检索结果-内蒙古大学图书馆

Fraud detection: A systematic literature review of graph-based anomaly detection approaches

DECISION SUPPORT SYSTEMS 2020年 133卷 113303-113303页

作者： Pourhabibi, Tahereh Ong, Kok-Leong Kam, Booi H. Boo, Yee Ling RMIT Univ Sch Accounting Informat Syst & Supply Chain Melbourne Vic Australia La Trobe Univ Ctr Data Analyt & Cognit Melbourne Vic Australia

graph-based anomaly detection (GBAD) approaches are among the most popular techniques used to analyze connectivity patterns in communication networks and identify suspicious behaviors. Given the different GBAD approaches proposed for fraud detection, in this study, we develop a framework to synthesize the existing literature on the application of GBAD methods in fraud detection published between 2007 and 2018. This study aims to investigate the present trends and identify the key challenges that require significant research efforts to increase the credibility of the technique. Additionally, we provide some recommendations to deal with these challenges.

关键词： Fraud detection graph-based anomaly detection graph data Systematic literature review Social network Big data analytics

来源：评论

学校读者我要写书评

暂无评论

Intrusion detection in IoT Networks Using Dynamic graph Modeling and graph-based Neural Networks

引用

IEEE ACCESS 2025年 13卷 65356-65375页

作者： Villegas-Ch, William Govea, Jaime Navarro, Alexandra Maldonado Jativa, Pablo Palacios Univ Las Amer Escuela Ingn Cibersegur FICA Quito 170125 Ecuador Univ Las Amer Escuela Postgrad Derecho Quito 170125 Ecuador Univ Diego Portales Escuela Informat & Telecomunicac Santiago 8370191 Chile

The rapid expansion of Internet of Things (IoT) networks has significantly increased security vulnerabilities, exposing critical infrastructures to sophisticated cyberattacks. Traditional Intrusion detection Systems, based mainly on signature matching and predefined rules, present limitations in identifying emerging threats and distributed attacks due to their inability to analyze complex interactions within IoT networks. To address this problem, this study proposes a graph-based intrusion detection model using graph Neural Networks (GNNs), leveraging a dynamic representation of IoT network traffic. In this model, devices are represented as nodes and communications as weighted edges, integrating features such as communication frequency, transmitted data volume, and protocol type. The proposed method was evaluated using a customized dataset from a simulated IoT network to reflect real-world attack scenarios, including Denial of Service, Spoofing, and Man-in-the-Middle. Experimental results demonstrate that our GNN-based model significantly outperforms traditional machine learning methods, achieving an F1-Score of 0.95 and an AUC-ROC of 0.98, compared to values between 0.84 and 0.91 for Support Vector Machines and Random Forests. Furthermore, the system reduces the false positive rate by 40% compared to signature-based IDS, improving its applicability in operational environments. The model also proved scalable, maintaining an inference time of 2.5 ms per sample on graphs of up to 10,000 nodes, making it viable for real-time deployment. These findings confirm that graph-based anomaly detection is a promising approach for securing large-scale IoT infrastructures, providing increased precision, adaptability, and robustness against emerging cyber threats.

关键词： Adaptation models Intrusion detection Internet of Things Telecommunication traffic Real-time systems Image edge detection Computational modeling Protocols Feature extraction anomaly detection graph neural networks (GNNs) intrusion detection in IoT graph-based anomaly detection cybersecurity in IoT networks

来源：评论

学校读者我要写书评

暂无评论

Coupled-Space Attacks Against Random-Walk-based anomaly detection

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2024年 19卷 9315-9329页

作者： Lai, Yuni Waniek, Marcin Li, Liying Wu, Jingwen Zhu, Yulin Michalak, Tomasz P. Rahwan, Talal Zhou, Kai Hong Kong Polytech Univ Dept Comp Hong Kong Peoples R China Univ Warsaw Inst Informat PL-02093 Warsaw Poland New York Univ Abu Dhabi Dept Comp Sci Abu Dhabi U Arab Emirates

Random Walks-based anomaly detection (RWAD) is commonly used to identify anomalous patterns in various applications. An intriguing characteristic of RWAD is that the input graph can either be pre-existing graphs or feature-derived graphs constructed from raw features. Consequently, there are two potential attack surfaces against RWAD: graph-space attacks and feature-space attacks. In this paper, we explore this vulnerability by designing practical coupled-space (interdependent feature-space and graph-space) attacks, investigating the interplay between graph-space and feature-space attacks. To this end, we conduct a thorough complexity analysis, proving that attacking RWAD is NP-hard. Then, we proceed to formulate the graph-space attack as a bi-level optimization problem and propose two strategies to solve it: alternative iteration (alterI-attack) or utilizing the closed-form solution of the random walk model (cf-attack). Finally, we utilize the results from the graph-space attacks as guidance to design more powerful feature-space attacks (i.e., graph-guided attacks). Comprehensive experiments demonstrate that our proposed attacks are effective in enabling the target nodes to evade the detection from RWAD with a limited attack budget. In addition, we conduct transfer attack experiments in a black-box setting, which show that our feature attack significantly decreases the anomaly scores of target nodes. Our study opens the door to studying the coupled-space attack against graph anomaly detection in which the graph space relies on the feature space.

关键词： anomaly detection Feature extraction Optimization Robustness Security Vectors Pipelines graph-based anomaly detection random walk poisoning attack adversarial attacks security and privacy

来源：评论

学校读者我要写书评

暂无评论

anomaly detection in data represented as graphs

引用

INTELLIGENT DATA ANALYSIS 2007年第6期11卷 663-689页

作者： Eberle, William Holder, Lawrence Tennessee Technol Univ Dept Comp Sci Cookeville TN 38505 USA Washington State Univ Sch Elect Engn & Comp Sci Pullman WA 99164 USA

An important area of data mining is anomaly detection, particularly for fraud. However, little work has been done in terms of detecting anomalies in data that is represented as a graph. In this paper we present graph-based approaches to uncovering anomalies in domains where the anomalies consist of unexpected entity/relationship alterations that closely resemble non-anomalous behavior. We have developed three algorithms for the purpose of detecting anomalies in all three types of possible graph changes: label modifications, vertex/edge insertions and vertex/edge deletions. Each of our algorithms focuses on one of these anomalous types, using the minimum description length principle to first discover the normative pattern. Once the common pattern is known, each algorithm then uses a different approach to discover particular anomalous types. In this paper, we validate all three approaches using synthetic data, verifying that each of the algorithms on graphs and anomalies of varying sizes, are able to detect the anomalies with very high detection rates and minimal false positives. We then further validate the algorithms using real-world cargo data and actual fraud scenarios injected into the data set with 100% accuracy and no false positives. Each of these algorithms demonstrates the usefulness of examining a graph-based representation of data for the purposes of detecting fraud.

关键词： graph-based anomaly detection minimum description length principle information theoretic compression

来源：评论

学校读者我要写书评

暂无评论

A review of social network centric anomaly detection techniques

引用

INTERNATIONAL JOURNAL OF COMMUNICATION NETWORKS AND DISTRIBUTED SYSTEMS 2016年第4期17卷 358-386页

作者： Kaur, Ravneet Singh, Sarbjeet Panjab Univ UIET Dept Comp Sci & Engn Chandigarh 160014 India

Online social networks have gained much attention in the recent years in terms of their analysis for usage as well as detection of abnormal activities. Anomalous activities arise when someone shows a different behaviour than others in the network. Presence of these anomalies may pose a number of problems which need to be addressed. This paper discusses different types of anomalies and their novel categorisation based on various factors. A review of various techniques used for detecting anomalies along with underlying assumptions and reasons for the presence of such anomalies is also covered. A special reference is made to different data mining approaches used to detect anomalies. However, the major focus of paper is the analysis of social network centric anomaly detection approaches which are broadly classified as behaviour-based, structure-based and spectral-based. Each one of this classification further incorporates a number of techniques which are discussed in the paper.

关键词： anomaly detection classification clustering centrality data mining graph-based anomaly detection online social networks social network analysis proximity static networks dynamic networks

来源：评论

学校读者我要写书评

暂无评论

graph Filtering to Remove the "Middle Ground" for anomaly detection 8

Graph Filtering to Remove the "Middle Ground" for Anomaly De...

引用

8th IEEE International Conference on Big Data (Big Data)

作者： Eberle, William Holder, Lawrence Tennessee Technol Univ Dept Comp Sci Cookeville TN 38505 USA Washington State Univ Sch Elect Engn & Comp Sci Pullman WA 99164 USA

ISBN: (纸本)9781728162515

Discovering patterns and anomalies in a variety of voluminous data represented as a graph is challenging. Current research has demonstrated success discovering graph patterns using a sampling of the data, but there has been little work when it comes to discovering anomalies that are based upon understanding what is normative. In this work we present two approaches to reducing graph data: subgraph filtering and graph filtering. The idea behind the proposed algorithms is the removal of a "murky middle", where data that may not be normative or anomalous, is removed from the discovery process. We empirically validate the proposed approach on real-world, pseudo-real-world, and synthetic data, as well as compare against a similar approach.

关键词： graph-based anomaly detection graph filtering knowledge discovery

来源：评论

学校读者我要写书评

暂无评论

Collusive anomalies detection based on collaborative markov random field

引用

INTELLIGENT DATA ANALYSIS 2022年第6期26卷 1469-1485页

作者： Shi, Haoran Ji, Lixin Liu, Shuxin Wang, Kai Hu, Xinxin PLA Strateg Support Force Informat Engn Univ Inst Informat Technol Zhengzhou 450000 Henan Peoples R China

Abnormal collusive behavior, widely existing in various fields with concealment and synergy, is particularly harmful in user-generated online reviews and hard to detect by traditional methods. With the development of network science, this problem can be solved by analyzing structure features. As a graph-based anomaly detection method, the Markov random field (MRF)-based model has been widely used to identify the collusive anomalies and shown its effectiveness. However, existing methods are mostly unable to highlight the primary synergy relationship among nodes and consider much irrelevant information, which caused poor detectability. Therefore, this paper proposes a novel MRF-based method (ACEagle), considering node-level and community-level behavior features. Our method has several advantages: (1) based on the analysis of the nodes' local structure, the community-level behavioral features are combined to calculate the nodes' prior probability to close the ground truth, (2) it measured the behavior's collaborative intensity between nodes by time and weight, constructing MRF by the synergic relationship exceeding the threshold to filter irrelevant structural information, (3) it operates in a completely unsupervised fashion requiring no labeled data, while still incorporating side information if available. Through experiments in user-reviewed datasets where abnormal collusive behavior is most typical, the results show that ACEagle is significantly outperforming state-of-the-art baselines in collusive anomalies detection.

关键词： Collusive behavior structure features graph-based anomaly detection markov random field user-generated online reviews

来源：评论

学校读者我要写书评

暂无评论

NLP-based Entity Behavior Analytics for Malware detection

NLP-based Entity Behavior Analytics for Malware Detection

引用

40th IEEE International Performance, Computing, and Communications Conference (IPCCC)

作者： Najafi, Pejman Koehler, Daniel Cheng, Feng Meinel, Christoph Hasso Plattner Inst Potsdam Germany

ISBN: (纸本)9781665443319

In this research, we formulate malware detection as a large-scale data-mining problem within Security Information and Event Management (SIEM) systems. We hypothesize that behavioral analysis of executable/process activities, such as file reads/writes, process creations, network connections, or registry modifications, enables the detection of advanced stealthy malware. To achieve this detection, we model processes behaviors as a set of directed acyclic graph streams and identify outliers in the set of graph streams. We enable this detection by conversion of the behavioral graph streams into documents, embedding using state-of-the-art Natural Language Processing model, and eventually performing novel outlier detection on the high dimensional vector representation of the documents. We evaluate our approach in a real-world setting, next to the SIEM system of a large-scale international enterprise (over 3TB of EDR logs). The proposed method has shown the capability to detect previously unknown threats.

关键词： Malware detection behavior analytics data mining SIEM NLP graph-based anomaly detection

来源：评论

学校读者我要写书评

暂无评论

Detecting Suspicious Behavior Using a graph-based Approach

Detecting Suspicious Behavior Using a Graph-Based Approach

引用

IEEE Conference Visual Analytics Sci Technology

作者： Mookiah, Lenin Eberle, William Holder, Lawrence Tennessee Technol Univ Cookeville TN 38505 USA Washington State Univ Pullman WA 99164 USA

ISBN: (纸本)9781479962273

The ability to discover illicit behaviour in complex, heterogeneous data is a daunting problem. In the VAST 2014 competition, one of the challenges involves identifying for local law enforcement which employees are involved and where they should be concentrating their efforts. One approach to handling this problem is a graph-based approach. In this paper, we present a graphbased anomaly detection approach for discovering suspicious employees and geographic locations.

关键词： graph-based anomaly detection knowledge discovery H.2.8 [Database Management]: Database Applications Data Mining

来源：评论

学校读者我要写书评

暂无评论

Security Auditing in the Fog 17

Security Auditing in the Fog

引用

2nd International Conference on Internet of things, Data and Cloud Computing (ICC)

作者： Parkinson, Simon Qin, Yongrui Khan, Saad Vallati, Mauro Univ Huddersfield Dept Informat Huddersfield HD1 3DH W Yorkshire England

ISBN: (纸本)9781450347747

Technology specific expert knowledge is often required to analyse security configurations and determine potential vulnerabilities, but it becomes difficult when it is a new technology such as Fog computing. Furthermore, additional knowledge is also required regarding how the security configuration has been constructed in respect to an organisation's security policies. Traditionally, organisations will often manage their access control permissions relative to their employees needs, posing challenges to administrators. This problem is even exacerbated in Fog computing systems where security configurations are implemented on a large amount of devices at the edges of Internet, and the administrators are required to retain adequate knowledge on how to perform complex administrative tasks. In this paper, a novel approach of translating object-based security configurations in to a graph model is presented. A technique is then developed to autonomously identify vulnerabilities and perform security auditing of large systems without the need for expert knowledge. Throughout the paper, access control configuration data is used as a case study, and empirical analysis is performed on synthetically generated access control permissions.

关键词： Fog computing security auditing graph-based anomaly detection synthetic data sets

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：