ARES: Anomaly Recognition Model For Edge Streams

TL;DR

ARES is an unsupervised framework that combines Graph Neural Networks and Half-Space Trees to detect anomalies in real-time edge streams within dynamic temporal graphs, addressing challenges like concept drift and large data volumes.

Contribution

It introduces a novel unsupervised anomaly detection method for edge streams that integrates GNNs with HSTs and includes a minimal supervised thresholding mechanism for improved accuracy.

Findings

Effective detection of anomalies in real-world cyber-attack scenarios

Operates efficiently with low space and time complexity

Outperforms existing methods in accuracy and adaptability

Abstract

Many real-world scenarios involving streaming information can be represented as temporal graphs, where data flows through dynamic changes in edges over time. Anomaly detection in this context has the objective of identifying unusual temporal connections within the graph structure. Detecting edge anomalies in real time is crucial for mitigating potential risks. Unlike traditional anomaly detection, this task is particularly challenging due to concept drifts, large data volumes, and the need for real-time response. To face these challenges, we introduce ARES, an unsupervised anomaly detection framework for edge streams. ARES combines Graph Neural Networks (GNNs) for feature extraction with Half-Space Trees (HST) for anomaly scoring. GNNs capture both spike and burst anomalous behaviors within streams by embedding node and edge properties in a latent space, while HST partitions this space to isolate anomalies efficiently. ARES operates in an unsupervised way without the need for prior data labeling. To further validate its detection capabilities, we additionally incorporate a simple yet effective supervised thresholding mechanism. This approach leverages statistical dispersion among anomaly scores to determine the optimal threshold using a minimal set of labeled data, ensuring adaptability across different domains. We validate ARES through extensive evaluations across several real-world cyber-attack scenarios, comparing its performance against existing methods while analyzing its space and time complexity.