Abstract

This paper proposes a new method named evolving-graph generation framework to simultaneously solve the complexity and dynamic nature of the attribute networks that can occur in graph-based anomaly detection with Graph Neural Networks (GNN). The proposed framework consists of two components. The first component is a feature selection method that hybridizes filter-based and wrapper-based techniques to reduce the snapshots. The second component is an association method based on temporal patterns for the snapshots using the subgraph embedding technique and gaussianbase KL divergence. At the time, the association method finds intra-snapshots and inter-snapshots associations. As a result, we can obtain an evolving graph that is simplified and temporal patternsenhanced from original networks. It is used an input graph for a GNN-based anomaly detection model. To show the superiority of the proposed framework, we conduct experiments and evaluations on 8 real-world datasets with anomaly labels with comparative state-of-the-art models of graph-based anomaly detection. We show that the proposed framework outperforms state-of-the-art methods in the accuracy and stability of training with the trend of decreasing train loss.