Source-linked AI summary
AnomalyDAE: Dual autoencoder for anomaly detection on attributed networks
Haoyi Fan, Fengbin Zhang, Zuoyong Li
TL;DR
AnomalyDAE addresses attributed-network anomaly detection when existing methods neglect interactions between network structure and node attributes. It jointly learns node and attribute embeddings with dual autoencoders, detects anomalies from reconstruction errors, and reports up to 22.32% ROC AUC improvement over state-of-the-art deep models.
Problem
Existing attributed-network anomaly-detection methods neglect complex cross-modality interactions between network structure and node attributes, despite their importance for detecting structure- and attribute-induced anomalies.
Method
AnomalyDAE jointly learns node and attribute embeddings with structure and attribute autoencoders, capturing cross-modality interactions during reconstruction and scoring anomalies from structure and attribute errors.
Results
Up to 22.32% improvement in ROC AUC is reported over state-of-the-art deep models on multiple real-world datasets.
Takeaways & Limitations
The reported results indicate that jointly modeling network structure and node attributes can support anomaly detection across multiple real-world datasets.
Takeaways & Limitations
The loss function assumes that non-zero elements deserve greater reconstruction-error penalties because real-world networks may contain missing edges or attributes.
Abstract
from arXiv · showhide
Anomaly detection on attributed networks aims at finding nodes whose patterns deviate significantly from the majority of reference nodes, which is pervasive in many applications such as network intrusion detection and social spammer detection. However, most existing methods neglect the complex cross-modality interactions between network structure and node attribute. In this paper, we propose a deep joint representation learning framework for anomaly detection through a dual autoencoder (AnomalyDAE), which captures the complex interactions between network structure and node attribute for high-quality embeddings. Specifically, AnomalyDAE consists of a structure autoencoder and an attribute autoencoder to learn both node embedding and attribute embedding jointly in latent space. Moreover, attention mechanism is employed in structure encoder to learn the importance between a node and its neighbors for an effective capturing of structure pattern, which is important to anomaly detection. Besides, by taking both the node embedding and attribute embedding as inputs of attribute decoder, the cross-modality interactions between network structure and node attribute are learned during the reconstruction of node attribute. Finally, anomalies can be detected by measuring the reconstruction errors of nodes from both the structure and attribute perspectives. Extensive experiments on real-world datasets demonstrate the effectiveness of the proposed method.
1. INTRODUCTION
Anomaly detection on attributed networks seeks nodes that deviate from reference nodes, but existing methods may miss interactions between network structure and attributes. AnomalyDAE addresses this with a dual autoencoder and reports improved ROC AUC performance on real-world datasets.
- Attributed-network anomaly detection targets nodes whose patterns or behaviors significantly deviate from reference nodes across applications including intrusion detection and spammer detection.
- Existing methods may incur computational overhead or learn only node representations, neglecting complex interactions between network structure and node attributes.
- AnomalyDAE proposes a deep joint representation-learning framework that captures cross-modality interactions and measures anomalies from both structure and attribute perspectives.
- 22.32% improvement in ROC AUC is reported for AnomalyDAE over state-of-the-art deep models across multiple real-world datasets.
2. NOTATIONS AND PROBLEM STATEMENT
The paper models an attributed network as a graph with node attributes and formulates anomaly detection as identifying rare nodes that differ from reference nodes in structure and attributes.
- An attributed network G = {V, E, X} is an undirected graph whose nodes have associated attributes.The graph contains node set V, edge set E, and attribute information X.
- Each node is associated with an N-dimensional attribute, where M=|V| denotes the number of nodes and |E| denotes the number of edges.
- The detection goal is to identify nodes that are rare and significantly differ from most reference nodes in both structural and attribute information.
- A score function f maps each node Vi to a real-valued score yi, which classifies samples using a threshold λ.The notation passage specifies that yi is the label of sample xi, with 0 for normal and 1 for anomalous.
3. METHOD
AnomalyDAE jointly reconstructs network structure and node attributes through dual autoencoders, learning cross-modality interactions and detecting anomalies from both reconstruction errors.
- Framework: AnomalyDAE combines structure and attribute autoencoders to jointly learn node and attribute embeddings in latent space.The structure decoder reconstructs network structure, while the attribute decoder reconstructs node attributes.
- Structure Autoencoder: A graph attention layer aggregates neighbor representations using learned importance weights for structure encoding.The weights are normalized through softmax before producing the final node embedding.
- Structure Autoencoder: The structure decoder uses final node embeddings and inner products to estimate link probabilities for network reconstruction.Sigmoid activation is applied to the decoder output.
- Attribute Autoencoder: The attribute decoder takes both node and attribute embeddings as inputs, jointly capturing interactions between network structure and node attributes.It omits an activation function to support arbitrary-valued attributes.
- Loss Function: The training objective minimizes weighted reconstruction errors for network structure and node attributes, with α controlling their trade-off.Parameters η and θ impose greater penalties on non-zero elements to account for missing edges or attributes.
- Anomaly Detection: Each node’s anomaly score combines structure and attribute reconstruction errors, and nodes above a score threshold are classified as anomalous.The threshold can be set by selecting the top-k anomaly scores.
4. EXPERIMENTS
Experiments evaluate AnomalyDAE against established anomaly-detection baselines on three real-world datasets and examine sensitivity to embedding dimension and reconstruction weighting. AnomalyDAE consistently achieves stronger AUC performance, while balanced structure–attribute reconstruction and moderate embedding dimensions are important for performance.
- Performance Evaluation: Experiments use BlogCatalog, Flickr, and ACM, with AUC reported for anomaly detection against LOF, SCAN, AMEN, Radar, Anomalous, and Dominant.AnomalyDAE is trained for 100, 100, and 80 iterations respectively, using embedding dimension 128 for all datasets.
- Performance Evaluation: AnomalyDAE significantly outperforms all baselines across the evaluated datasets.The reported comparisons include gains over traditional methods and the more recent Dominant model.
- Performance Evaluation: 22.32% improvement in ROC AUC is the largest reported gain over Dominant, occurring on the Flickr dataset.Compared with Dominant, the reported gains are 19.68% on BlogCatalog, 22.32% on Flickr, and 15.11% on ACM.
- Parameter Sensitivity: Embedding dimensions of 128 or 256 facilitate high performance, whereas dimensions that are too low or too high degrade performance.Lower dimensions weaken modeling ability, while higher dimensions can lead to overfitting.
- Parameter Sensitivity: Using only attribute reconstruction or only structure reconstruction produces poor performance, highlighting the importance of their interaction.The trade-off parameter settings α=0 and α=1 correspond to considering only attribute or structure reconstruction, respectively.
5. CONCLUSION
The paper addresses anomaly detection on attributed networks by modeling interactions between network structure and node attributes. Its dual autoencoder jointly learns node and attribute embeddings and performs better than current state-of-the-art methods on multiple real-world datasets.
- 5. CONCLUSION: AnomalyDAE uses two separate autoencoders to jointly learn node and attribute embeddings while considering modality interactions.The framework targets anomaly detection on attributed networks.
- 5. CONCLUSION: AnomalyDAE performs better than current state-of-the-art methods on multiple real-world datasets.The conclusion reports this as the method's overall experimental outcome.