Global Context Enhanced Anomaly Detection of Cyber Attacks via Decoupled Graph Neural Networks
This addresses the need for better anomaly detection in cybersecurity networks, though it appears to be an incremental improvement over existing GNN methods.
The paper tackles the problem of GNN-based anomaly detection for cyber attacks by proposing a decoupled GNN approach that separates node representation learning from classification, which achieves superior AUC performance compared to state-of-the-art models.
Recently, there has been a substantial amount of interest in GNN-based anomaly detection. Existing efforts have focused on simultaneously mastering the node representations and the classifier necessary for identifying abnormalities with relatively shallow models to create an embedding. Therefore, the existing state-of-the-art models are incapable of capturing nonlinear network information and producing suboptimal outcomes. In this thesis, we deploy decoupled GNNs to overcome this issue. Specifically, we decouple the essential node representations and classifier for detecting anomalies. In addition, for node representation learning, we develop a GNN architecture with two modules for aggregating node feature information to produce the final node embedding. Finally, we conduct empirical experiments to verify the effectiveness of our proposed approach. The findings demonstrate that decoupled training along with the global context enhanced representation of the nodes is superior to the state-of-the-art models in terms of AUC and introduces a novel way of capturing the node information.