Graph-Based Anomaly Detection

1
Graph-Based Anomaly Detection

• Eiman Alshammari

2
Problem Definition

• Why and What ??

3

• Anomaly detection is an area that has received
  much attention in recent years.
• Little work has focused on anomaly detection in
  graph-based data.
• In this project, a new technique for graph-based
  anomaly detection is introduced .
• Clustering technique is applied afterwards to
  determine the likelihood of successful anomaly
  detection within graph-based data.
• Experimental results is provided using
  artificially-created data.

4
Represent Web as Graph

• Nodes represent pages / web pages
• Edges represent hyperlinks

5
Graph To Subgraphs
Data to Graph
Subgraphs Similarities
Clustering
6
Data to Graph

• There are many tools to convert Data to graphs.
• In an advanced level of the research , these
  tools will be used

1
7
Graph to Subgraph
1
2
3
4
5
2
8
Given Graph G
9
Step 1
10
(No Transcript)
11
M
S1
A B C D E F G H I J K L M
A 0 1 1 1
B 1 0 1 1 1
C 1 1 0 1 1
D 1 1 0
E 1 0 1
F 1 1 0
G 0 1
H 1 1 1 0 1 1 1
I 1 0
J 1 0
K 1 0 1
L 1 1 0 1
M 1 0
L
D
K
J
A
E
H
C
B
G
I
F
12
A B C D E F G H I J K L M
A 0 1 1 1
B 1 0 1 1 1
C 1 1 0 1 1
D 1 1 0
E 1 0 1
F 1 1 0
G 0 1
H 1 1 1 0 1 1 1
I 1 0
J 1 0
K 1 0 1
L 1 1 0 1
M 1 0
13
Step 2 Will be repeated for each link
14
H
B
A
G
C
I
S2
F
J
D
A B C D E F G H I J K L
A 0 1
B 1 0 1 1
C 1 0 1
D 1 0
E 0 1
F 1 0 1 1 1
G 0 1 1
H 1 1 0 1
I 1 1 0 1
J 1 0 1 1
K 1 1 1 0 1
L 1 1 1 0
K
E
L
15
Subgraphs Similarities

• Adjacency Matrices

3
16
Subgraphs Similarities
S
W
S
W
L
W
L
W
S
Similar matrices have the same eigenvalues If
they are exactly similar Isomorphisim
W
X
L
17
(No Transcript)
18
(No Transcript)
19
(No Transcript)
20
Remember

• That 1 in the matrix means
• An extra link or a missing link

21
(No Transcript)
22

• Find the minimum difference using the XOR
• Similarity
• 1-(number of 1s in the composed algorithm)
• ____________________________________
• (number of ones in S1

23
We define similarity
The similarity threshold will be
application-dependent meaning that its value
will be determined according to the performance
and safety of the application that the algorithm
is embedded into.
24
A Link is anomalous

• If there exist no similarity between its sub
  graph and any other sub graphs

A link is not anomalous

• If there exist at least one sub graph that allows
  a similarity gt the assigned similarity

25
Algorithm

• Something New Something Borrowed

26
The algorithm
27
Algorithm Complexity
28
(No Transcript)
29
Experimental Results

• Did we solve the problem?

30
20 nodes 37 edges
31
15 nodes 21 edges
32
Future Direction

• Experimental results will be provided using
  real-world network intrusion data.