Network anomaly detection with graph neural networks

(English) Modern networks support critical applications with increasingly diverse, complex, and dynamic requirements. Ensuring their proper functioning is vital to maintaining the reliability and availability of these dependent services. Anomaly Detection (AD) plays a crucial role in preserving network performance by promptly identifying disruptions or degradations. In computer networks, the behavior of a node (e.g., a router) is heavily influenced by its surrounding elements. However, many traditional and Machine Learning (ML)-based methods often fail to exploit these structural correlations effectively, and in some cases ignore them entirely. While some existing approaches attempt to incorporate topological information into the AD task, they often do so suboptimally, losing key relational information. As a result, these systems struggle to achieve the robustness and adaptability required for deployment in dynamic, production environments. Graph Neural Networks (GNNs) have recently gained prominence for modeling tasks where spatial correlations are essential. Nevertheless, their application to AD in computer networks remains underexplored, despite their natural suitability for such structured environments. This thesis investigates new uses of GNNs for AD in networked systems, focusing on three representative scenarios: (i) Border Gateway Protocol (BGP) AD, where hijacks and misconfigurations cause structural changes; (ii) contextual AD, where anomalies depend on the behavior of neighboring entities; and (iii) zero-shot spatiotemporal modeling, enabling forecasting in data-scarce environments. In the first scenario, we leverage the raw BGP topology to design a model capable of generalizing across incidents while maintaining a low false-positive rate, an essential requirement for real-world deployment. We evaluate the model on well-known BGP incidents and extensive regular operation data to validate its robustness. For contextual AD, we propose two GNN-based models that uncover hidden relationships between flows in a backbone network. We validate these models on datasets containing both real and synthetic anomalies and show how the attention mechanisms provide interpretable visualizations of the learned contextual dependencies. Finally, we introduce a GNN-based spatiotemporal model trained on non-networking time series, capable of achieving zero-shot forecasting performance on network monitoring data. The model exploits attention mechanisms to learn and transfer spatial and temporal correlations across domains, outperforming state-of-the-art baselines. Moreover, the learned attention patterns suggest opportunities to simplify spatiotemporal representations, which is critical for scaling models to large production networks. These predictions can subsequently be used to perform AD, which is our main motivation to develop it. Collectively, the contributions of this thesis advance the use of Graph Neural Networks for Anomaly Detection in computer networks by systematically leveraging topological information to improve predictive performance and interpretability. Furthermore, the role of attention mechanisms for providing more interpretable results is also explored, opening the door to using them as a way to both understand the reasons behind the detected anomalies and to provide more transparency to the underlying dynamics in computer networks. (Català) Les xarxes modernes donen suport a aplicacions crítiques amb requisits cada vegada més diversos, complexos i dinàmics. Garantir el seu funcionament correcte és fonamental per mantenir la fiabilitat i disponibilitat dels serveis que en depenen. La Detecció d’Anomalies (AD, per les seves sigles en anglès) juga un paper clau en la preservació del rendiment de la xarxa, ja que permet identificar ràpidament interrupcions o degradacions. En les xarxes de computadors, el comportament d’un node (per exemple, un encaminador) està fortament influenciat pels elements del seu entorn. No obstant això, molts mètodes tradicionals i basats en l’aprenentatge automàtic (ML) no aprofiten de manera efectiva aquestes correlacions estructurals i, en alguns casos, les ignoren completament. Tot i que alguns enfocaments existents intenten incorporar informació topològica a la tasca de detecció d’anomalies, sovint ho fan de manera subòptima, perdent informació relacional clau. Això provoca que aquests sistemes tinguin dificultats per assolir la robustesa i adaptabilitat necessàries per ser desplegats en entorns de producció dinàmics. Les Xarxes Neuronals Gràfiques (GNNs) han guanyat protagonisme recentment per a tasques de modelatge on les correlacions espacials són essencials. Tanmateix, la seva aplicació a la detecció d’anomalies en xarxes de computadors encara està poc explorada, tot i la seva adequació natural per a entorns estructurats.