将领域知识融入图神经网络,提升异常检测泛化能力。
KnowGraph: Knowledge-Enabled Anomaly Detection via Logical Reasoning on Graph Data
- 用多知识模型与主模型协同,捕捉领域语义特征
- 通过概率图模型推理,实现基于逻辑公式的知识融合
- 在极端类别不平衡下仍表现优异,适合安全场景
基于图的异常检测在欺诈识别和网络入侵检测等安全应用中至关重要。传统方法如图神经网络(GNN)在数据分布变化时泛化能力不足。现实中的领域知识相对稳定,是现有检测策略的重要组成部分。为将此类知识显式融入数据驱动模型(如GCN),我们提出KnowGraph,通过统计学习与逻辑推理双组件实现知识增强的图异常检测。其一,主模型结合多个专用知识模型预测领域特定语义实体;其二,利用概率图模型基于模型输出进行逻辑推理,通过加权一阶逻辑公式编码领域知识。在多个大规模真实数据集上的实验表明,KnowGraph在半监督与归纳设置下均显著优于当前最优基线,在完全未见测试图上平均精度提升明显。消融研究进一步验证了推理组件的有效性,尤其在极端类别不平衡场景下表现突出。结果表明,将领域知识融入数据驱动模型,对高风险图安全应用具有重要潜力。
原文摘要 · Abstract (English)
Graph-based anomaly detection is pivotal in diverse security applications, such as fraud detection in transaction networks and intrusion detection for network traffic. Standard approaches, including Graph Neural Networks (GNNs), often struggle to generalize across shifting data distributions. Meanwhile, real-world domain knowledge is more stable and a common existing component of real-world detection strategies. To explicitly integrate such knowledge into data-driven models such as GCNs, we propose KnowGraph, which integrates domain knowledge with data-driven learning for enhanced graph-based anomaly detection. KnowGraph comprises two principal components: (1) a statistical learning component that utilizes a main model for the overarching detection task, augmented by multiple specialized knowledge models that predict domain-specific semantic entities; (2) a reasoning component that employs probabilistic graphical models to execute logical inferences based on model outputs, encoding domain knowledge through weighted first-order logic formulas. Extensive experiments on these large-scale real-world datasets show that KnowGraph consistently outperforms state-of-the-art baselines in both transductive and inductive settings, achieving substantial gains in average precision when generalizing to completely unseen test graphs. Further ablation studies demonstrate the effectiveness of the proposed reasoning component in improving detection performance, especially under extreme class imbalance. These results highlight the potential of integrating domain knowledge into data-driven models for high-stakes, graph-based security applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。