Action Sequence Augmentation for Early Graph-based Anomaly Detection
Action Sequence Augmentation for Early Graph-based Anomaly Detection
复制标题
DOI：
10.1145/3459637.3482313
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Tong Zhao;Bo Ni;Wenhao Yu;Zhichun Guo;Neil Shah;Meng Jiang
中科院分区：
文献类型：
--
作者：
Tong Zhao;Bo Ni;Wenhao Yu;Zhichun Guo;Neil Shah;Meng Jiang
网络平台的激增为网络滥用创造了诱因。提出了许多基于图的异常检测技术来识别可疑账户和行为。然而，它们大多是在用户执行了许多此类行为后才检测到异常。当用户的观测数据在早期阶段受到限制时，它们的性能将受到很大的阻碍，这需要改进以最大限度地减少经济损失。在这项工作中，我们提出了Eland，一个使用动作序列增强进行早期异常检测的新框架。Eland利用序列预测器来预测每个用户的下一步动作，并利用动作序列增强和用户动作图异常检测之间的相互增强。在三个真实数据集上的实验表明，Eland提高了各种基于图的异常检测方法的性能。使用Eland，在早期阶段的异常检测性能优于需要更多观测数据的非增强方法，其在ROC曲线下的面积可达15%。
The proliferation of web platforms has created incentives for online abuse. Many graph-based anomaly detection techniques are proposed to identify the suspicious accounts and behaviors. However, most of them detect the anomalies once the users have performed many such behaviors. Their performance is substantially hindered when the users' observed data is limited at an early stage, which needs to be improved to minimize financial loss. In this work, we propose Eland, a novel framework that uses action sequence augmentation for early anomaly detection. Eland utilizes a sequence predictor to predict next actions of every user and exploits the mutual enhancement between action sequence augmentation and user-action graph anomaly detection. Experiments on three real-world datasets show that Eland improves the performance of a variety of graph-based anomaly detection methods. With Eland, anomaly detection performance at an earlier stage is better than non-augmented methods that need significantly more observed data by up to 15% on the Area under the ROC curve.