摘要：

网络异常检测的目的在于及时识别并响应网络中的恶意活动和潜在威胁。大多数基于图嵌入的异常检测方法主要用于静态图, 忽略了细粒度的时间信息, 无法捕获动态网络行为的连续性, 从而降低了网络异常检测性能。为了提高动态网络异常检测的效率和准确性, 提出一个融合动态图嵌入和Transformer自编码器的网络异常检测方法。该方法利用时间游走的图嵌入技术捕获网络拓扑结构和细粒度的时间信息, 结合对比损失的Transformer自编码器来优化节点嵌入表示并捕获长期依赖和全局信息, 增强了模型对动态网络的感知能力, 能更好地捕捉动态网络中随时间变化的事件, 识别网络中的恶意行为。在公开的网络安全领域数据集上进行的大量实验结果表明, 该方法在LANL-2015数据集上的真阳率(TPR)为94.3%、假阳率(FPR)为5.7%、曲线下面积(AUC)为98.3%, 在OpTC数据集上的TPR为99.9%、FPR为0.01%、AUC为99.9%, 异常检测结果优于基准方法。上述结果说明了该方法可以有效地学习动态网络中的拓扑和长短期时间依赖信息, 识别网络中的异常行为。

关键词: 动态图嵌入, Transformer自编码器, 网络异常检测, 恶意行为, 长短期时间依赖

Abstract:

Network anomaly detection aims to promptly identify and respond to malicious activities and potential threats within networks. Most existing graph-embedding-based methods are designed for static graphs and neglect fine-grained temporal information, thus failing to capture the continuity of dynamic network behaviors and diminishing the effectiveness of network anomaly detection. To enhance the efficiency and accuracy of dynamic network anomaly detection, this study proposes a novel method integrating dynamic graph embedding and Transformer autoencoders. This method leverages temporal-walk-based graph embedding to capture the topological structure and detailed temporal information of the network. It incorporates a Transformer autoencoder with contrastive loss to optimize node embeddings and effectively capture long-term dependencies and global information. This integration enhances the model's ability to perceive dynamic networks, facilitating better detection of time-evolving events and the identification of malicious behaviors. The effectiveness of this method is validated through extensive experiments conducted on two publicly available datasets in network security. Its superior performance on the LANL-2015 dataset is indicated with a True Positive Rate (TPR) of 94.3%, False Positive Rate (FPR) of 5.7%, and an Area Under the Curve (AUC) of 98.3%. Further, on the OpTC dataset, the method achieves a TPR of 99.9%, a FPR of 0.01%, and an AUC of 99.9%. These results demonstrate that the proposed method effectively learns the topology and temporal dependencies of dynamic networks, thereby accurately identifying network anomalies.

Key words: dynamic graph embedding, Transformer autoencoder, network anomaly detection, malicious behavior, long and short-term time-dependence