Global Context Enhanced Anomaly Detection of Cyber Attacks via Decoupled Graph Neural Networks

TL;DR

This paper introduces a decoupled GNN approach with global context enhancement for anomaly detection in cyber networks, outperforming existing models in accuracy by capturing richer node information.

Contribution

It proposes a novel decoupled GNN architecture with global context enhancement, improving anomaly detection performance over shallow models.

Findings

Decoupled training improves detection accuracy.

Global context enhances node representations.

Outperforms state-of-the-art models in AUC.

Abstract

Recently, there has been a substantial amount of interest in GNN-based anomaly detection. Existing efforts have focused on simultaneously mastering the node representations and the classifier necessary for identifying abnormalities with relatively shallow models to create an embedding. Therefore, the existing state-of-the-art models are incapable of capturing nonlinear network information and producing suboptimal outcomes. In this thesis, we deploy decoupled GNNs to overcome this issue. Specifically, we decouple the essential node representations and classifier for detecting anomalies. In addition, for node representation learning, we develop a GNN architecture with two modules for aggregating node feature information to produce the final node embedding. Finally, we conduct empirical experiments to verify the effectiveness of our proposed approach. The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.