PaperlayerView exact revision on arXiv

Source-linked AI summary

Statistical Feature Augmentation for Anomaly Detection in Dynamic Graphs

Philipp Schlinge, Jean-Luc Schnipper, Martin Atzmueller

arXiv:2609.02965v1cs.SIcs.LGstat.ML

TL;DR

Deep learning models can struggle to learn short-term interaction signals such as sender intensity and interaction inertia. The paper adds temporally decayed behavioral statistics to model inputs and evaluates the augmentation for anomaly detection. Performance improves in most settings, with gains varying by dataset and architecture, and the added dimensions support more direct interpretation of behavioral statistics.

  • Problem

    Deep learning models struggle to reliably learn short-term behavioral characteristics such as sender intensity and interaction inertia from dynamic graphs.

    Source: §1 · p. 2

  • Method

    The approach augments dynamic-graph input features with temporally decayed behavioral statistics, optionally encoding the concatenated features through a bottleneck autoencoder.

    Source: §1 · p. 2, §3 · pp. 5–6

  • Results

    Performance improves for most models, with gains varying across datasets and architectures; on Reddit, GraphSAGE reaches 84.15% ROC-AUC versus 62.98% with +Stats + Encoded, a +21.18% gain.

    Source: §5 · p. 8, §6 · p. 10

  • Takeaways & Limitations

    The augmented input makes behavioral statistics more directly interpretable, and SHAP analysis finds they often account for a substantial share of decision importance despite their small dimensionality.

    Source: §6 · p. 10, §7 · p. 11

    The approach rests on the hypothesis that short-term interaction characteristics carry high discriminative information, especially for anomaly detection.

    Source: §3 · p. 5

Abstract

from arXiv · show

Dynamic networks are being applied in many domains, from social media to logistics systems, each with their own set of special characteristics. A model employed on this type of data must capture the duality between temporal/structural and feature-based information. Yet state-of-the-art deep learning models often struggle to learn especially short-term behavioral interaction signals, such as sender intensity or interaction inertia, directly from raw event streams. To address this gap, we propose a statistical feature augmentation method that explicitly encodes behavioral interaction statistics into the input feature space. We evaluate our proposed method on an anomaly detection task across three real-world datasets (Reddit, Wikipedia, MOOC) and seven models spanning both continuous-time and discrete-time architectures. As a baseline, we apply the same models trained on the original embeddings. Our results show, that augmentation consistently improves detection performance. Beyond performance, the enriched input enables fine-grained post-hoc analysis of behavioral importance, since each statistic occupies a dedicated input dimension. In particular, this work showcases a promising approach for merging classical network analysis with deep learning.

1 Introduction

Discrete- and continuous-time models represent dynamic graphs differently, yet both can struggle to learn short-term interaction behavior. The paper augments model inputs with behavioral statistics to improve anomaly detection and support post-hoc analysis.

1 Introduction

  • Discrete-time models aggregate events into snapshots, while continuous-time models process event streams, motivating different architectural choices.Examples include graph convolution, memory modules, and temporal neighborhood sampling.Source: §1 · pp. 1–2
  • Both model families struggle to reliably learn short-term characteristics such as sender intensity and interaction inertia.Prior approaches either embed motif-learning strategies in complex architectures or retain restrictions imposed by statistical model structures.Source: §1 · p. 2
  • The proposed method adds temporally decayed behavioral statistics to input features, making short-term information available to different deep learning architectures.The approach targets anomaly detection and gives each statistic a dedicated input dimension for post-hoc analysis.Source: §1 · p. 2
  • In a MOOC forum example, a sudden burst of messages can reflect changes in interaction intensity and edge inertia that discrete-time aggregation may lose.Explicit features can also let SHAP attribute an anomaly score to a statistic such as intensity, rather than only to raw embeddings.Source: §1 · p. 2
  • The paper reports that augmentation often improves anomaly-detection performance by a considerable margin and substantially improves explainability in the studied models.These are stated contributions of the work.Source: §1 · pp. 2–3

2 Related Work

The related work covers dynamic interaction networks, statistical network models and motifs, dynamic-graph anomaly detection, and post-hoc explanations. It positions this paper's input-feature augmentation as a model-agnostic complement to those approaches.

2 Related Work

  • The related-work overview identifies dynamic interaction networks, statistical network models and motifs, anomaly detection, and post-hoc explanations as its main topics.The paper describes its augmentation as a sophisticated preprocessing approach complementary to existing literature.Source: §2 · p. 3, §2.4 · p. 4

2.1 Dynamic Interaction Networks

  • Dynamic interaction networks retain the timing, duration, and sequence of connections, unlike static networks that aggregate interactions into one topology.This time-resolved structure can preserve transient motifs and communities that static aggregation may mask.Source: §2.1 · p. 3

2.2 Statistical Network Models and Motifs

  • Classical relational event models and motif-learning methods capture interaction patterns, while the paper proposes adding characteristic behavioral features to input features.The stated aim is to address the gap between deep learning and explicit statistical modeling.Source: §2.2 · pp. 3–4

2.3 Anomaly Detection on Dynamic Graphs

  • The paper positions its approach as model-agnostic augmentation of input features, applicable to continuous- and discrete-time dynamic-graph anomaly detectors.Continuous-time examples use neighborhood sampling and attention, while discrete-time examples ingest snapshots and may use graph convolution.Source: §2.3 · p. 4

2.4 Post-hoc Explanations

  • Post-hoc feature attribution methods such as SHAP operate on input dimensions, enabling importance analysis over a defined set of statistics.The paper contrasts this with motif-level explanation approaches that can be restrictive across datasets and model formats.Source: §2.4 · p. 4

3 Statistical Feature Augmentation

The method adds temporally decayed behavioral statistics to event features so downstream models can use short-term interaction information directly. It compares simple concatenation with an encoded representation designed to separate normal and anomalous latent dimensions.

3 Statistical Feature Augmentation

  • The augmentation adds short-term interaction statistics to each event’s original features, making behavioral information directly available to downstream models.The statistics are computed from event history, and the method targets activity, recency, and repeated interaction patterns.Source: §3 · p. 5
  • The parameter T1/2 controls the decay’s half-life and the relevance of historical events: a smaller T1/2 gives more weight to recent events, while a larger T1/2 smoothes the statistic over a longer window.In the experiments, T1/2 was set to half the dataset duration, retaining substantial weight on a large part of the history.Source: §3 · p. 5
  • The statistics cover sender/receiver activity, recent activity on a specific edge, and receiver changes that complete directed cycles.The method computes nine statistics per event for directed and undirected interaction cases.Source: §3 · pp. 5–6, Table 1 · p. 6
  • +Stats concatenates normalized statistics with the original edge features, while +Stats +Encoded maps the concatenated vector through a bottleneck autoencoder.The encoded variant addresses asymmetries between the embedding feature space and individual statistic distributions.Source: §3 · p. 6
  • The encoder objective combines KS separation of normal and anomalous latent distributions with reconstruction and variance terms; exponential decay enables O(n) total statistic computation.The differentiable, temperature-smoothed CDF supports backpropagation; reconstruction retains input information and the variance penalty prevents collapse or trivial scaling.Source: §3 · p. 6

4 Experiments

The experiments compare three feature configurations across seven dynamic-graph anomaly detection models on Reddit, Wikipedia, and MOOC. Chronological train, validation, and test splits support model selection and final test evaluation.

4 Experiments

  • The evaluation tests binary edge classification using original edge features, concatenated statistics (+Stats), and the encoded representation (+Stats +Encoded).The task is to predict whether each current event is anomalous or normal from the historical event stream.Source: §4 · p. 7
  • The study evaluates seven continuous- and discrete-time models on Reddit, Wikipedia, and MOOC, using chronological 70/15/15 train, validation, and test splits.Models are selected by validation ROC-AUC and evaluated on the test split.Source: §4 · p. 7, Table 2 · p. 7
  • The experiment asks whether augmentation improves detection, which architectures benefit across datasets, and whether encoding further changes performance and statistical-feature contributions.Discrete-time models use snapshots of 2,000 edges; reported model results are means and standard deviations over four random seeds.Source: §4 · pp. 7–8

5 Results

Statistical augmentation generally improves anomaly-detection performance, but its gains vary across datasets and models. The statistical features also contribute substantially to model importance, while encoding them can alter feature importance and seed variability.

5 Results

  • Across datasets, augmentation improves at least one configuration for every model except MOOC DyGFormer (−0.42%); Reddit GraphSAGE +Stats + Encoded gains +21.18% ROC-AUC (62.98% to 84.15%).Table 3 reports ROC-AUC (%) as mean±std over four runs with different seeds.Source: §5 · p. 8, Table 3 · p. 9
  • No architecture benefits most consistently across datasets; augmentation gains vary by model and dataset and are not correlated with baseline performance.Both low- and high-performing models sometimes benefit to a similar degree.Source: §5 · pp. 8–9
  • The +Stats + Encoded configuration generally shifts SHAP importance toward statistics, especially on Wikipedia, where statistics exceed 80% for most models; Reddit and MOOC effects are more model-dependent.On Reddit and Wikipedia, the best-performing model-variant pairs rely on statistical information for 80–88%; on MOOC, the best models use it as a supportive addition.Source: §5 · p. 8
  • The nine statistical features often contribute substantially more than their dimensionality would suggest, providing predictive information beyond embeddings.The best-performing model-variant pairs rely heavily on statistics on Reddit and Wikipedia, but not on MOOC.Source: §5 · p. 8
  • Encoding often reduces seed variability, particularly on Wikipedia and Reddit, but the effect is not universal across datasets.Reddit DyGFormer’s standard deviation falls from 8.2% to 4.2%, while MOOC DyGFormer’s rises from 4.6% to 9.8%.Source: §5 · p. 9
  • The encoded configuration often outperforms concatenation and shifts SHAP importance toward statistics, though neither effect is consistent across all datasets and models.It can also improve stability, but that effect is likewise not consistent.Source: §5 · p. 9

6 Discussion

The results suggest that behavioral statistics complement existing dynamic-graph representations, with their usefulness varying across datasets and architectures. SHAP analysis also indicates that the statistics can contribute substantially to model decisions and make individual behavioral features more interpretable.

6 Discussion

  • Statistical augmentation provides information complementary to existing dynamic-graph representations, with performance gains varying across datasets and architectures.The usefulness of short-term behavioral statistics depends on interaction-data characteristics rather than a specific model family.Source: §6 · p. 10
  • SHAP analysis finds that the nine statistical features often account for a substantial share of decision importance despite their small dimensionality.The encoded configuration generally increases their contribution, particularly on Wikipedia; Reddit and MOOC show more model-dependent effects.Source: §6 · p. 10
  • The enriched input makes the contribution of specific behavioral statistics more directly interpretable, alongside performance gains in many settings.The statistics’ decision importance varies by dataset and model.Source: §6 · p. 10

7 Conclusion

The paper reports positive effects from enriching dynamic-network data with interaction statistics and argues that this can simplify learning network dynamics while supporting explainability. It identifies broader statistics, datasets, and combined feature-space projection as areas for further study.

7 Conclusion

  • The paper reports a positive impact from enriching dynamic-network data with interaction statistics.It argues that classical statistics can simplify learning network dynamics and provide a basis for explainability.Source: §7 · p. 11
  • Future work will expand the statistic set toward more complex interaction patterns and extend evaluation to more datasets.The authors also identify projection into a combined embedding-and-statistics feature space for further research.Source: §7 · p. 11
  • The authors call for causal analysis because large standard deviations in SHAP importance may indicate an association with the training process.They identify this as a question for future work.Source: §7 · p. 11
Loading 2609.02965v1…