用变分图自编码器实现无监督网络异常检测，无需标注数据
AutoGraphAD: Unsupervised network anomaly detection using Variational Graph Autoencoders
- 基于异构图的变分自编码器，从连接与IP节点构建网络活动图
- 无监督训练下达到与有监督方法相当的检测性能，误报率更低
- 适合需要快速部署的实时网络监控场景，训练推理速度提升超10倍
网络入侵检测系统（NIDS）在识别网络攻击中至关重要。尽管已有大量研究使用监督机器学习进行攻击检测与分类，但这些方法依赖精确标注的数据集，获取成本极高。此外，现有公开数据集涵盖的攻击类型有限且过时，许多还存在标签错误问题。为减少对标注数据的依赖，本文提出AutoGraphAD，一种基于异构变分图自编码器的新型无监督异常检测方法。该模型在由连接节点和IP节点构成的异构图上运行，通过无监督与对比学习进行训练，不依赖任何标注数据。模型损失经加权融合生成异常评分，用于异常检测。实验表明，AutoGraphAD在多数情况下性能不低于Anomal-E，且无需额外下游异常检测器。整体实现约1.18个数量级的训练加速和1.03个数量级的推理加速，显著提升实际部署效率。
原文摘要 · Abstract (English)
Network Intrusion Detection Systems (NIDS) are essential tools for detecting network attacks and intrusions. While extensive research has explored the use of supervised Machine Learning for attack detection and characterisation, these methods require accurately labelled datasets, which are very costly to obtain. Moreover, existing public datasets have limited and/or outdated attacks, and many of them suffer from mislabelled data. To reduce the reliance on labelled data, we propose AutoGraphAD, a novel unsupervised anomaly detection approach based on a Heterogeneous Variational Graph Autoencoder. AutoGraphAD operates on heterogeneous graphs, made from connection and IP nodes that represent network activity. The model is trained using unsupervised and contrastive learning, without relying on any labelled data. The model's losses are then weighted and combined in an anomaly score used for anomaly detection. Overall, AutoGraphAD yields the same, and in some cases better, results than Anomal-E, but without requiring costly downstream anomaly detectors. As a result, AutoGraphAD achieves around 1.18 orders of magnitude faster training and 1.03 orders of magnitude faster inference, which represents a significant advantage for operational deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。