MVAD HAN: A Multi-View Based Anomaly Detection Method for Heterogeneous Attributed Networks

Abstract

With the frequent occurrence of network security incidents in recent years, it has become very important to detect anomalous behaviour in networks as early and accurately as possible. Anomaly detection can improve the security of complex network systems by detecting abnormal and unreliable nodes, and thus it has become a hot research direction that has attracted wide attention. At present, abstracting real complex systems into complex networks for anomaly detection is the mainstream research method. However, the existing methods still have challenges in extracting network heterogeneity information and attribute information, so we propose a multi-view based anomaly detection method for heterogeneous attributed networks, MVAD HAN. This method can better extract the heterogeneous structural information and rich attribute information of the network to model heterogeneous attributed networks. Our method adopts an encoder-decoder architecture. First, in the encoder part, we use the Heterogeneous Graph Transformer with multiple views to learn node embeddings that fuse the heterogeneous information of the network. In the decoder part, we use an inner product decoder to reconstruct the network topology, a multilayer perceptron-based decoder to better reconstruct the network attribute information, and a linear projection to reconstruct the node type information of the network. Finally, we compute an anomaly score for each node using three reconstruction errors: network structure, attributes and node type. The higher the reconstruction error of a node, the higher the anomaly score and the higher the probability of an anomaly. Finally, anomalous nodes are identified by ranking the anomaly scores and setting a threshold. We validate the effectiveness of the proposed method on four real-world datasets. The experimental results show that this method outperforms several of the baseline methods and has a good performance in anomaly detection.