Adversarial Reconstruction with Spectral-Augmented and Graph Joint Embedding for Network Anomaly Detection

Network anomaly detection is widely used in network analysis and security prevention, in which reconstruction-based approaches have achieved remarkable results. However, attributed networks exhibit highly nonlinear relationships and time dependence over time, which make the anomalies more complex and ambiguous, resulting in anomaly detection still facing challenges. To this end, this study proposes an adversarial reconstruction framework with spectral-augmented and graph joint embedding for anomaly detection (GAN-SAGE), which integrates an autoencoder (AE) based on the frequency feature enhanced graph transformer (GT) into the generator for generating adversarial networks (GAN), improving network representation through adversarial training. The first stage of the encoding process captures the frequency domain information of the input timing data through spectral-augmented, and the second stage enhances the modeling capability of spatial structure and graph interaction dependency through multi-attribute coupling and GTs. We conducted extensive experiments on AIOps, SWaT and WADI datasets, demonstrating the effectiveness of GAN-SAGE compared to the state-of-the-art method. The detection performance of GAN-SAGE, respectively, improved by an average of 9.64%, 18.73% and 19.79% in terms of F1-score across the three datasets.