Anomaly Detection using Knowledge Graphs: A Survey for Network Management and Cybersecurity Application

Anomaly Detection using Knowledge Graphs: A Survey for Network Management and Cybersecurity Application. This survey examines how knowledge graphs and anomaly detection might work together in decision-support systems for network and security operations. The challenge is to combine the traceable logic of rules with the broader flexibility of probabilistic models. The proposed architecture remains a research direction rather than a proven deployment recipe.

Information and communications technology networks are complex and varied. Investigating an incident can require technical and operational data from different systems. Network monitoring systems and security information and event management systems already help analyze these inputs, but their basic representations can still leave teams without enough shared context. A knowledge graph instead links distinct pieces of information and supports consistent interpretation and logical reasoning. That can help analysts ask whether a failed host threatens a service or whether separate logs belong to the same incident.

Rule-based detection has understandable logic, which helps people explain decisions and share knowledge. But numerous narrowly written rules are difficult to maintain and adapt, and they can miss unfamiliar anomalies. Probabilistic machine-learning models can generalize across a wider range of signals, yet their internal representations are harder to trace and their false positives require additional validation. The researchers therefore ask what design principles could balance explainability and generalization across a unified view of a large network. More concretely, could explicit graph representations support both definite rule-based conclusions and reasoning under uncertainty while accounting for changing system state?

This is a critical survey of prior approaches. The researchers used keyword searches to find work on anomaly and failure detection in networked systems. They organized their analysis around knowledge representation, complexity, anomaly detection and explainability. The evidence is therefore a structured synthesis of existing work.

The researchers found that established network-monitoring and security systems simplify analysis across assets, logs, alarms and vulnerability scans, but heterogeneous sources hinder full contextualization of failures. Semantic models for network and security operations can support knowledge graphs, yet they generally do not cover the whole domain or express conditional procedures for changing system states. Among the reviewed algorithmic methods, none simultaneously handled events over time, network structure, logical dependencies and probabilistic uncertainty. Few approaches also combined explainability through explicit representations with interconnected data that changes across several dimensions over time. The available pieces overlap, but they do not yet form a complete solution.

The proposed architecture places a knowledge graph in the data platform. It receives streaming events, static or slowly changing datasets, previous inference results and actions taken by network or security analysts. A network of ontologies organizes that information into a unified description of network configuration, current state and surrounding context. Detection and diagnostic modules read from the graph and write their conclusions back, giving later analysis additional context. These modules could run on demand, periodically or after significant events, while analysts explore the resulting network state through specialized interfaces. This creates a feedback loop between observations, automated conclusions and human actions.

Several gaps constrain this design. Existing automated contextualization may omit network topology or operational information. Many semantic models cover only parts of the required domain, sometimes representing topology at a high level or supporting limited conditional reasoning. Few reviewed solutions were designed directly for streamed analysis, and those generally required training. Graph data was not widely used by anomaly-detection methods, while coupling logical and probabilistic approaches remained limited. The researchers also say inference capabilities may need adjustment through practical experiments, and that integrating Semantic Web technology with industrial decision-support patterns still requires end-to-end research. A graph alone therefore does not resolve the identified engineering and reasoning problems.

A reasonable industry interpretation is to use this survey as a design checklist, not a product scorecard. Security architects and detection engineers can begin by identifying the relationships their analysis needs among system context, events and analyst actions. Existing vocabularies can be reused where they fit without adding needless complexity. Teams considering this architecture also need plans to ingest data that changes at different speeds. They should feed analytical conclusions back into the context and test inference behavior against practical cases. Graph-shaped storage alone does not guarantee interoperability or useful reasoning: existing graph-based products do not always use open semantic models or include topology and operational data.

The contribution is a structured account of how decision-support systems, semantic models and anomaly-detection techniques can complement one another, and where they remain disconnected. The proposed knowledge-graph architecture gives network and security operations teams a design for making context explicit and reusing analytical conclusions in later reasoning. Design reviews should ask whether representations cover network topology and changing state, and whether they can reason about dependencies and uncertainty. A knowledge graph alone does not guarantee complete context or effective anomaly detection. Models remain incomplete, logic-based and probabilistic techniques are weakly coupled, and industrial integration is unresolved.