FadMan: Federated Anomaly Detection across Multiple Attributed Networks
Anomaly subgraph detection has been widely used in various applications,
ranging from cyber attack in computer networks to malicious activities in
social networks. Despite an increasing need for federated anomaly detection
across multiple attributed networks, only a limited number of approaches are
available for this problem. Federated anomaly detection faces two major
challenges. One is that isolated data in most industries are restricted share
with others for data privacy and security. The other is most of the centralized
approaches training based on data integration. The main idea of federated
anomaly detection is aligning private anomalies from local data owners on the
public anomalies from the attributed network in the server through public
anomalies to federate local anomalies. In each private attributed network, the
detected anomaly subgraph is aligned with an anomaly subgraph in the public
attributed network. The significant public anomaly subgraphs are selected for
federated private anomalies while preventing local private data leakage. The
proposed algorithm FadMan is a vertical federated learning framework for public
node aligned with many private nodes of different features, and is validated on
two tasks correlated anomaly detection on multiple attributed networks and
anomaly detection on an attributeless network using five real-world datasets.
In the first scenario, FadMan outperforms competitive methods by at least 12%
accuracy at 10% noise level. In the second scenario, by analyzing the
distribution of abnormal nodes, we find that the nodes of traffic anomalies are
associated with the event of postgraduate entrance examination on the same day.