Invalid traffic detection using explainable unsupervised graph ML
Herein are graph machine learning explainability (MLX) techniques for invalid traffic detection. In an embodiment, a computer generates a graph that contains: a) domain vertices that represent network domains that received requests and b) address vertices that respectively represent network addresses from which the requests originated. Based on the graph, domain embeddings are generated that respectively encode the domain vertices. Based on the domain embeddings, multidomain embeddings are generated that respectively encode the network addresses. The multidomain embeddings are organized into multiple clusters of multidomain embeddings. A particular cluster is detected as suspicious. In an embodiment, an unsupervised trained graph model generates the multidomain embeddings. Based on the clusters of multidomain embeddings, feature importances are unsupervised trained. Based on the feature importances, an explanation is automatically generated for why an object is or is not suspicious. The explained object may be a cluster or other batch of network addresses or a single network address.
1 . A method comprising:
generating, by an unsupervised trained graph model, a plurality of multidomain embeddings, wherein:
each multidomain embedding of the plurality of multidomain embeddings represents a distinct network address of a plurality of network addresses, and
each multidomain embedding of the plurality of multidomain embeddings is based on a plurality of network domains that received requests from said distinct network address;
clustering the plurality of multidomain embeddings into a plurality of clusters of multidomain embeddings;
unsupervised training, based on the plurality of clusters of multidomain embeddings, a plurality of importances;
generating, based on the plurality of importances, an explanation for why an object is or is not suspicious, wherein the object is at least one selected from the group consisting of: a particular cluster of the plurality of clusters of multidomain embeddings and a particular multidomain embedding of the plurality of multidomain embeddings.
2 . The method of claim 1 wherein:
the plurality of importances includes a disjoint subset of importances for each cluster of the plurality of clusters of multidomain embeddings;
said generating the explanation for said particular cluster is not based on importances for the plurality of clusters other than the particular cluster.
3 . The method of claim 1 wherein said unsupervised training the plurality of importances is based on centroids of the plurality of clusters of multidomain embeddings.
4 . The method of claim 1 wherein an importance of the plurality of importances corresponds to one selected from the group consisting of:
a feature of a network address of the plurality of network addresses, and
a network domain of the plurality of network domains.
5 . The method of claim 1 wherein said unsupervised training the plurality of importances is based on at least one selected from the group consisting of:
a loss function that uses a centroid of a cluster of the plurality of clusters,
a loss function that uses an inner product,
a loss function that uses an entropy measurement,
a loss function that penalizes a sum of multiple importances of the plurality of importances,
a loss function that penalizes mid-range importances, and
a loss function that uses multiple multidomain embeddings of the plurality of multidomain embeddings.
6 . The method of claim 1 wherein said unsupervised training the plurality of importances comprises measuring a difference between:
a) an inner product of a multidomain embedding of a particular network address and a centroid of a particular cluster of the plurality of clusters that contains the multidomain embedding of the particular network address and
b) an average of respective inner products of a respective centroid of each cluster of the plurality of clusters that is not said particular cluster and the multidomain embedding of the particular network address.
7 . The method of claim 1 wherein said plurality of importances consists of a respective disjoint subset of importances for each multidomain embedding of the plurality of multidomain embeddings.
8 . The method of claim 7 wherein said subsets of importances for a first multidomain embedding of the plurality of multidomain embeddings and a second multidomain embedding of the plurality of multidomain embeddings consist of different counts of importances.
9 . The method of claim 1 wherein a multidomain embedding of the plurality of multidomain embeddings is based on more than two domain embeddings.
10 . The method of claim 1 wherein said unsupervised training the plurality of importances is based on a loss function that does not use a domain embedding.
11 . One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause:
generating, by an unsupervised trained graph model, a plurality of multidomain embeddings, wherein:
each multidomain embedding of the plurality of multidomain embeddings represents a distinct network address of a plurality of network addresses, and
each multidomain embedding of the plurality of multidomain embeddings is based on a plurality of network domains that received requests from said distinct network address;
clustering the plurality of multidomain embeddings into a plurality of clusters of multidomain embeddings;
unsupervised training, based on the plurality of clusters of multidomain embeddings, a plurality of importances;
generating, based on the plurality of importances, an explanation for why an object is or is not suspicious, wherein the object is at least one selected from the group consisting of: a particular cluster of the plurality of clusters of multidomain embeddings and a particular multidomain embedding of the plurality of multidomain embeddings.
12 . The one or more non-transitory computer-readable media of claim 11 wherein:
the plurality of importances includes a disjoint subset of importances for each cluster of the plurality of clusters of multidomain embeddings;
said generating the explanation for said particular cluster is not based on importances for the plurality of clusters other than the particular cluster.
13 . The one or more non-transitory computer-readable media of claim 11 wherein said unsupervised training the plurality of importances is based on centroids of the plurality of clusters of multidomain embeddings.
14 . The one or more non-transitory computer-readable media of claim 11 wherein an importance of the plurality of importances corresponds to one selected from the group consisting of:
a feature of a network address of the plurality of network addresses, and
a network domain of the plurality of network domains.
15 . The one or more non-transitory computer-readable media of claim 11 wherein said unsupervised training the plurality of importances is based on at least one selected from the group consisting of:
a loss function that uses a centroid of a cluster of the plurality of clusters,
a loss function that uses an inner product,
a loss function that uses an entropy measurement,
a loss function that penalizes a sum of multiple importances of the plurality of importances,
a loss function that penalizes mid-range importances, and
a loss function that uses multiple multidomain embeddings of the plurality of multidomain embeddings.
16 . The one or more non-transitory computer-readable media of claim 11 wherein said unsupervised training the plurality of importances comprises measuring a difference between:
a) an inner product of a multidomain embedding of a particular network address and a centroid of a particular cluster of the plurality of clusters that contains the multidomain embedding of the particular network address and
b) an average of respective inner products of a respective centroid of each cluster of the plurality of clusters that is not said particular cluster and the multidomain embedding of the particular network address.
17 . The one or more non-transitory computer-readable media of claim 11 wherein said plurality of importances consists of a respective disjoint subset of importances for each multidomain embedding of the plurality of multidomain embeddings.
18 . The one or more non-transitory computer-readable media of claim 17 wherein said subsets of importances for a first multidomain embedding of the plurality of multidomain embeddings and a second multidomain embedding of the plurality of multidomain embeddings consist of different counts of importances.
19 . The one or more non-transitory computer-readable media of claim 11 wherein a multidomain embedding of the plurality of multidomain embeddings is based on more than two domain embeddings.
20 . The one or more non-transitory computer-readable media of claim 11 wherein said unsupervised training the plurality of importances is based on a loss function that does not use a domain embedding.