Effectiveness of Term Frequency-Inverse Graph Frequency (TF-IGF) Technique Against Various Cyber Attacks
摘要
The ability to detect fraudulent activities such as denial-of-service attacks (DoS), social media impersonations, or fake recommendations in e-commerce networks is a difficult task. One approach to aiding in detecting these types of anomalous activities is to represent the data as a graph. In general, given a stream of graph edges, where each edge indicates a communication/link in a specific time, the objective is to detect abnormal edges that represent actions such as DoS attacks, port scans, etc., and do so in an online manner while consuming constant time and memory. In this paper, we propose Term Frequency-Inverse Graph Frequency (TF-IGF) as an online anomaly detection approach, which assigns anomaly scores to edge streams. We further analyze the performance of the TF-IGF technique in detecting various types of cyber attacks by using real-world streaming graph datasets and benchmarking against the existing edge streaming models. Performance is compared based on 1. the accuracy in classifying anomalies, 2. the experiment run-time, and 3. the type of anomalies detected. The results show the strengths of TF-IGF in detecting various cyber attacks in streaming graph networks. The paper concludes with recommendations for future work and provides valuable insights for designing and deploying efficient and effective anomaly detection systems in streaming graph networks.