DAS-GNN: A SCALABLE DISAGREEMENT-AWARE GRAPH NEURAL FRAMEWORK FOR ANOMALY DETECTION IN LARGE-SCALE NETWORKS
Keywords:
Anomaly detection, Graph neural networks, Network intrusion detection, Scalable graph learning, Decoupled propagationAbstract
Graph neural networks can exploit relational context for anomaly detection, but repeated neighborhood expansion and dense graph construction make many designs difficult to deploy on large network-flow collections. This paper presents DAS-GNN, a decoupled disagreement-aware framework that converts flow records into a deterministic, degree-capped locality graph and performs graph propagation only once. The graph is built without labels by combining categorical signatures with multiple random-projection orderings, avoiding an all-pairs nearest-neighbor search. A cosine-gated context channel estimates locally stable behavior, while an explicit deviation channel preserves the absolute disagreement between each record and its neighborhood together with similarity, entropy, and categorical-agreement statistics. The resulting graph views are trained with ordinary dense mini-batches, so each epoch is independent of edge traversal. Experiments use the official UNSW-NB15 partition with 257,673 labeled network flows. Across three seeds, DAS-GNN obtains 0.9721±0.0004 ROC-AUC, 0.9794±0.0003 PR-AUC, and 0.8771±0.0022 F1, improving the matched MLP by 0.0042, 0.0029, and 0.0083, respectively. A strong LightGBM baseline remains best at 0.9852 ROC-AUC, which bounds the claim: the contribution is scalable graph-context enhancement rather than universal dominance over tabular boosting. On the complete graph, construction plus propagation takes 1.59 s in a controlled CPU scaling run; a 500,000-node stress graph takes 4.46 s.References
[1] Pang G, Shen C, Cao L, et al. Deep learning for anomaly detection: A review. ACM Computing Surveys, 2021, 54(2): 38, 1-38. DOI: 10.1145/3439950.
[2] Liu F T, Ting K M, Zhou Z H. Isolation forest. In: Proceedings of the 8th IEEE International Conference on Data Mining, 2008: 413-422. DOI: 10.1109/ICDM.2008.17.
[3] Breunig M M, Kriegel H P, Ng R T, et al. LOF: Identifying density-based local outliers. In: Proceedings of the ACM SIGMOD International Conference on Management of Data, 2000: 93-104. DOI: 10.1145/342009.335388.
[4] Kipf T N, Welling M. Semi-supervised classification with graph convolutional networks. In: Proceedings of the International Conference on Learning Representations (ICLR), 2017.
[5] Hamilton W L, Ying R, Leskovec J. Inductive representation learning on large graphs. In: Advances in Neural Information Processing Systems, 2017.
[6] Veličković P, Cucurull G, Casanova A, et al. Graph attention networks. In: Proceedings of the International Conference on Learning Representations (ICLR), 2018.
[7] Chen J, Ma T, Xiao C. FastGCN: Fast learning with graph convolutional networks via importance sampling. In: Proceedings of the International Conference on Learning Representations (ICLR), 2018.
[8] Zou D, Hu Z, Wang Y, et al. Layer-dependent importance sampling for training deep and large graph convolutional networks. In: Advances in Neural Information Processing Systems, 2019.
[9] Chiang W L, Liu X, Si S, et al. Cluster-GCN: An efficient algorithm for training deep and large graph convolutional networks. In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019: 257-266. DOI: 10.1145/3292500.3330925.
[10] Zeng H, Zhou H, Srivastava A, et al. GraphSAINT: Graph sampling based inductive learning method. In: Proceedings of the International Conference on Learning Representations (ICLR), 2020.
[11] Wu F, Souza A, Zhang T, et al. Simplifying graph convolutional networks. In: Proceedings of the 36th International Conference on Machine Learning, PMLR, 2019, 97: 6861-6871.
[12] Frasca F, Rossi E, Eynard D, et al. SIGN: Scalable inception graph neural networks. arXiv:2004.11198, 2020.
[13] Bojchevski A, Gasteiger J, Perozzi B, et al. Scaling graph neural networks with approximate PageRank. In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2020: 2464-2473. DOI: 10.1145/3394486.3403296.
[14] Ding K, Li J, Bhanushali R, et al. Deep anomaly detection on attributed networks. In: Proceedings of the SIAM International Conference on Data Mining (SDM), 2019: 594-602. DOI: 10.1137/1.9781611975673.67.
[15] Fan H, Zhang F, Li Z. AnomalyDAE: Dual autoencoder for anomaly detection on attributed networks. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020: 5685-5689. DOI: 10.1109/ICASSP40776.2020.9053387.
[16] Liu Y, Li Z, Pan S, et al. Anomaly detection on attributed networks via contrastive self-supervised learning. IEEE Transactions on Neural Networks and Learning Systems, 2022, 33(6): 2378-2392. DOI: 10.1109/TNNLS.2021.3068344.
[17] Dou Y, Liu Z, Sun L, et al. Enhancing graph neural network-based detectors against camouflaged fraudsters. In: Proceedings of the 29th ACM International Conference on Information & Knowledge Management, 2020: 315-324. DOI: 10.1145/3340531.3411903.
[18] Liu Y, Ao X, Qin Z, et al. Pick and choose: A GNN-based imbalanced learning approach for detection. In: Proceedings of the Web Conference, 2021: 3168-3177. DOI: 10.1145/3442381.3449989.
[19] Yuan X, Zhou N, Yu S, et al. Higher-order structure based anomaly detection on attributed networks. In: Proceedings of the IEEE International Conference on Big Data, 2021: 2691-2700. DOI: 10.1109/BigData52589.2021.9671990.
[20] Moustafa N, Slay J. UNSW-NB15: A comprehensive data set for network intrusion detection systems. In: Proceedings of the Military Communications and Information Systems Conference (MilCIS), 2015: 1-6. DOI: 10.1109/MilCIS.2015.7348942.
[21] Ke G, Meng Q, Finley T, et al. LightGBM: A highly efficient gradient boosting decision tree. In: Advances in Neural Information Processing Systems 30, 2017.
[22] Akoglu L, Tong H, Koutra D. Graph based anomaly detection and description: A survey. Data Mining and Knowledge Discovery, 2015, 29(3): 626-688. DOI: 10.1007/s10618-014-0365-y.
[23] Ma X, Wu J, Xue S, et al. A comprehensive survey on graph anomaly detection with deep learning. IEEE Transactions on Knowledge and Data Engineering, 2023, 35(12): 12012-12038. DOI: 10.1109/TKDE.2021.3118815.
[24] Huang X, Yang Y, Wang Y, et al. DGraph: A large-scale financial dataset for graph anomaly detection. In: Advances in Neural Information Processing Systems 2022: 22765-22777.
[25] Liu K, Dou Y, Zhao Y, et al. PyGOD: A Python library for graph outlier detection. arXiv:2204.12095, 2022.
[26] Ying R, He R, Chen K, et al. Graph convolutional neural networks for web-scale recommender systems. In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2018: 974-983. DOI: 10.1145/3219819.3219890.
[27] Davis J, Goadrich M. The relationship between Precision-Recall and ROC curves. In: Proceedings of the 23rd International Conference on Machine Learning, 2006: 233-240. DOI: 10.1145/1143844.1143874.
[28] Saito T, Rehmsmeier M. The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLoS One, 2015, 10(3): e0118432. DOI: 10.1371/journal.pone.0118432.
[29] He H, Garcia E A. Learning from imbalanced data. IEEE Transactions on Knowledge and Data Engineering, 2009, 21(9): 1263-1284. DOI: 10.1109/TKDE.2008.239.
[30] Loshchilov I, Hutter F. Decoupled weight decay regularization. In: Proceedings of the International Conference on Learning Representations (ICLR), 2019.