PaperlayerView exact revision on arXiv

Source-linked AI summary

A Comprehensive Survey on Graph Anomaly Detection with Deep Learning

Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z. Sheng, Hui Xiong, Leman Akoglu

arXiv:2106.07178v5cs.LG

TL;DR

Graph anomaly detection must capture relational patterns that conventional feature-space methods overlook. This survey organizes deep-learning approaches, datasets, implementations, metrics, and open directions, offering a unified resource for the field.

  • Problem

    Graph anomalies can involve unusual relationships and substructures, requiring detection methods that account for structural information beyond individual features.

  • Method

    The survey categorizes deep-learning techniques by anomalous nodes, edges, subgraphs, and graphs, while compiling datasets, implementations, and evaluation metrics.

  • Results

    The review provides systematic comparisons, benchmarking resources, and 12 potential directions for future graph anomaly detection research.

  • Takeaways & Limitations

    The survey offers a unified basis for understanding existing approaches and guiding future benchmarking and research in graph anomaly detection.

  • Takeaways & Limitations

    Existing graph anomaly detection methods often lack scalability to large networks because transductive models require the whole graph as input.

Abstract

from arXiv · show

Anomalies represent rare observations (e.g., data records or events) that deviate significantly from others. Over several decades, research on anomaly mining has received increasing interests due to the implications of these occurrences in a wide range of disciplines. Anomaly detection, which aims to identify rare observations, is among the most vital tasks in the world, and has shown its power in preventing detrimental events, such as financial fraud, network intrusion, and social spam. The detection task is typically solved by identifying outlying data points in the feature space and inherently overlooks the relational information in real-world data. Graphs have been prevalently used to represent the structural information, which raises the graph anomaly detection problem - identifying anomalous graph objects (i.e., nodes, edges and sub-graphs) in a single graph, or anomalous graphs in a database/set of graphs. However, conventional anomaly detection techniques cannot tackle this problem well because of the complexity of graph data. For the advent of deep learning, graph anomaly detection with deep learning has received a growing attention recently. In this survey, we aim to provide a systematic and comprehensive review of the contemporary deep learning techniques for graph anomaly detection. We compile open-sourced implementations, public datasets, and commonly-used evaluation metrics to provide affluent resources for future studies. More importantly, we highlight twelve extensive future research directions according to our survey results covering unsolved and emerging research problems and real-world applications. With this survey, our goal is to create a "one-stop-shop" that provides a unified understanding of the problem categories and existing approaches, publicly available hands-on resources, and high-impact open challenges for graph anomaly detection using deep learning.

1 INTRODUCTION

Graph anomaly detection identifies abnormal graph objects by incorporating relational structure that conventional feature-space methods overlook. This survey reviews deep learning approaches, organizes anomaly types and challenges, and provides resources and future directions for the field.

  • Motivation: Anomalies are abnormal objects that significantly differ from normal or expected objects, despite often occurring rarely in real-world data.They can provide critical signals for antifraud detection and network intrusion protection while also causing adverse impacts such as panic from fake news.
  • Motivation: Conventional anomaly detection represents objects as feature vectors and identifies outlying data points, thereby overlooking relational information.This limitation is important when anomalous and benign objects have near-identical attributes.
  • Problem Definition: Graph anomaly detection addresses this limitation by using nodes and edges to represent objects and their relationships in a non-Euclidean space.Unexpectedly dense connections formed by fake users can reveal deviations that feature-based methods miss.
  • Limitations of Existing Methods: Earlier graph anomaly methods relied on handcrafted features, statistical models, matrix factorization, or SVM, limiting scalability, unknown-anomaly detection, and representational expressiveness.Non-deep techniques also lack the capability to capture non-linear properties of real objects, motivating deep learning methods.
  • Survey Contributions: The survey is presented as the first dedicated comprehensive review of deep learning techniques for graph anomaly detection.It systematically reviews recent work, summarizes seven data-specific and four technique-specific challenges, and analyzes methods by motivations, detection ideas, conventional techniques, and taxonomies.
  • Survey Contributions: The survey highlights 12 future research directions and provides open-source algorithms, public and synthetic datasets, evaluation metrics, benchmark datasets, and baselines.It also introduces a taxonomy covering node, edge, sub-graph, and graph anomalies and identifies their differences and similarities.

2 PRELIMINARIES

This section establishes graph definitions for node-, edge-, and sub-graph-level anomaly detection by distinguishing static, dynamic, and graph-database settings. It formalizes plain, attributed, and dynamic graphs, while noting how available labels enable supervised or semi-supervised detection.

  • Graph categories: The survey categorizes graphs as static graphs, dynamic graphs, and graph databases for subsequent anomaly-detection discussions.Unless otherwise specified, later sections concern static graphs.
  • Plain graph: A static plain graph G = {V, E} consists of nodes V and edges E connecting pairs of nodes.Its adjacency matrix A = [a_i,j]_{n×n} records whether each node pair is connected.
  • Attributed graph: A static attributed graph G = {V, E, X} extends the plain graph with node attributes represented by matrix X.Attribute and feature are used interchangeably, and each node attribute vector has dimension k.
  • Dynamic graph: A dynamic graph G(t) = {V(t), E(t), Xv(t), Xe(t)} contains nodes, edges, and attributes that change over time.Node and edge attribute matrices are specified at each time step when they exist.
  • Graph labels: When numerical or categorical node or edge labels are available or partially available, supervised or semi-supervised detection models can be trained effectively.Labels may indicate classes such as normal or abnormal.

3 ANOMALOUS NODE DETECTION (ANOS ND)

Anomalous node detection in static graphs identifies nodes that differ from others through graph structure, node attributes, or both. The survey organizes these anomalies and reviews traditional, representation-learning, and deep-learning approaches for detecting them.

  • Scope: Static graph anomalous nodes are abnormal individual objects, such as network intruders, fraudulent users, or fake news.The section focuses specifically on anomalous node detection in static graphs, while dynamic graphs are reviewed separately.
  • Anomaly Types: Global anomalies differ in node attributes, structural anomalies differ in connection patterns, and community anomalies differ in attributes within their communities.These categories use node attributes, graph structure, or their combination to distinguish anomalous nodes.
  • Traditional Methods: Traditional methods transform graph anomaly detection into feature-based anomaly detection, but feature selection can be costly and structural information may remain inadequately captured.OddBall extracts statistics from nodes and their 1-hop neighbors to identify local structural patterns, heavy links, and dominant heavy links.
  • Representation Learning: Network representation methods encode graph structure into vectors and detect anomalies through distinguishable embedding locations or community-connection patterns.Hu et al.’s method assigns higher anomaly scores to nodes connecting across communities, with above-threshold nodes identified as anomalies.
  • Deep Learning Approaches: Attributed graphs combine structural and attribute information, enabling detection of hidden anomalies through deep neural networks, graph neural networks, and reinforcement learning.The survey separately reviews Deep NN, GCN, and reinforcement-learning techniques, while other methods are covered in an appendix.

4 ANOS ND ON DYNAMIC GRAPHS

Dynamic graphs combine evolving structure, node attributes, and temporal signals, making anomaly detection more challenging while potentially revealing additional anomaly details. The section reviews network-representation and GAN-based techniques, including NetWalk and OCAN, and identifies joint structural-attribute modeling as an open direction.

  • Motivation: Dynamic graphs contain evolving structural, node-attribute, and temporal information, increasing detection difficulty through data volume while providing additional anomaly details.Temporal signals include evolving patterns of graph structure and node attributes.
  • Network Representation Techniques: NetWalk detects anomalous nodes in dynamic plain graphs using only structure, encoding the initial graph with an autoencoder and incrementally updating node representations.It follows a graph-encoding approach in which anomaly detection is performed in an embedding space.
  • GAN-Based Techniques: OCAN detects anomalous users from observed benign users’ attributes by modeling normal activity patterns with an LSTM autoencoder and a one-class adversarial network.Historical social behaviors include posts and posts’ URLs, and benign and malicious users are assumed to occupy separate feature-space regions.
  • Open Direction: NetWalk and OCAN respectively consider only structure or attributes, motivating future methods that jointly analyze both information types in dynamic graphs.The survey highlights joint structural-attribute modeling as an unexplored area for future work.

5 ANOMALOUS EDGE DETECTION (ANOS ED)

Anomalous edge detection identifies abnormal links representing unexpected relationships between objects. Deep learning approaches model edge distributions, use GCN-based anomaly-aware learning, or learn edge representations directly from graph structure and interactions.

  • Scope: ANOS ED targets abnormal links, such as fraudster–benign-user interactions or attacker–machine connections.These links capture unexpected or unusual relationships between real objects.
  • Deep NN-based methods: Deep models detect anomalous edges by estimating the likelihood that existing links occur.Ouyang et al. model edge distributions and identify existing edges with the lowest probabilities.
  • Deep NN-based methods: UGED estimates edge probability from each endpoint and its neighborhood, training on existing-edge prediction with cross-entropy loss.It encodes nodes with an FCN, aggregates each node with its neighbors, and predicts P(v|u, N(u)) and P(u|v, N(v)).
  • GCN-based methods: AANE reduces contamination from anomalous training edges by jointly learning node embeddings, an anomaly indicator matrix, and adjusted reconstruction losses.It removes predicted anomalies from the adjacency matrix and selects the top-k edges with the lowest probabilities.
  • Edge representation-based methods: Directly learned edge representations can distinguish anomalies when they preserve graph structure and interaction content.Examples of interaction content include online-social-network messages and co-authored papers in citation networks.

6 ANOS ED ON DYNAMIC GRAPHS

This section reviews deep-learning approaches for anomaly detection on dynamic graphs, where anomalous edges are identified by modeling evolving graph structures and edge distributions over time. It highlights challenges in updating informative edge representations and describes AddGraph’s temporal, structural, and attribute-aware scoring framework.

  • Dynamic graph anomaly detection: Dynamic graphs represent edge appearances and disappearances over time, enabling anomalous edges to be detected from changing graph structures and time-specific edge distributions.The section focuses on ANOS ED for dynamic graphs.
  • Network representation methods: Network representation methods encode dynamic graph structure into edge representations before applying traditional anomaly detection techniques to identify irregular edges.Their main challenge is generating and updating informative edge representations as graph structure evolves.
  • Network representation methods: NetWalk detects anomalous edges in dynamic graphs, but updates edge representations without modeling evolving long- and short-term node patterns or graph structure.This limitation motivates more comprehensive dynamic edge anomaly detection methods.
  • AddGraph: AddGraph combines temporal, structural, and attribute information in a semi-supervised GCN-GRU model with attention to measure edge anomalousness in dynamic graphs.At each timestamp, the GCN generates node embeddings from the previous hidden state, while the GRU learns the current hidden state using node embeddings and attention on previous hidden states.
  • AddGraph: AddGraph assigns anomaly scores to temporal-graph edges using the hidden states of their associated nodes, training with existing edges as normal and sampled non-existing edges as anomalies.After training, higher scores identify anomalous edges in test data.

7 ANOMALOUS SUB-GRAPH DETECTION (ANOS SGD)

ANOS SGD detects suspicious sub-graphs whose individual nodes and edges may appear normal but become anomalous collectively, including colluding fraudulent groups. Deep-learning approaches mainly learn anomaly-aware representations and identify dense suspicious regions, but only a few works currently address this challenging problem.

  • Motivation and challenges: Colluding anomalies can form suspicious sub-graphs, such as fraudulent user groups that coordinate misleading reviews, motivating ANOS SGD.Unlike individual node or edge anomalies, sub-graph anomalies emerge from collective behavior and interactions.
  • Motivation and challenges: ANOS SGD is challenging because each node and edge may be individually normal, while anomalous sub-graphs vary in size and internal structure.These properties make sub-graph detection more difficult than node- or edge-level anomaly detection.
  • Deep-learning approaches: DeepFD learns anomaly-aware user representations in bipartite shopping graphs, placing users from the same fraudulent group closely while separating benign users.It measures pairwise behavioral similarity from shared item connections and detects suspicious dense blocks with DBSCAN.
  • Deep-learning approaches: FraudNE jointly embeds users and manipulated items in a shared latent space, then uses DBSCAN to distinguish dense sub-graphs formed by suspicious users and items.Its shared loss encourages linked users and items to obtain similar representations, while reconstruction losses preserve their graph-derived features.
  • Open direction: Only a few studies currently use deep learning for ANOS SGD, leaving sub-graph representation learning an important direction for future research.The survey highlights ANOS SGD as a potential future research area.

8 ANOMALOUS GRAPH DETECTION (ANOS GD)

ANOS GD detects individual graphs that significantly deviate from other graphs in a graph database, including unusual molecules and brain disorders. Recent methods use GNN-based classification or graph-level embeddings, while earlier approaches rely on graph proximities, anomalous graph signals, or frequent motifs.

  • Problem definition: A graph database contains N individual graphs, each defined by node and edge sets and, when attributed, node and edge attribute matrices.The database is represented as G = {G_i = (V_i, E_i, X_v(i), X_e(i))}^N.
  • Problem definition: ANOS GD identifies individual graphs whose structures or features deviate significantly from others, such as unusual molecular graphs or graphs associated with brain disorders.In molecular graphs, atoms and bonds are represented as nodes and edges.
  • Conventional approaches: Single-graph anomaly methods for nodes, edges, and sub-graphs are incompatible with ANOS GD, which has been approached using graph kernels, anomalous graph signals, or frequent motifs.These approaches measure pairwise graph proximities, detect signals from abnormal node groups, or encode graphs using frequent motifs.
  • GNN-based approaches: Recent ANOS GD studies employ GNNs to classify individual graphs as normal or abnormal within a graph database.UPFD models news as tree-structured propagation graphs and treats graphs labeled fake by the trained model as anomalous.
  • GNN-based approaches: A GIN with DeepSVDD generates graph-level embeddings by mean-pooling node embeddings and flags graphs outside a learned hypersphere as anomalous.The framework is trained end-to-end for graph-level anomaly detection.
  • Embedding-based approaches: General graph-level representation methods recast ANOS GD as outlier detection in a shared embedding space through a two-stage process.Graphs are first encoded into a shared latent space, followed by anomaly detection in that space.

9 ANOS GD ON DYNAMIC GRAPHS

Graph-level anomaly detection on dynamic graphs identifies abnormal snapshots or temporal graphs through unusual evolving patterns or graph-level features. Deep learning approaches use GNNs, LSTMs, and autoencoders, exemplified by DeepSphere’s LSTM-autoencoder embeddings and hypersphere-based detection.

  • Dynamic graph-level anomaly detection identifies abnormal graph snapshots or temporal graphs from unusual evolving patterns, graph-level features, or related characteristics.
  • GNNs, LSTMs, and autoencoders are commonly used to derive characteristics of graph snapshots or temporal graphs.
  • DeepSphere: DeepSphere represents a dynamic graph as a sequence of three-order tensors, embeds each snapshot with an LSTM autoencoder, and applies one-class classification to learn a hypersphere covering normal snapshots.
  • DeepSphere: DeepSphere flags an unseen graph as anomalous when its embedding lies outside the learned hypersphere of radius r.
  • Perturbed graphs generated to attack graph classifiers or GNNs can be treated as intensional anomalies, but the survey excludes them because their primary purpose is model attack.

10 PUBLISHED ALGORITHMS AND DATASETS

This section compiles publicly available implementations, benchmark datasets, and commonly used evaluation metrics for graph anomaly detection. It also reviews synthetic dataset strategies motivated by the scarcity of labeled real-world anomalies.

  • Published algorithms and implementations: Published implementations support baseline experiments and are summarized by language, platform, admissible graph types, and code repository URLs.The resources are publicly available through the survey’s GitHub repository.
  • Public datasets: Only the Enron, Twitter Sybil, Disney, Amazon, Elliptic, and Yelp datasets provide labeled anomaly ground truth.Other listed datasets contain raw data that existing works further process.
  • Public datasets: Eight graph-classification datasets can be converted into anomaly-detection benchmarks through downsampling.This conversion is described as using selected normal objects and downsampled anomalies.
  • Synthetic dataset generation: Synthetic benchmarks use injected anomalies in synthetic graphs, modified or inserted anomalies in real-world graphs, or downsampled graph-classification datasets.Downsampling selects one class as normal and other records as anomalies; it does not modify individual records.
  • Evaluation metrics: The most widely used evaluation metrics are accuracy, precision, recall rate, F1-score, and AUC-AP.The survey calls for more dedicated metrics because applications impose different requirements involving false negatives and false positives.

11 FUTURE DIRECTIONS

The survey identifies compounded challenges from anomaly detection, graph complexity, and immature deep-learning techniques, with most existing work focused on anomalous nodes. It outlines future directions spanning richer graph-object detection, dynamic and large-scale graphs, multi-view and camouflaged anomalies, imbalanced and multi-task learning, benchmarking, and unified detection frameworks.

  • Deep-learning graph anomaly detection remains limited, while anomalous edge, sub-graph, and graph detection lags emerging application demands.The survey highlights gaps across social, computer, and financial networks and calls for domain knowledge and graph-level representation learning.
  • Dynamic graphs require methods that jointly model spatial, temporal, and evolving node, edge, sub-graph, and attribute information.Most existing deep-learning approaches rely on DeepWalk, GCN, or models designed for static graphs; dynamic graph mining tools are suggested as a future basis.
  • Scalable anomaly detection is needed for high-dimensional, large-scale networks, where transductive models often cannot process billions of users and links.Inductive learning, including GraphSAGE-style approaches, is proposed as a basis for detecting anomalies in unseen data.
  • Future methods should exploit complementary multi-view information and jointly analyze attributes and higher-order relationships to detect camouflaged anomalies.Anomalies may be indistinguishable in one view yet divergent in another, while camouflage blurs the boundary between anomalous and regular objects.
  • Graph anomaly detection should address class imbalance through anomaly-focused training and use multi-task learning to obtain complementary signals from associated tasks.The survey notes that imbalance techniques are rarely incorporated and that few studies currently explore multi-task learning beyond joint node detection and recommendation.
  • Systematic benchmarking and unified frameworks are needed to evaluate methods consistently and detect diverse anomaly types that coexist in real-world datasets.Benchmarking should include datasets, baselines, metrics, and analysis tools; unified neural architectures and learning strategies remain challenging to design.

12 CONCLUSION

The survey comprehensively reviews modern deep learning techniques for graph anomaly detection and organizes them by graph-object types. It also supports future research through benchmarking resources and twelve identified research directions.

  • 12 CONCLUSION: The survey presents a comprehensive review of graph anomaly detection using modern deep learning techniques.It describes this as the first survey dedicated to this topic.
  • 12 CONCLUSION: Contemporary deep learning techniques are reviewed and categorized according to graph-object types.
  • 12 CONCLUSION: 12 potential future research directions are highlighted based on the survey results.
  • 12 CONCLUSION: The survey compiles datasets, open-sourced implementations, and synthetic dataset generation techniques to support systematic benchmarking.

APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION · APPENDIX B TAXONOMY

The survey identifies data and technical challenges that complicate deep-learning-based graph anomaly detection, including scarce labels, heterogeneous graph and anomaly types, scale, relational dynamics, imbalance, and unknown or camouflaged anomalies. It summarizes these challenges with corresponding methods and presents the survey taxonomy in Fig. 11.

  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Ground-truth anomalies are often unavailable because identifying them through domain experts is generally cost-prohibitive.Most applications have little or no prior knowledge of anomaly features or patterns.
  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Graph anomaly detection must accommodate plain, attributed, and heterogeneous graphs, whose anomalies exhibit different deviating patterns.These graph types encode structural, attribute, or cross-object relational information.
  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Anomalies may occur as nodes, edges, sub-graphs, or entire graphs, requiring concise anomaly definitions and concrete clues about deviation.Each anomaly type can differ significantly from the others.
  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Real-world networks can contain millions or billions of nodes, requiring methods that extract anomalous patterns within feasible time and computing resources.Representing network structure produces high-dimensional and large-scale data.
  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Detection must model pairwise, triadic, and higher-order interdependencies among objects while handling the dynamic nature of real-world networks.Objects cannot be treated independently, and the passage notes that dynamic networks further complicate detection.
  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Because anomalies are rare, the predominance of normal objects creates class imbalance that can cause learning-based methods to overlook anomalous patterns.Without additional measures, this imbalance can produce sub-optimal results.
  • APPENDIX A CHALLENGES IN GRAPH ANOMALY DETECTION: Unknown anomalies may emerge over time, while existing anomalies can camouflage themselves by connecting to normal nodes or mimicking their attributes.These behaviors can bypass existing detection systems.
  • APPENDIX B TAXONOMY: The survey summarizes these data-specific and technical-specific challenges with corresponding articles in Table 7 and presents its taxonomy in Fig. 11.The taxonomy of the survey is shown in Fig. 11.

APPENDIX C ANOS ND ON STATIC GRAPHS · C.1 Traditional Non-Deep Learning Techniques

Appendix C organizes anomaly detection on static graphs according to the survey taxonomy, covering traditional non-deep learning methods and subsequent GAT-, GAN-, and network-representation-based techniques. Traditional methods exploit graph topology and node attributes but face scalability and generalizability limits in large real-world networks.

  • APPENDIX C ANOS ND ON STATIC GRAPHS: The appendix reviews static-graph anomaly detection methods following the survey’s taxonomy, including traditional techniques and approaches based on GATs, GANs, and network representation.The survey taxonomy is presented in Fig. 11.
  • C.1 Traditional Non-Deep Learning Techniques: Traditional methods use statistical models, matrix factorization, and KNN to extract structural and attribute patterns of anomalous nodes for detection.These approaches focus on patterns in graph topology and node attributes before a subsequent detection process.
  • C.1 Traditional Non-Deep Learning Techniques: Matrix factorization methods capture topological structures and node attributes, with ALAD detecting community anomalies by incorporating graph structure A and node attributes X through non-negative matrix factorization.ALAD is identified as an early matrix-factorization attempt for community anomaly detection.
  • C.1 Traditional Non-Deep Learning Techniques: Radar applies residual analysis, learning attribute reconstruction residual errors through factorization while imposing structural restrictions to incorporate graph information.Its premise is that anomalies produce larger reconstruction residuals because they do not match majority attribute patterns.
  • C.1 Traditional Non-Deep Learning Techniques: The homophily hypothesis can fail because connected objects may have distinct attributes, motivating attention to structurally irrelevant node attributes.Regulating connected objects to share similar values in every feature dimension is non-trivial.
  • C.1 Traditional Non-Deep Learning Techniques: Supervised linear regression models such as SGASD train anomaly classifiers from labeled data and combine social-network structure, social-media content, and user labels to identify social spammers.SGASD is reported to have yielded encouraging results for social-spam detection.
  • C.1 Traditional Non-Deep Learning Techniques: Traditional methods capture valuable topology and attribute information, but high computational costs from matrix decomposition and regression limit their application and generalizability in large-scale real-world networks.The limitation concerns both matrix decomposition operations and regression models.

C.2 GAT Based Techniques … F.2 ANOS SGD on Dynamic Graphs

The surveyed techniques use attention, adversarial generation, and representation learning to detect anomalous nodes, while traditional methods extend anomaly detection to dynamic graphs and anomalous sub-graphs through temporal, structural, attribute, and statistical signals.

  • C.2 GAT Based Techniques: GAT methods replace equal neighbor aggregation with attention and separately encode graph structure and node attributes for anomaly detection.AnomalyDAE uses reconstruction loss to rank top-k anomalous nodes, while SemiGNN combines node- and view-level attention with supervised and unsupervised objectives.
  • C.3 GAN Based Techniques: GAN-based AEGIS learns node embeddings, generates anomalies from noise, and uses a discriminator’s output to score nodes before selecting the top-k anomalies.The model first fine-tunes an autoencoder for attribute reconstruction, then trains the generator and discriminator in a mini-max game.
  • C.4 Network Representation Based Techniques: Network-representation methods detect anomalies through residuals, semi-supervised embeddings, neighbor aggregation, and anomaly-aware objectives, but aggregation can make anomalies resemble regular nodes.REMAD ranks nodes by residual norms, SEANO combines labels with graph contexts, and CARE-GNN uses neighbor sampling to mitigate feature and relation camouflage.
  • APPENDIX D ANOS ND ON DYNAMIC GRAPHS WITH TRADITIONAL NON-DEEP LEARNING TECHNIQUES: Traditional dynamic-node methods model evolving graph structure, node and edge attributes, or heterogeneous relationships to identify anomalous nodes and groups.Representative mechanisms include link-prediction modeling, hypersphere distances in a shared latent space, and feature-based analysis of users, tweets, hashtags, and links.
  • ING TECHNIQUES: Traditional dynamic-edge methods primarily use temporal signals, graph-structure evolution, and statistical metrics to detect anomalous edges.These methods model dynamic graphs as edge streams and identify unusual structural connections between graph regions.
  • F.1 ANOS SGD on Static Graphs: Traditional static sub-graph methods model anomalous attribute distributions or residuals between expected and observed structures.Representative approaches include gAnomaly, AMEN, and SLICENDICE, which measure sub-graph normality using attribute distributions or graph residual analysis.
  • F.2 ANOS SGD on Dynamic Graphs: Traditional dynamic sub-graph methods use handcrafted community patterns, manually extracted dense-subgraph features, and graph scan statistics, but their specialization limits detection of unseen and camouflage anomalies.Examples include grown, shrunken, merged, split, born, and vanished communities, alongside Kulldorff, Poisson, elevated mean scan, and Berk-Jones statistics.
Loading 2106.07178v5…