Anomaly detection using knowledge graphs: A survey for network management and cybersecurity application

In telecommunications and computer networks, effective incident management highly depends on handling data heterogeneity and providing detailed event context. While knowledge graphs can assist with data integration and AI techniques with contextualization, these aspects are often treated separately, limiting progress toward detailed, explainable, shareable network behavior understanding. This article offers a structured overview, through three perspectives, of how integrating semantic knowledge representations and AI can address this gap. First, we analyze current Network Monitoring Systems (NMS) and Security Information and Event Management (SIEM) systems with respect to the needs of NetOps and SecOps experts. We identify key limitations and discuss enhancements through the incorporation of network topology and operational data, the use of semantic models, and the integration of multiple analytical techniques working together. Next, we review semantic models aligned with NetOps and SecOps, assessing their coverage and expressivity to inform decision support system designers about their potential for reuse, combination, and their capabilities in representing and reasoning about network and system state changes. Finally, we categorize AI techniques by approach, level of determinism, the knowledge representations used, and the incident management steps they address. We identify families of techniques and how each serves operational needs. Additionally, we highlight system design patterns that could maximize, either within families of techniques or through their combination, a detailed understanding of the interplay between network architecture and operational dynamics. We synthesize these three perspectives into a high-level design proposal for a next-generation NMS/SIEM combining logic-based and probabilistic reasoning within a semantic ecosystem, aiming to further automate context-aware incident management in complex Information and Communications Technology (ICT) environments.