Anomalydae: Dual Autoencoder for Anomaly Detection on Attributed Networks

Abstract

Anomaly detection on attributed networks aims at finding nodes whose patterns deviate significantly from the majority of reference nodes, which is pervasive in many applications such as network intrusion detection and social spammer detection. However, most existing methods neglect the complex cross-modality interactions between network structure and node attribute. In this paper, we propose a deep joint representation learning framework for anomaly detection through a dual autoencoder (AnomalyDAE), which captures the complex interactions between network structure and node attribute for high-quality embeddings. Specifically, Anoma-lyDAE consists of a structure autoencoder and an attribute autoencoder to learn both node embedding and attribute embedding jointly in latent space. Moreover, attention mechanism is employed in structure encoder to learn the importance between a node and its neighbors for an effective capturing of structure pattern, which is important to anomaly detection. Besides, by taking both the node embedding and attribute embedding as inputs of attribute decoder, the cross-modality interactions between network structure and node attribute are learned during the reconstruction of node attribute. Finally, anomalies can be detected by measuring the reconstruction errors of nodes from both the structure and attribute perspectives. Extensive experiments on real-world datasets demonstrate the effectiveness of the proposed method.

Deep Dual Support Vector Data description for anomaly detection on attributed networks

“…Recently, anomaly detection on attributed networks has attracted lots of research interests, 18 whose goal is to detect the anomalies by obtaining information from nodes attribute and network structure. Some of them conduct anomaly detection using only structure information in the community level by comparing the current node with other reference nodes within the same community 10 or measuring the quality of connected subgraphs.…”

“…11 Some of them study the problem of feature-level anomalies detection through subspace selection of node feature. 12,13 While some residual analysis-based methods 14,15 and graph autoencoder-based methods [16][17][18] consider both the context and feature information to discover anomalies by assuming that anomalies cannot be approximated from other reference nodes, they use residual estimation or network reconstruction to measure the abnormality of each node. However, most of those methods aim at minimizing the reconstruction errors for the whole network, whose loss functions are not designed directly for the abnormal node detection, moreover, those reconstruction-based losses will also be impacted by the noisy node and have a potential problem of overfitting for both normal nodes and abnormal nodes.…”

“…11 Some of them study the problem of featurelevel anomalies detection through subspace selection of node feature. 12,13 While some residual analysis-based methods 14,15 and graph autoencoder-based methods [16][17][18] consider both the context and feature information to discover anomalies by assuming that anomalies cannot be approximated from other reference nodes, they use residual estimation or network reconstruction to measure the abnormality of each node. Although those exiting method had their fair share of success, there are still some shortcomings among them.…”

Deep Dual Support Vector Data Description for Anomaly Detection on Attributed Networks

“…Recently, anomaly detection on attributed networks has attracted lots of research interests [18], whose goal is to detect the anomalies by obtaining information from nodes attribute and network structure. Some of them conduct anomaly detection using only structure information in the community-level by comparing the current node with other reference nodes within the same community [10] or measuring the quality of connected subgraphs [11].…”

“…Some of them study the problem of feature-level anomalies detection through subspace selection of node feature [12,13]. While some residual analysis based methods [14,15] and graph autoencoder based methods [16,17,18] consider both the context and feature information to discover anomalies by assuming that anomalies cannot be approximated from other reference nodes, they use residual estimation or network reconstruction to measure the abnormality of each node.…”