A deep co-evolution architecture for anomaly detection in dynamic networks

• Published in: Multimedia tools and applications 2024-04, Vol.83 (14), p.40489-40508
• Main Authors: Hayat, Malik Khizar, Daud, Ali, Banjar, Ameen, Alharbey, Riad, Bukhari, Amal
• Format: Article
• Language: English
• Subjects: Anomalies; Citations; Combinatorial analysis; Computer architecture; Computer Communication Networks; Computer Science; Cybersecurity; Data Structures and Information Theory; Evolution; Graph neural networks; Keywords; Multimedia; Multimedia Information Systems; Neural networks; Nodes; Semantics; Social networks; Special Purpose and Application-Based Systems; Venue
• ISSN: 1573-7721; 1380-7501; 1573-7721
• DOI: 10.1007/s11042-023-17126-7

Heterogeneous Information Networks (HINs) are ubiquitous in the real world, and discovering anomalies is essential for understanding network semantics through nodes and edges. Evolution in the nodes along with their attributes leverages the probability of anomalies in the network. Recently, detecting anomalous nodes on attributed graphs has attracted an increasing amount of research attention, with wide-ranging applications in various high-impact domains, such as cybersecurity, finance, healthcare, social networks, and so on. Most of the existing efforts try to capture the evolution structure for anomaly detection problem in HINs with emphasis on the nodes merely. However, technically, in a dynamic attributed network, anomalies occur due to the co-evolution of node attributes that is ignored and needs attention. Consequently, modeling the co-evolution of attributes and their influence over linked nodes is important to tackle the anomaly detection problem. In this paper, we propose a DEep Co-evolution architecture for anOmaly DetEction (DECODE) in HINs. Particularly, the proposed architecture learns the combined embeddings for node and attributes for time-evolving attributed networks. A three-layered Graph Neural Network (GNN) is used for network embedding learning. The approximated Betweenness Centrality (BC) measure is employed to model the dynamic influence of attributes over linked nodes in a Long Short-term Memory (LSTM) layer. The combinatorial effect of GNN and LSTM helps to spot the anomalies by computing network reconstruction errors in terms of both nodes and attributes. Experimentation on real-world dataset depicts the effectiveness of the proposed architecture with the 10.74% performance increase in BlogCatalog, 9.59% in Amazon, and 17.1% increase in ArnetMiner data.