Anomaly detection analysis based on correlation of features in graph neural network

Abstract

Various studies have been conducted to detect network anomalies. However, because anomaly signals are determined by the pattern characteristics using the dataset, the real-time detection problem continues. Even if there is a signal with an attack sign among the constantly transmitted and received signals, the attack cannot be blocked in advance. Moreover, it appears in many places in a distributed denial-of-service (DDoS) attack, so the real-time defense must be the best option. Therefore, it is necessary first to discover the characteristics and elements regarded as abnormal signals to discover anomalies in real time. Finally, by analyzing the correlation between network data and features, extracting the elements of the anomaly, and analyzing the behavior of the extracted elements in detail, we aim to increase the accuracy of the anomaly. In this study, we used Coburg intrusion detection and KDDCup datasets and analyzed the correlation of elements in the dataset using a graph neural network. The calculated accuracy values of the anomaly detection were 94.5% and 98.85%.