Download presentation
Presentation is loading. Please wait.
1
Graph-Based Anomaly Detection
Eiman Alshammari
2
Problem Definition Why and What … ??
3
Anomaly detection is an area that has received much attention in recent years.
Little work has focused on anomaly detection in graph-based data. In this project, a new technique for graph-based anomaly detection is introduced . Clustering technique is applied afterwards to determine the likelihood of successful anomaly detection within graph-based data. Experimental results is provided using artificially-created data.
4
Nodes represent pages / web pages Edges represent hyperlinks
Represent Web as Graph page university texas learning group projects subdue robotics parallel hyperlink work word planning Nodes represent pages / web pages Edges represent hyperlinks
5
Graph To Subgraphs Data to Graph Subgraphs Similarities Clustering
6
There are many tools to convert Data to graphs.
In an advanced level of the research , these tools will be used 1
7
Graph to Subgraph 1 2 3 5 4 Here I am going to explain to explain what is graph and what are the basic elements of graph: Graph , subgraph vertex, edge 2
8
Given Graph G
9
Step 1
11
M S1 A B C D E F G H I J K L M 1 L D K J A E H C B G I F
12
A B C D E F G H I J K L M 1
13
Step 2 Will be repeated for each link
14
H A B G C I S2 F J D A B C D E F G H I J K L 1 K E L
15
Subgraphs Similarities
Adjacency Matrices 3
16
Subgraphs Similarities
W S W L W L W S Similar matrices have the same eigenvalues If they are exactly similar … Isomorphisim X W L
20
Remember That 1 in the matrix means An extra link or a missing link
22
Find the minimum difference using the XOR
Similarity 1-(number of 1’s in the composed algorithm) ____________________________________ (number of one’s in S1
23
We define similarity The similarity threshold will be application-dependent; meaning that its value will be determined according to the performance and safety of the application that the algorithm is embedded into.
24
A Link is anomalous A link is not anomalous
If there exist no similarity between its sub graph and any other sub graphs A link is not anomalous If there exist at least one sub graph that allows a similarity >= the assigned similarity
25
Something New… Something Borrowed
Algorithm Something New… Something Borrowed
26
The algorithm
27
Algorithm & Complexity
29
Did we solve the problem?
Experimental Results Did we solve the problem?
30
20 nodes 37 edges
31
15 nodes – 21 edges
32
Future Direction Experimental results will be provided using real-world network intrusion data.
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.