PaperlayerView exact revision on arXiv

Source-linked AI summary

Few-shot Network Anomaly Detection via Cross-network Meta-learning

Kaize Ding, Qinghai Zhou, Hanghang Tong, Huan Liu

arXiv:2102.11165v1cs.LG

TL;DR

Few-shot network anomaly detection must use scarce labels while avoiding irrelevant anomalies identified by unsupervised methods, and existing work largely overlooks related networks as sources of supervision. The paper proposes GDN and Meta-GDN, which enforce anomaly-score deviations within networks and transfer meta-knowledge from multiple auxiliary networks. Experiments demonstrate superior performance on few-shot network anomaly detection, including one-shot settings.

  • Problem

    Anomaly labels are costly, while unsupervised methods may detect noise or uninteresting instances and commonly omit labeled anomalies from similar networks.

  • Method

    GDN uses limited labeled anomalies to enforce statistically significant score deviations, while Meta-GDN transfers learned initialization and meta-knowledge from multiple auxiliary networks.

  • Results

    Extensive evaluations demonstrate Meta-GDN’s superiority over state-of-the-art methods for few-shot network anomaly detection.

  • Takeaways & Limitations

    Cross-network meta-learning can support few-shot anomaly detection on a target network by exploiting comprehensive knowledge from multiple auxiliary networks.

  • Takeaways & Limitations

    GDN assumes Gaussian abnormality scores and treats unlabeled nodes as normal, introducing contamination from unlabeled anomalies into training data.

Abstract

from arXiv · show

Network anomaly detection aims to find network elements (e.g., nodes, edges, subgraphs) with significantly different behaviors from the vast majority. It has a profound impact in a variety of applications ranging from finance, healthcare to social network analysis. Due to the unbearable labeling cost, existing methods are predominately developed in an unsupervised manner. Nonetheless, the anomalies they identify may turn out to be data noises or uninteresting data instances due to the lack of prior knowledge on the anomalies of interest. Hence, it is critical to investigate and develop few-shot learning for network anomaly detection. In real-world scenarios, few labeled anomalies are also easy to be accessed on similar networks from the same domain as of the target network, while most of the existing works omit to leverage them and merely focus on a single network. Taking advantage of this potential, in this work, we tackle the problem of few-shot network anomaly detection by (1) proposing a new family of graph neural networks -- Graph Deviation Networks (GDN) that can leverage a small number of labeled anomalies for enforcing statistically significant deviations between abnormal and normal nodes on a network; and (2) equipping the proposed GDN with a new cross-network meta-learning algorithm to realize few-shot network anomaly detection by transferring meta-knowledge from multiple auxiliary networks. Extensive evaluations demonstrate the efficacy of the proposed approach on few-shot or even one-shot network anomaly detection.

1 INTRODUCTION

Network anomaly detection is important but difficult because anomalies are costly to label, and unsupervised methods may identify irrelevant instances. The paper introduces GDN and Meta-GDN to use few labeled anomalies and transfer knowledge across similar networks.

  • Network anomalies can have highly detrimental effects, motivating their detection across social, citation, and other networked systems.
  • Unsupervised methods dominate because anomaly labeling is labor-intensive and requires specialized domain knowledge.Such methods may identify data noise or uninteresting instances because they lack prior knowledge about anomalies of interest.
  • Similar networks can provide transferable anomaly knowledge because they share topological structures and nodal attributes.The paper studies few-shot anomaly detection under this cross-network setting.
  • GDN assigns node anomaly scores and uses deviation loss to enforce statistically significant separation between abnormal and normal nodes.This addresses incomplete supervision when only limited labeled anomalies are available.
  • Meta-GDN learns a generalized GDN initialization from multiple auxiliary networks for few-shot detection on a target network.The framework is designed to extract comprehensive meta-knowledge across networks rather than relying on one source network.
  • Extensive experiments report superior Meta-GDN performance over state-of-the-art methods for network anomaly detection with few labeled instances.

2 RELATED WORK

Prior work studies anomaly detection on plain and attributed networks, while graph neural networks learn network representations and increasingly support knowledge transfer across graphs.

  • 2.1 Network Anomaly Detection: Network anomaly detection methods exploit network structure, with attributed-network methods additionally using node features.Examples include structural anomaly detection and local-context anomaly ranking.
  • 2.2 Graph Neural Networks: Graph neural networks transform graph information into low-dimensional latent representations through learned aggregation or convolution mechanisms.
  • 2.2 Graph Neural Networks: Figure 2 presents GDN for limited-label anomaly detection and Meta-GDN for adaptation from auxiliary networks to a target network.
  • 2.2 Graph Neural Networks: GraphSAGE, GAT, and GIN support generalization, attention-based aggregation, or expressive multiset processing for graph representation learning.
  • 2.2 Graph Neural Networks: Recent methods integrate GNNs with meta-learning to transfer knowledge across multiple graphs.The cited examples include robustness transfer and graph alignment across networks.

3 PROBLEM DEFINITION

The paper formulates few-shot cross-network anomaly detection as ranking abnormal nodes in a target attributed network using limited labeled anomalies from related auxiliary networks.

  • An attributed network is represented by nodes, edges, and node attributes, with structure encoded by an adjacency matrix.
  • The task transfers limited supervised knowledge from auxiliary networks to improve anomaly detection on a target network.
  • Auxiliary and target networks are assumed to share the same or a similar domain.The setup contains P auxiliary networks and a target network.
  • Only a few anomalies are labeled, so the labeled-node set is much smaller than the unlabeled-node set.
  • The detection objective is to rank abnormal nodes above normal nodes in the target network.

4 PROPOSED APPROACH

Meta-GDN combines Graph Deviation Networks with cross-network meta-learning for few-shot anomaly detection. GDN learns node representations and anomaly scores using deviation from a reference score, while Meta-GDN transfers knowledge from multiple auxiliary networks to a target network.

  • Cross-network Meta-learning: Meta-GDN transfers meta-knowledge from multiple auxiliary networks to initialize GDN for few-shot anomaly detection on a target network.Multiple auxiliary networks are used to distill broader anomaly knowledge, addressing the potential negative transfer associated with relying on only one network.
  • Graph Deviation Networks: GDN comprises a network encoder, an abnormality valuator, and a deviation loss for detecting anomalies with few-shot labeled data.The encoder learns node representations, the valuator estimates scalar anomaly scores, and the deviation loss optimizes the model.
  • Graph Deviation Networks: The network encoder stacks GNN layers to aggregate neighborhood information and capture long-range node dependencies.It is compatible with arbitrary GNN-based architectures; the implementation uses Simple Graph Convolution.
  • Graph Deviation Networks: GDN maps an input network to scalar anomaly scores and trains end-to-end with a deviation loss based on a reference score.The reference score is the mean of sampled anomaly scores from a Gaussian prior, and the deviation measures distance from that reference.
  • Graph Deviation Networks: The deviation loss pulls normal-node scores toward the reference while enforcing abnormal-node deviations of at least m.This lets GDN learn normal-pattern abstractions with fewer labeled anomalies and assign larger scores to substantially deviating nodes.
  • Cross-network Meta-learning: Each auxiliary network defines a learning task, and meta-optimization adapts the model to tasks before optimizing parameters across tasks.The task-specific update uses a gradient step controlled by the meta-learning rate, while the learned parameters preserve anomaly-detection capability across networks.

5 EXPERIMENTS

The experiments evaluate Meta-GDN on three real-world datasets against multiple anomaly-detection baselines, including few-shot, sensitivity, robustness, and ablation analyses. Results show strong performance, benefits from additional auxiliary networks and labeled anomalies, robustness to contamination, and contributions from both network encoding and cross-network meta-learning.

  • Experimental setup: Experiments use three real-world datasets and compare Meta-GDN and GDN with feature-based, unsupervised, semi-supervised, and network-anomaly baselines.The datasets include Yelp, PubMed, and Reddit; PubMed and Reddit use injected structural and contextual anomalies.
  • Effectiveness results: Meta-GDN outperforms the compared methods on 10-shot AUC-ROC and AUC-PR, while also ranking abnormal nodes more accurately by Precision@K.The evaluation includes Table 2 for AUC-ROC and AUC-PR and Figure 3 for Precision@K.
  • Few-shot evaluation: More labeled anomalies improve Meta-GDN’s performance, demonstrating that the model can be better fine-tuned on the target network with additional examples.The few-shot evaluation includes AUC-ROC and AUC-PR across different numbers of labeled anomalies.
  • Sensitivity and robustness: Meta-GDN achieves stronger performance as the number of auxiliary networks increases, while remaining relatively robust when anomaly contamination rises.Performance decreases for all methods with increasing contamination, but Meta-GDN and GDN remain robust and outperform SemiGNN.
  • Ablation study: GDN improves precision@100 by 8.1% over GDN− on PubMed, while Meta-GDN improves AUC-ROC by 5.75% over GDN on Yelp.The ablation attributes the first improvement to the GNN-based network encoder and uses the second to verify cross-network meta-learning.

6 CONCLUSION

The paper introduces few-shot cross-network anomaly detection through GDN and Meta-GDN, and reports superiority over state-of-the-art methods in extensive evaluations.

  • GDN leverages limited labeled anomalies to enforce statistically significant deviations between abnormal and normal nodes on an individual network.
  • Meta-GDN transfers comprehensive meta-knowledge from multiple auxiliary networks in the target network’s domain for few-shot anomaly detection.
  • Extensive experimental evaluations demonstrate Meta-GDN’s superiority over state-of-the-art methods.
Loading 2102.11165v1…