Dynamic transaction graph analysis
Systems and methods for implementing dynamic graph analysis (DGA) to detect anomalous network traffic are provided. The method includes processing communications and profile data associated with multiple devices to determine dynamic graphs. The method includes generating features to model temporal behaviors of network traffic generated by the multiple devices based on the dynamic graphs. The method also includes formulating a list of prediction results for sources of the anomalous network traffic from the multiple devices based on the temporal behaviors.
1. A method for implementing dynamic graph analysis (DGA) to detect anomalous network traffic, comprising:
processing historical transactions of bank accounts and profile data associated with a plurality of devices to determine at least one dynamic graph;
generating, by a processor device, a plurality of features to model temporal behaviors of network traffic generated by the plurality of devices based on the at least one dynamic graph, the plurality of features grouped into a static one-hop feature group, a dynamic one-hop feature group, a static multi-hop feature group, and a dynamic multi-hop feature group; and
formulating a list of prediction results for sources of anomalous network traffic from the plurality of devices based on the temporal behaviors,
wherein the static one-hop feature group includes degree-based features of nodes in each snapshot of a series of graphs, the dynamic one-hop feature group includes dynamic features of the nodes in consecutive graphs, the static multi-hop feature group includes path and community-based features of the nodes in each snapshot of the series of graphs, and the dynamic multi-hop feature group includes dynamic path and community-based features in consecutive graphs.
2. The method as recited in claim 1 , wherein the static one-hop feature group includes an in-degree feature, an out-degree feature, and a total degree feature, the in-degree feature pertaining to a number of out-going edges associated with each node, the out-degree feature pertaining to a number of out-going edges associated with each node, and the total degree feature pertaining to a sum of the in-degree feature and the out-degree feature.
3. The method as recited in claim 1 , wherein the static one-hop feature group includes a weighted in-degree feature, a weighted out-degree feature, and a weighted total degree feature, the weighted in-degree feature pertaining to a sum of weights on in-going edges associated with each node, the weighted out-degree feature pertaining to a sum of weights on out-going edges associated with each node, and the weighted total degree feature pertaining to a difference between the weighted in-degree feature and the weighted out-degree feature.
4. The method as recited in claim 1 , wherein the static one-hop feature group includes aggregated features.
5. The method as recited in claim 4 , wherein the aggregated features include a maximum value of each of the in-degree feature, the out-degree feature, and the total degree feature of monthly snapshots in each year, a minimum value of each of the in-degree feature, the out-degree feature, and the total degree feature of monthly snapshots in each year, and a mean value of each of the in-degree feature, the out-degree feature, and the total degree feature of monthly snapshots in each year.
6. The method as recited in claim 1 , wherein the dynamic one-hop feature group includes:
an ego-net-based feature, a clustering feature, a pagerank-based feature and an aggregated feature.
7. The method as recited in claim 6 , wherein the dynamic one-hop feature group further includes:
a degree-based feature, a weighted degree-based feature and an aggregated feature.
8. The method as recited in claim 1 , wherein the static multi-hop feature group includes:
at least one degree-based feature, at least one weighted degree-based feature and at least one aggregated feature.
9. The method as recited in claim 1 , wherein the static multi-hop feature group includes a 2-hop pagerank score for each node, a 3-hop pagerank score for each node, and a pagerank converge feature being a convergent pagerank score of each node.
10. The method as recited in claim 1 , wherein the dynamic multi-hop feature group includes:
an ego-net-based feature, a clustering feature, and a pagerank-based feature.
11. The method as recited in claim 1 , wherein outputting the list of prediction results based on the plurality of features further comprises:
detecting at least one anomalous device using a trained model based on the at least one of the plurality of features.
12. A computer system for implementing dynamic graph analysis (DGA) to detect anomalous network traffic, comprising:
a processor device operatively coupled to a memory device, the processor device being configured to:
process historical transactions of bank accounts and profile data associated with a plurality of devices to determine at least one dynamic graph;
generate a plurality of features to model temporal behaviors of network traffic generated by the plurality of devices based on the at least one dynamic graph, the plurality of features grouped into a static one-hop feature group, a dynamic one-hop feature group, a static multi-hop feature group, and a dynamic multi-hop feature group; and
formulate a list of prediction results for sources of anomalous network traffic from the plurality of devices based on the temporal behaviors,
wherein the static one-hop feature group includes degree-based features of nodes in each snapshot of a series of graphs, the dynamic one-hop feature group includes dynamic features of the nodes in consecutive graphs, the static multi-hop feature group includes path and community-based features of the nodes in each snapshot of the series of graphs, and the dynamic multi-hop feature group includes dynamic path and community-based features in consecutive graphs.
13. The system as recited in claim 12 , wherein the static one-hop feature group includes an in-degree feature, an out-degree feature, and a total degree feature, the in-degree feature pertaining to a number of out-going edges associated with each node, the out-degree feature pertaining to a number of out-going edges associated with each node, and the total degree feature pertaining to a sum of the in-degree feature and the out-degree feature.
14. The system as recited in claim 13 , wherein the static one-hop feature group includes a weighted in-degree feature, a weighted out-degree feature, and a weighted total degree feature, the weighted in-degree feature pertaining to a sum of weights on in-going edges associated with each node, the weighted out-degree feature pertaining to a sum of weights on out-going edges associated with each node, and the weighted total degree feature pertaining to a difference between the weighted in-degree feature and the weighted out-degree feature.
15. The system as recited in claim 12 , wherein the static one-hop feature group includes aggregated features.
16. The system as recited in claim 15 , wherein the aggregated features include a maximum value of each of the in-degree feature, the out-degree feature, and the total degree feature of monthly snapshots in each year, a minimum value of each of the in-degree feature, the out-degree feature, and the total degree feature of monthly snapshots in each year, and a mean value of each of the in-degree feature, the out-degree feature, and the total degree feature of monthly snapshots in each year.
17. The system as recited in claim 12 , wherein the dynamic one-hop feature group includes:
an ego-net-based feature, a clustering feature, a pagerank-based feature and an aggregated feature.
18. The system as recited in claim 17 , wherein the dynamic one-hop feature group further includes:
a degree-based feature, a weighted degree-based feature and an aggregated feature.
19. The system as recited in claim 12 , wherein the static multi-hop feature group includes a 2-hop pagerank score for each node, a 3-hop pagerank score for each node, and a pagerank converge feature being a convergent pagerank score of each node.
20. A computer program product for implementing dynamic graph analysis (DGA) to detect anomalous network traffic, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to perform the method comprising:
processing historical transactions of bank accounts and profile data associated with a plurality of devices to determine at least one dynamic graph;
generating, by the computing device, a plurality of features to model temporal behaviors of network traffic generated by the plurality of devices based on the at least one dynamic graph, the plurality of features grouped into a static one-hop feature group, a dynamic one-hop feature group, a static multi-hop feature group, and a dynamic multi-hop feature group; and
formulating a list of prediction results for sources of anomalous network traffic from the plurality of devices based on the temporal behaviors,
wherein the static one-hop feature group includes degree-based features of nodes in each snapshot of a series of graphs, the dynamic one-hop feature group includes dynamic features of the nodes in consecutive graphs, the static multi-hop feature group includes path and community-based features of the nodes in each snapshot of the series of graphs, and the dynamic multi-hop feature group includes dynamic path and community-based features in consecutive graphs.