GDN Anomaly Detection System

A Graph Deviation Network (GDN) based anomaly detection system for identifying unusual login behaviors with interactive network visualization.

🌟 Key Features

• Login Behavior Anomaly Scoring: Analyzes individual login events, not network nodes
• Interactive Network Visualization: PyVis-based interactive graphs with anomaly highlighting
• Anomalous Login Chain Detection: Red edges highlight connections with high anomaly rates
• Configurable Network Topology: Define office networks, IP ranges, and server types
• Multi-dimensional Analysis: Time, location, server access, and privilege patterns
• Realistic Data Modeling: Proper user-to-IP ratios and network relationships

🏗️ System Architecture

Network Topology

• Users (circles) → Independent nodes connecting to offices and servers
• Office IPs (dots) → Point to their respective Office nodes (boxes)
• Server IPs (triangles) → Point to their respective Server Type nodes (diamonds)
• Connections → Show login relationships with anomaly rate highlighting

Anomaly Detection

• Unusual Time Access: Logins outside normal working hours
• Unusual Location Access: Logins from unexpected office locations
• Unusual Server Access: Access to servers not normally used by the user
• Privilege Escalation: Non-admin users accessing high-privilege servers
• Failed Login Patterns: Suspicious authentication failures

🚀 Quick Start

1. Installation

# Install required dependencies
pip install pandas numpy pyyaml pyvis

# Clone the repository
git clone <repository-url>
cd gdn_anomaly_detection

2. Generate Sample Data

python3 data_generator.py

This creates sample_data.csv with realistic login events including anomalies.

3. Create Network Visualization

python3 visualizer.py

This generates network_visualization.html - open it in your web browser.

4. Run Demo

python3 demo.py

Shows comprehensive system analysis and statistics.

📁 Project Structure

gdn_anomaly_detection/
├── README.md                     # This file
├── LICENSE                       # MIT license
├── requirements.txt              # Python dependencies
├── .gitignore                   # Git ignore patterns
├── config.py                    # System configuration
├── data_generator.py            # Sample data generation
├── visualizer.py                # Network visualization
├── gdn_model.py                 # GDN model implementation
├── demo.py                      # System demonstration
├── sample_data.csv              # Generated sample data
└── network_visualization.html   # Interactive visualization

⚙️ Configuration

Office Networks

Define office locations with network segments and working hours:

OFFICE_NETWORKS = {
    'US_Office': {
        'name': 'US Office',
        'network_segments': ['192.168.1.0/24', '10.0.1.0/24'],
        'working_hours': {
            'start': time(8, 0),   # 8:00 AM
            'end': time(18, 0),    # 6:00 PM
            'timezone': 'US/Pacific'
        }
    }
}

Server Types

Configure server types with IP ranges:

SERVERS = {
    'web_server': {
        'name': 'Web Application Server',
        'ip_ranges': ['10.0.10.0/24', '10.0.11.0/24'],
        'services': ['HTTP', 'HTTPS'],
        'criticality': 'high'
    }
}

🎯 Usage Examples

Basic Analysis

# Generate fresh data
python3 data_generator.py

# Create visualization
python3 visualizer.py

# View results
python3 demo.py

Custom Configuration

from config import OFFICE_NETWORKS, SERVERS

# Add new office
OFFICE_NETWORKS['Tokyo_Office'] = {
    'name': 'Tokyo Office',
    'network_segments': ['192.168.4.0/24'],
    'working_hours': {
        'start': time(9, 0),
        'end': time(18, 0),
        'timezone': 'Asia/Tokyo'
    }
}

📊 Sample Output

The system generates realistic data with:

• 20 users (15 office workers + 5 remote)
• 130+ office IP addresses
• 35+ server IP addresses
• ~1,300 login events with 0.5-1% anomaly rate

🌐 Interactive Visualization Features

• Color-coded Nodes: Red = anomalous users, Green = normal users
• Edge Highlighting: Red edges = high anomaly rates, Orange = medium, Gray = normal
• Interactive Controls:
  • 🔍 Fit View
  • ⚡ Toggle Physics
  • 🚨 Focus Anomalous Users
  • 🔗 Highlight Anomalous Chains
• Hover Information: Detailed statistics for nodes and connections
• Anomaly Analysis: Table of top anomalous login events

📈 System Performance

• Scalability: Handles thousands of login events efficiently
• Real-time Capable: Designed for live data integration
• Browser Compatible: Works in Chrome, Firefox, Safari, Edge
• Memory Efficient: Optimized data structures and sampling

🔧 Development

Data Generator

• Generates realistic user behavior patterns
• Creates configurable anomaly rates
• Supports multiple office locations and server types

Visualizer

• PyVis-based interactive networks
• Anomaly-focused highlighting
• Responsive web interface

GDN Model

• Graph neural network implementation
• Login behavior analysis
• Anomaly scoring algorithms

🚨 Anomaly Types Detected

1. Unusual Time Access (0.3 score): Outside working hours
2. Unusual Location Access (0.4 score): From unexpected offices
3. Unusual Server Access (0.3 score): Servers not normally accessed
4. Failed Login (0.2 score): Authentication failures
5. Privilege Escalation (0.2 score): Non-admin accessing critical servers

Scores are cumulative, with 0.5+ considered anomalous.

📋 Requirements

• Python 3.8+
• pandas >= 1.3.0
• numpy >= 1.21.0
• pyyaml >= 5.4.0
• pyvis >= 0.3.2

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

📞 Support

For questions and support, please open an issue on GitHub.

🙏 Acknowledgments

• Graph Deviation Network (GDN) research
• PyVis library for network visualization
• NetworkX for graph operations