Graph Neural Networks for Anomaly Detection via Topological Distance

Abstract

Anomaly detection in complex networks – encompassing areas like fraud detection, intrusion detection, and equipment monitoring – presents a significant challenge. Traditional methods often employ simplistic thresholding techniques, which frequently lack robustness and adaptability to varying network characteristics. This paper proposes a novel approach leveraging Graph Neural Networks (GNNs) to achieve more accurate and reliable anomaly detection. The core idea revolves around training GNNs to learn the normal topological structure of a network. Once trained, the GNNs can effectively represent nodes within the network using embeddings. Anomalies are then identified by measuring the distance between a node's embedding and the embeddings of its neighbors, reflecting deviations from the learned normal structure. We demonstrate the effectiveness of this method through theoretical analysis and a conceptual framework. The key contribution lies in the utilization of GNNs' ability to capture intricate network relationships, providing a more nuanced and robust solution compared to traditional threshold-based approaches. The method offers a flexible framework adaptable to diverse network topologies and anomaly types.