Frozen-Reference Graph Context for Inductive Network-Flow Anomaly Detection
DOI:
https://doi.org/10.54097/avwk8x64Keywords:
Graph anomaly detection, Inductive graph learning, Network flows, Reference memory, Disagreement, Streaming inference, Synthetic benchmarkAbstract
We study inductive network-flow anomaly detection using a frozen training-only graph reference rather than edges among future observations. Category-conditioned random-projection retrieval yields 12 neighbors per query; cosine-weighted context and elementwise disagreement are inherited from the DAS-GNN disagreement-aware graph framework. We compare all-record and label-vetted benign reference banks, prototype shrinkage, and compact uniform-mean residual features. A fully executable study uses two independently generated realizations of 48,000 synthetic flows each, three neural seeds, validation-selected thresholds, LightGBM, and saved per-record predictions. On the first synthetic test set, uniform graph averaging obtains 0.9052 ROC-AUC, 0.8243 average precision and 0.7330 F1, versus 0.8737, 0.7683 and 0.6787 for a matched MLP. On the independent generator realization, its average precision is 0.8153 versus 0.7645 for the MLP. More elaborate disagreement and prototype variants do not consistently improve on simple averaging. The result is an auditable, strict-inductive method comparison rather than a claim of optimality or accuracy on recorded production traffic.
Downloads
References
[1] Pang, G., Shen, C., Cao, L., & van den Hengel, A. (2021). Deep learning for anomaly detection: A review. ACM Computing Surveys, 54(2), Article 38. https://doi.org/10.1145/3439950
[2] Akoglu, L., Tong, H., & Koutra, D. (2015). Graph based anomaly detection and description: A survey. Data Mining and Knowledge Discovery, 29, 626-688. https://doi.org/10.1007/s10618-014-0365-y
[3] Ma, X., Wu, J., Xue, S., Yang, J., Zhou, C., Sheng, Q. Z., Xiong, H., & Akoglu, L. (2023). A comprehensive survey on graph anomaly detection with deep learning. IEEE Transactions on Knowledge and Data Engineering, 35(12), 12012-12038. https://doi.org/10.1109/TKDE.2021.3118815
[4] Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems. In Proceedings of the Military Communications and Information Systems Conference (MilCIS) (pp. 1-6). IEEE. https://doi.org/10.1109/MilCIS.2015.7348942
[5] Kipf, T. N., & Welling, M. (2017). Semi-supervised classification with graph convolutional networks. In Proceedings of the International Conference on Learning Representations (ICLR).
[6] Hamilton, W. L., Ying, R., & Leskovec, J. (2017). Inductive representation learning on large graphs. Advances in Neural Information Processing Systems, 30, 1024-1034.
[7] Chen, J., Han, X., Zhang, X., & Yang, Y. (2023). Exact concept-level explanations for early detection of financial misstatements. Eurasia Journal of Science and Technology, 5(2), 34-48.
[8] Wu, F., Souza, A., Zhang, T., Fifty, C., Yu, T., & Weinberger, K. Q. (2019). Simplifying graph convolutional networks. In Proceedings of the 36th International Conference on Machine Learning (ICML), PMLR 97 (pp. 6861-6871). PMLR.
[9] Frasca, F., Rossi, E., Eynard, D., Chamberlain, B., Bronstein, M., & Monti, F. (2020). SIGN: Scalable inception graph neural networks. arXiv, arXiv:2004.11198. https://doi.org/10.48550/arXiv.2004.11198
[10] Zhou, F. (2026). Moment-constrained side-force allocation for wind-assisted merchant ships: Hydrodynamic performance of retractable anti-leeway fins and flap rudders. Innovation and Technology Studies, 3(1), 27-41.
[11] Chen, J., Ma, T., & Xiao, C. (2018). FastGCN: Fast learning with graph convolutional networks via importance sampling. In Proceedings of the International Conference on Learning Representations (ICLR).
[12] Zou, D., Hu, Z., Wang, Y., Jiang, S., Sun, Y., & Gu, Q. (2019). Layer-dependent importance sampling for training deep and large graph convolutional networks. Advances in Neural Information Processing Systems, 32, 11249-11259.
[13] Chiang, W.-L., Liu, X., Si, S., Li, Y., Bengio, S., & Hsieh, C.-J. (2019). Cluster-GCN: An efficient algorithm for training deep and large graph convolutional networks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) (pp. 257-266). ACM. https://doi.org/10.1145/3292500.3330925
[14] Zeng, H., Zhou, H., Srivastava, A., Kannan, R., & Prasanna, V. (2020). GraphSAINT: Graph sampling based inductive learning method. In Proceedings of the International Conference on Learning Representations (ICLR).
[15] Bojchevski, A., Gasteiger, J., Perozzi, B., Kapoor, A., Blais, M., Rózemberczki, B., & Günnemann, S. (2020). Scaling graph neural networks with approximate PageRank. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) (pp. 2464-2473). ACM. https://doi.org/10.1145/3394486.3403296
[16] Ying, R., He, R., Chen, K., Eksombatchai, P., Hamilton, W. L., & Leskovec, J. (2018). Graph convolutional neural networks for web-scale recommender systems. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) (pp. 974-983). ACM. https://doi.org/10.1145/3219819.3219890
[17] Ding, K., Li, J., Bhanushali, R., & Liu, H. (2019). Deep anomaly detection on attributed networks. In Proceedings of the SIAM International Conference on Data Mining (SDM) (pp. 594-602). SIAM. https://doi.org/10.1137/1.9781611975673.67
[18] Fan, H., Zhang, F., & Li, Z. (2020). AnomalyDAE: Dual autoencoder for anomaly detection on attributed networks. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) (pp. 5685-5689). IEEE. https://doi.org/10.1109/ICASSP40776.2020.9053387
[19] Liu, Y., Li, Z., Pan, S., Gong, C., Zhou, C., & Karypis, G. (2022). Anomaly detection on attributed networks via contrastive self-supervised learning. IEEE Transactions on Neural Networks and Learning Systems, 33(6), 2378-2392. https://doi.org/10.1109/TNNLS.2021.3068344
[20] Dou, Y., Liu, Z., Sun, L., Deng, Y., Peng, H., & Yu, P. S. (2020). Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In Proceedings of the 29th ACM International Conference on Information and Knowledge Management (CIKM) (pp. 315-324). ACM. https://doi.org/10.1145/3340531.3411903
[21] Wang, J., Ge, Y., Liu, J., & Jiang, B. (2024). Early warning of liquidity stress in U.S. banks with seasonally aligned frailty hazards and delayed-feedback conformal alarms. Journal of Trends in Finance and Economics, 1(1), 85-100.
[22] Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008). Isolation forest. In Proceedings of the 8th IEEE International Conference on Data Mining (ICDM) (pp. 413-422). IEEE. https://doi.org/10.1109/ICDM.2008.17
[23] Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., Ye, Q., & Liu, T.-Y. (2017). LightGBM: A highly efficient gradient boosting decision tree. Advances in Neural Information Processing Systems, 30, 3146-3154.
[24] Davis, J., & Goadrich, M. (2006). The relationship between precision-recall and ROC curves. In Proceedings of the 23rd International Conference on Machine Learning (ICML) (pp. 233-240). ACM. https://doi.org/10.1145/1143844.1143874
[25] Saito, T., & Rehmsmeier, M. (2015). The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLOS ONE, 10(3), Article e0118432. https://doi.org/10.1371/journal.pone.0118432
[26] He, H., & Garcia, E. A. (2009). Learning from imbalanced data. IEEE Transactions on Knowledge and Data Engineering, 21(9), 1263-1284. https://doi.org/10.1109/TKDE.2008.239
[27] Teng, D. (2025). RSRBench: Reproducibility and performance benchmarking for regional seismic risk workflows. Academic Journal of Architecture and Civil Engineering, 3(1), 40-52.
[28] Ding, J., Shen, Z., & Liu, W. (2026). Game-theoretic cost-sensitive adversarial training for robust cloud intrusion detection against GAN-based evasion attacks. Applied Sciences, 16, Article 3944. https://doi.org/10.3390/app16083944
[29] Liu, Y., Zhang, H., Wang, L., Chen, X., & Li, J. (2024). Temporal logical attention network for log-based anomaly detection in distributed systems. Sensors, 24, Article 7949. https://doi.org/10.3390/s24247949
[30] Ren, S., Zhang, Y., Li, H., Wang, J., & Chen, X. (2025). ARCS: Adaptive reinforcement learning framework for automated cybersecurity incident response strategy optimization. Applied Sciences, 15, Article 951. https://doi.org/10.3390/app15020951
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Computing and Electronic Information Management
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
