CGGM: a conditional graph generation model with adaptive sparsity for node anomaly detection in IoT networks

Dynamic graphs are increasingly utilized for detecting anomalous behaviors in nodes within the Internet of Things (IoT). Graph generative models play a pivotal role in addressing the challenge of imbalanced node categories in dynamic graphs. However, these models encounter several limitations, including the monotonicity of adjacency relationships, the complexity in constructing multi-dimensional features for nodes, and the absence of an end-to-end method for generating multiple categories of nodes. In this study, we introduce a novel graph generation model, designated as Conditional Graph Generation Model (CGGM), aimed specifically at generating samples from minority classes. The architecture comprises two principal modules: a conditional graph generation module and a graph-based anomaly detection module. The generative module adjusts to matrix sparsity by downsampling a noise adjacency matrix and integrates a multi-dimensional feature encoder based on multi-head self-attention to capture latent feature dependencies. Furthermore, a latent space constraint coupled with distribution distance is utilized to approximate the latent distribution of real data. The graph-based anomaly detection module employs the generated balanced dataset to predict node behaviors. Extensive experiments demonstrate that CGGM surpasses contemporary state-of-the-art methods in accuracy and divergence. The results further reveal that CGGM can produce diverse data categories, thereby enhancing the performance in multi-category classification tasks.