서브메뉴
검색
Closed-Loop Network Anomaly Detection
Closed-Loop Network Anomaly Detection
상세정보
- 자료유형
- 학위논문 서양
- 최종처리일시
- 20260209102855
- ISBN
- 9798291573754
- DDC
- 004
- 저자명
- Zhou, Qinghai.
- 서명/저자
- Closed-Loop Network Anomaly Detection
- 발행사항
- [Sl] : University of Illinois at Urbana-Champaign, 2023
- 발행사항
- Ann Arbor : ProQuest Dissertations & Theses, 2023
- 형태사항
- 172 p
- 주기사항
- Source: Dissertations Abstracts International, Volume: 87-02, Section: A.
- 주기사항
- Advisor: Tong, Hanghang.
- 학위논문주기
- Thesis (Ph.D.)--University of Illinois at Urbana-Champaign, 2023.
- 초록/해제
- 요약Anomalies are defined as rare observations that significantly deviate from the majority. In recent years, with the networked data becoming ubiquitous, network anomaly detection (NAD), which aims to identify the rare objects in networks, has attracted remarkable attentions in a variety of high-impact applications, ranging from social network analysis (e.g., social spammer detection), online review system (e.g., opinion spam detection) to financial fraud (e.g., credit card fraud detection).Generally speaking, an NAD algorithm is composed of three major components, including (1) networks, (2) supervision, and (3) users. The vast majority of existing NAD techniques have been developed to take networks and supervision as input and deliver the detection results (e.g., a top-k list) to the end user. Despite tremendous advances being achieved, three key challenges remain. First (rich networks), real-world networks are often sourced from multiple instances or dynamically evolving, whereas the majority of existing NAD approaches are designed for single or multiple static aligned network(s). It remains nascent how to detect anomalies in rich (e.g., multiple, dynamic) networks. Second (weak supervision), the existing NAD methods are predominately developed in an unsupervised manner due to lack of supervision. Nevertheless, it has not been well studied on how to leverage low-cost weak supervision (e.g., limited number of labels, labels in coarse granularity) to design supervised algorithms. Third (user interaction), existing methods primarily regard the users as the passive receiving end of an NAD algorithm. It is imperative on how to bring the users into the NAD loop to boost both the interpretability and detection accuracy.The close interactions between the key challenges in NAD naturally necessitate four major tasks, namely predicting, auditing, augmenting and interpreting. First, predicting aims to advance the detection performance in complex networks by mining the crucial knowledge from weak supervised signals. Second, the auditing task studies how user-based anomalous activities and the corresponding alterations on graphs impact the network systems. Third, augmenting correlates users and networks, and explores reinforcing the supervision and network information, to improve NAD algorithms. The goal of interpreting is to help the end users understand the outcome of mining techniques through quantitative uncertainty estimation and intuitive visual explanations.The theme of my Ph.D. research is to collectively address the above key challenges in network anomaly detection through the four major tasks, including predicting, auditing, augmenting and interpreting. Specifically, for predicting, we have developed GDN to learn anomalous patterns from limited labeled anomalies and Meta-GDN which realizes effective meta-knowledge transfer across multiple networks by equipping GDN with a meta learning algorithm. In addition, we design a generic framework, Wedge which is capable of identifying node-level anomalies given coarse-grained subgraph supervision. Second, for auditing, we have designed a family of scalable algorithms, Admiring to analyze the impact of anomalous activities on multi-network systems, to graph learning results. Furthermore, we develop Attent, a generic influence-based query strategy to actively obtain user feedback. Third, for augmenting, we develop G-ADAM, a mixup-based NAD approach that can augment the original limited training data by adaptively interpolating data instances in the embedding space. Moreover, we have studied the problem of dynamically optimizing the user net- work (e.g., teams) with reinforcement learning. For the interpreting task, we have proposed JuryGCN, which is the first frequentist-based approach to quantify node uncertainty of graph convolutional network without model training. JuryGCN has demonstrated superiority in both active learning on node classification and semi-supervised node classification, and achieves the best effectiveness and lowest memory usage than the competitors. We also develop Extra, an interactive visualization tool, to provide intuitive visual explanations for results in the team recommendation scenario.
- 일반주제명
- Computer science
- 일반주제명
- Information science
- 키워드
- Data mining
- 키워드
- Graph mining
- 키워드
- Networks
- 기타저자
- University of Illinois at Urbana-Champaign Computer Science
- 기본자료저록
- Dissertations Abstracts International. 87-02A.
- 전자적 위치 및 접속
- 로그인 후 원문을 볼 수 있습니다.
MARC
008260203s2023 us c eng d■001000017365922
■00520260209102855
■006m o d
■007cr#unu||||||||
■020 ▼a9798291573754
■035 ▼a(MiAaPQ)AAI32272134
■035 ▼a(MiAaPQ)httphdlhandlenet2142121978
■040 ▼aMiAaPQ▼cMiAaPQ
■0820 ▼a004
■1001 ▼aZhou, Qinghai.
■24510▼aClosed-Loop Network Anomaly Detection
■260 ▼a[Sl]▼bUniversity of Illinois at Urbana-Champaign▼c2023
■260 1▼aAnn Arbor▼bProQuest Dissertations & Theses▼c2023
■300 ▼a172 p
■500 ▼aSource: Dissertations Abstracts International, Volume: 87-02, Section: A.
■500 ▼aAdvisor: Tong, Hanghang.
■5021 ▼aThesis (Ph.D.)--University of Illinois at Urbana-Champaign, 2023.
■520 ▼aAnomalies are defined as rare observations that significantly deviate from the majority. In recent years, with the networked data becoming ubiquitous, network anomaly detection (NAD), which aims to identify the rare objects in networks, has attracted remarkable attentions in a variety of high-impact applications, ranging from social network analysis (e.g., social spammer detection), online review system (e.g., opinion spam detection) to financial fraud (e.g., credit card fraud detection).Generally speaking, an NAD algorithm is composed of three major components, including (1) networks, (2) supervision, and (3) users. The vast majority of existing NAD techniques have been developed to take networks and supervision as input and deliver the detection results (e.g., a top-k list) to the end user. Despite tremendous advances being achieved, three key challenges remain. First (rich networks), real-world networks are often sourced from multiple instances or dynamically evolving, whereas the majority of existing NAD approaches are designed for single or multiple static aligned network(s). It remains nascent how to detect anomalies in rich (e.g., multiple, dynamic) networks. Second (weak supervision), the existing NAD methods are predominately developed in an unsupervised manner due to lack of supervision. Nevertheless, it has not been well studied on how to leverage low-cost weak supervision (e.g., limited number of labels, labels in coarse granularity) to design supervised algorithms. Third (user interaction), existing methods primarily regard the users as the passive receiving end of an NAD algorithm. It is imperative on how to bring the users into the NAD loop to boost both the interpretability and detection accuracy.The close interactions between the key challenges in NAD naturally necessitate four major tasks, namely predicting, auditing, augmenting and interpreting. First, predicting aims to advance the detection performance in complex networks by mining the crucial knowledge from weak supervised signals. Second, the auditing task studies how user-based anomalous activities and the corresponding alterations on graphs impact the network systems. Third, augmenting correlates users and networks, and explores reinforcing the supervision and network information, to improve NAD algorithms. The goal of interpreting is to help the end users understand the outcome of mining techniques through quantitative uncertainty estimation and intuitive visual explanations.The theme of my Ph.D. research is to collectively address the above key challenges in network anomaly detection through the four major tasks, including predicting, auditing, augmenting and interpreting. Specifically, for predicting, we have developed GDN to learn anomalous patterns from limited labeled anomalies and Meta-GDN which realizes effective meta-knowledge transfer across multiple networks by equipping GDN with a meta learning algorithm. In addition, we design a generic framework, Wedge which is capable of identifying node-level anomalies given coarse-grained subgraph supervision. Second, for auditing, we have designed a family of scalable algorithms, Admiring to analyze the impact of anomalous activities on multi-network systems, to graph learning results. Furthermore, we develop Attent, a generic influence-based query strategy to actively obtain user feedback. Third, for augmenting, we develop G-ADAM, a mixup-based NAD approach that can augment the original limited training data by adaptively interpolating data instances in the embedding space. Moreover, we have studied the problem of dynamically optimizing the user net- work (e.g., teams) with reinforcement learning. For the interpreting task, we have proposed JuryGCN, which is the first frequentist-based approach to quantify node uncertainty of graph convolutional network without model training. JuryGCN has demonstrated superiority in both active learning on node classification and semi-supervised node classification, and achieves the best effectiveness and lowest memory usage than the competitors. We also develop Extra, an interactive visualization tool, to provide intuitive visual explanations for results in the team recommendation scenario.
■590 ▼aSchool code: 0090.
■650 4▼aComputer science
■650 4▼aInformation science
■653 ▼aData mining
■653 ▼aGraph mining
■653 ▼aAnomaly detection
■653 ▼aGraph neural networks
■653 ▼aNetworks
■690 ▼a0984
■690 ▼a0800
■690 ▼a0723
■71020▼aUniversity of Illinois at Urbana-Champaign▼bComputer Science.
■7730 ▼tDissertations Abstracts International▼g87-02A.
■790 ▼a0090
■791 ▼aPh.D.
■792 ▼a2023
■793 ▼aEnglish
■85640▼uhttp://www.riss.kr/pdu/ddodLink.do?id=T17365922▼nKERIS▼z이 자료의 원문은 한국교육학술정보원에서 제공합니다.


