본문

서브메뉴

Closed-Loop Network Anomaly Detection
Closed-Loop Network Anomaly Detection
Closed-Loop Network Anomaly Detection

상세정보

자료유형  
 학위논문 서양
최종처리일시  
20260209102855
ISBN  
9798291573754
DDC  
004
저자명  
Zhou, Qinghai.
서명/저자  
Closed-Loop Network Anomaly Detection
발행사항  
[Sl] : University of Illinois at Urbana-Champaign, 2023
발행사항  
Ann Arbor : ProQuest Dissertations & Theses, 2023
형태사항  
172 p
주기사항  
Source: Dissertations Abstracts International, Volume: 87-02, Section: A.
주기사항  
Advisor: Tong, Hanghang.
학위논문주기  
Thesis (Ph.D.)--University of Illinois at Urbana-Champaign, 2023.
초록/해제  
요약Anomalies are defined as rare observations that significantly deviate from the majority. In recent years, with the networked data becoming ubiquitous, network anomaly detection (NAD), which aims to identify the rare objects in networks, has attracted remarkable attentions in a variety of high-impact applications, ranging from social network analysis (e.g., social spammer detection), online review system (e.g., opinion spam detection) to financial fraud (e.g., credit card fraud detection).Generally speaking, an NAD algorithm is composed of three major components, including (1) networks, (2) supervision, and (3) users. The vast majority of existing NAD techniques have been developed to take networks and supervision as input and deliver the detection results (e.g., a top-k list) to the end user. Despite tremendous advances being achieved, three key challenges remain. First (rich networks), real-world networks are often sourced from multiple instances or dynamically evolving, whereas the majority of existing NAD approaches are designed for single or multiple static aligned network(s). It remains nascent how to detect anomalies in rich (e.g., multiple, dynamic) networks. Second (weak supervision), the existing NAD methods are predominately developed in an unsupervised manner due to lack of supervision. Nevertheless, it has not been well studied on how to leverage low-cost weak supervision (e.g., limited number of labels, labels in coarse granularity) to design supervised algorithms. Third (user interaction), existing methods primarily regard the users as the passive receiving end of an NAD algorithm. It is imperative on how to bring the users into the NAD loop to boost both the interpretability and detection accuracy.The close interactions between the key challenges in NAD naturally necessitate four major tasks, namely predicting, auditing, augmenting and interpreting. First, predicting aims to advance the detection performance in complex networks by mining the crucial knowledge from weak supervised signals. Second, the auditing task studies how user-based anomalous activities and the corresponding alterations on graphs impact the network systems. Third, augmenting correlates users and networks, and explores reinforcing the supervision and network information, to improve NAD algorithms. The goal of interpreting is to help the end users understand the outcome of mining techniques through quantitative uncertainty estimation and intuitive visual explanations.The theme of my Ph.D. research is to collectively address the above key challenges in network anomaly detection through the four major tasks, including predicting, auditing, augmenting and interpreting. Specifically, for predicting, we have developed GDN to learn anomalous patterns from limited labeled anomalies and Meta-GDN which realizes effective meta-knowledge transfer across multiple networks by equipping GDN with a meta learning algorithm. In addition, we design a generic framework, Wedge which is capable of identifying node-level anomalies given coarse-grained subgraph supervision. Second, for auditing, we have designed a family of scalable algorithms, Admiring to analyze the impact of anomalous activities on multi-network systems, to graph learning results. Furthermore, we develop Attent, a generic influence-based query strategy to actively obtain user feedback. Third, for augmenting, we develop G-ADAM, a mixup-based NAD approach that can augment the original limited training data by adaptively interpolating data instances in the embedding space. Moreover, we have studied the problem of dynamically optimizing the user net- work (e.g., teams) with reinforcement learning. For the interpreting task, we have proposed JuryGCN, which is the first frequentist-based approach to quantify node uncertainty of graph convolutional network without model training. JuryGCN has demonstrated superiority in both active learning on node classification and semi-supervised node classification, and achieves the best effectiveness and lowest memory usage than the competitors. We also develop Extra, an interactive visualization tool, to provide intuitive visual explanations for results in the team recommendation scenario.
일반주제명  
Computer science
일반주제명  
Information science
키워드  
Data mining
키워드  
Graph mining
키워드  
Anomaly detection
키워드  
Graph neural networks
키워드  
Networks
기타저자  
University of Illinois at Urbana-Champaign Computer Science
기본자료저록  
Dissertations Abstracts International. 87-02A.
전자적 위치 및 접속  
로그인 후 원문을 볼 수 있습니다.

MARC

 008260203s2023        us                              c    eng  d
■001000017365922
■00520260209102855
■006m          o    d                
■007cr#unu||||||||
■020    ▼a9798291573754
■035    ▼a(MiAaPQ)AAI32272134
■035    ▼a(MiAaPQ)httphdlhandlenet2142121978
■040    ▼aMiAaPQ▼cMiAaPQ
■0820  ▼a004
■1001  ▼aZhou,  Qinghai.
■24510▼aClosed-Loop  Network  Anomaly  Detection
■260    ▼a[Sl]▼bUniversity  of  Illinois  at  Urbana-Champaign▼c2023
■260  1▼aAnn  Arbor▼bProQuest  Dissertations  &  Theses▼c2023
■300    ▼a172  p
■500    ▼aSource:  Dissertations  Abstracts  International,  Volume:  87-02,  Section:  A.
■500    ▼aAdvisor:  Tong,  Hanghang.
■5021  ▼aThesis  (Ph.D.)--University  of  Illinois  at  Urbana-Champaign,  2023.
■520    ▼aAnomalies  are  defined  as  rare  observations  that  significantly  deviate  from  the  majority.  In  recent  years,  with  the  networked  data  becoming  ubiquitous,  network  anomaly  detection  (NAD),  which  aims  to  identify  the  rare  objects  in  networks,  has  attracted  remarkable  attentions  in  a  variety  of  high-impact  applications,  ranging  from  social  network  analysis  (e.g.,  social  spammer  detection),  online  review  system  (e.g.,  opinion  spam  detection)  to  financial  fraud  (e.g.,  credit  card  fraud  detection).Generally  speaking,  an  NAD  algorithm  is  composed  of  three  major  components,  including  (1)  networks,  (2)  supervision,  and  (3)  users.  The  vast  majority  of  existing  NAD  techniques  have  been  developed  to  take  networks  and  supervision  as  input  and  deliver  the  detection  results  (e.g.,  a  top-k  list)  to  the  end  user.  Despite  tremendous  advances  being  achieved,  three  key  challenges  remain.  First  (rich  networks),  real-world  networks  are  often  sourced  from  multiple  instances  or  dynamically  evolving,  whereas  the  majority  of  existing  NAD  approaches  are  designed  for  single  or  multiple  static  aligned  network(s).  It  remains  nascent  how  to  detect  anomalies  in  rich  (e.g.,  multiple,  dynamic)  networks.  Second  (weak  supervision),  the  existing  NAD  methods  are  predominately  developed  in  an  unsupervised  manner  due  to  lack  of  supervision.  Nevertheless,  it  has  not  been  well  studied  on  how  to  leverage  low-cost  weak  supervision  (e.g.,  limited  number  of  labels,  labels  in  coarse  granularity)  to  design  supervised  algorithms.  Third  (user  interaction),  existing  methods  primarily  regard  the  users  as  the  passive  receiving  end  of  an  NAD  algorithm.  It  is  imperative  on  how  to  bring  the  users  into  the  NAD  loop  to  boost  both  the  interpretability  and  detection  accuracy.The  close  interactions  between  the  key  challenges  in  NAD  naturally  necessitate  four  major  tasks,  namely  predicting,  auditing,  augmenting  and  interpreting.  First,  predicting  aims  to  advance  the  detection  performance  in  complex  networks  by  mining  the  crucial  knowledge  from  weak  supervised  signals.  Second,  the  auditing  task  studies  how  user-based  anomalous  activities  and  the  corresponding  alterations  on  graphs  impact  the  network  systems.  Third,  augmenting  correlates  users  and  networks,  and  explores  reinforcing  the  supervision  and  network  information,  to  improve  NAD  algorithms.  The  goal  of  interpreting  is  to  help  the  end  users  understand  the  outcome  of  mining  techniques  through  quantitative  uncertainty  estimation  and  intuitive  visual  explanations.The  theme  of  my  Ph.D.  research  is  to  collectively  address  the  above  key  challenges  in  network  anomaly  detection  through  the  four  major  tasks,  including  predicting,  auditing,  augmenting  and  interpreting.  Specifically,  for  predicting,  we  have  developed  GDN  to  learn  anomalous  patterns  from  limited  labeled  anomalies  and  Meta-GDN  which  realizes  effective  meta-knowledge  transfer  across  multiple  networks  by  equipping  GDN  with  a  meta  learning  algorithm.  In  addition,  we  design  a  generic  framework,  Wedge  which  is  capable  of  identifying  node-level  anomalies  given  coarse-grained  subgraph  supervision.  Second,  for  auditing,  we  have  designed  a  family  of  scalable  algorithms,  Admiring  to  analyze  the  impact  of  anomalous  activities  on  multi-network  systems,  to  graph  learning  results.  Furthermore,  we  develop  Attent,  a  generic  influence-based  query  strategy  to  actively  obtain  user  feedback.  Third,  for  augmenting,  we  develop  G-ADAM,  a  mixup-based  NAD  approach  that  can  augment  the  original  limited  training  data  by  adaptively  interpolating  data  instances  in  the  embedding  space.  Moreover,  we  have  studied  the  problem  of  dynamically  optimizing  the  user  net-  work  (e.g.,  teams)  with  reinforcement  learning.  For  the  interpreting  task,  we  have  proposed  JuryGCN,  which  is  the  first  frequentist-based  approach  to  quantify  node  uncertainty  of  graph  convolutional  network  without  model  training.  JuryGCN  has  demonstrated  superiority  in  both  active  learning  on  node  classification  and  semi-supervised  node  classification,  and  achieves  the  best  effectiveness  and  lowest  memory  usage  than  the  competitors.  We  also  develop  Extra,  an  interactive  visualization  tool,  to  provide  intuitive  visual  explanations  for  results  in  the  team  recommendation  scenario.
■590    ▼aSchool  code:  0090.
■650  4▼aComputer  science
■650  4▼aInformation  science
■653    ▼aData  mining
■653    ▼aGraph  mining
■653    ▼aAnomaly  detection
■653    ▼aGraph  neural  networks
■653    ▼aNetworks
■690    ▼a0984
■690    ▼a0800
■690    ▼a0723
■71020▼aUniversity  of  Illinois  at  Urbana-Champaign▼bComputer  Science.
■7730  ▼tDissertations  Abstracts  International▼g87-02A.
■790    ▼a0090
■791    ▼aPh.D.
■792    ▼a2023
■793    ▼aEnglish
■85640▼uhttp://www.riss.kr/pdu/ddodLink.do?id=T17365922▼nKERIS▼z이  자료의  원문은  한국교육학술정보원에서  제공합니다.

미리보기

내보내기

chatGPT토론

Ai 추천 관련 도서


    신착도서 더보기
    최근 3년간 통계입니다.

    소장정보

    • 예약
    • 소재불명신고
    • 나의폴더
    • 우선정리요청
    • 비도서대출신청
    • 야간 도서대출신청
    소장자료
    등록번호 청구기호 소장처 대출가능여부 대출정보
    TF15722 전자도서 대출가능 마이폴더 부재도서신고 비도서대출신청 야간 도서대출신청

    * 대출중인 자료에 한하여 예약이 가능합니다. 예약을 원하시면 예약버튼을 클릭하십시오.

    해당 도서를 다른 이용자가 함께 대출한 도서

    관련 인기도서

    로그인 후 이용 가능합니다.