AutoGraphAD：基于变分图自编码器的无监督网络异常检测
AutoGraphAD: Unsupervised network anomaly detection using Variational Graph Autoencoders
AI总结：
本文提出AutoGraphAD，一种基于异构变分图自编码器的无监督网络异常检测方法，通过无监督和对比学习训练模型，无需标注数据，实现高效检测。
摘要：
网络入侵检测系统（NIDS）是检测网络攻击和入侵的关键工具。尽管已有大量研究探索了使用监督机器学习进行攻击检测和表征，但这些方法需要准确标记的数据集，而获取这些数据集成本很高。此外，现有的公开数据集在攻击种类上有限且可能过时，许多数据集还存在标签错误的问题。为减少对标记数据的依赖，我们提出了AutoGraphAD，一种基于异构变分图自编码器的新型无监督异常检测方法。AutoGraphAD在由连接和IP节点组成的异构图上运行，这些节点代表网络活动。模型通过无监督和对比学习进行训练，不依赖任何标记数据。模型的损失被加权并结合成一个用于异常检测的异常评分。总体而言，AutoGraphAD的性能与Anomal-E相当，在某些情况下更优，但不需要依赖昂贵的后续异常检测器。因此，AutoGraphAD的训练速度比Anomal-E快约1.18个数量级，推理速度快约1.03个数量级，这在实际部署中具有显著优势。
英文摘要：
Network Intrusion Detection Systems (NIDS) are essential tools for detecting network attacks and intrusions. While extensive research has explored the use of supervised Machine Learning for attack detection and characterisation, these methods require accurately labelled datasets, which are very costly to obtain. Moreover, existing public datasets have limited and/or outdated attacks, and many of them suffer from mislabelled data. To reduce the reliance on labelled data, we propose AutoGraphAD, a novel unsupervised anomaly detection approach based on a Heterogeneous Variational Graph Autoencoder. AutoGraphAD operates on heterogeneous graphs, made from connection and IP nodes that represent network activity. The model is trained using unsupervised and contrastive learning, without relying on any labelled data. The model's losses are then weighted and combined in an anomaly score used for anomaly detection. Overall, AutoGraphAD yields the same, and in some cases better, results than Anomal-E, but without requiring costly downstream anomaly detectors. As a result, AutoGraphAD achieves around 1.18 orders of magnitude faster training and 1.03 orders of magnitude faster inference, which represents a significant advantage for operational deployment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
