Anomaly detection with graph adversarial training in computer systems

System for detecting and responding to an intrusion in a computer network, comprising:

• a hardware processor;
• a memory configured to store a computer program that, when executed by the computer program causes the hardware processor to implement:
• a graph-based neural network model, configured to detect anomalous activity in a computer network;
• a model trainer, stored in the memory and executed by the hardware processor, configured to generate an adversarial training data set that includes original samples and adversarial samples, by perturbing one or more of the original samples with an integrated gradient attack to generate the adversarial samples, including a determination of an integrated gradient for a perturbation to determine how much the perturbation will affect a prediction outcome for an unlabeled node;
• to encode the original and adversarial samples to generate respective original and adversarial graph representations, based on node neighborhood aggregation;
• and to train the graph-based neural network to detect anomalous activity in a computer network, using the adversarial training data set;
• and
• a security console configured to perform a security action responsive to the detected anomalous activity.