Interactive Anomaly Detection on Attributed Networks

Abstract

Performing anomaly detection on attributed networks concerns with finding nodes whose patterns or behaviors deviate significantly from the majority of reference nodes. Its success can be easily found in many real-world applications such as network intrusion detection, opinion spam detection and system fault diagnosis, to name a few. Despite their empirical success, a vast majority of existing efforts are overwhelmingly performed in an unsupervised scenario due to the expensive labeling costs of ground truth anomalies. In fact, in many scenarios, a small amount of prior human knowledge of the data is often effortless to obtain, and getting it involved in the learning process has shown to be effective in advancing many important learning tasks. Additionally, since new types of anomalies may constantly arise over time especially in an adversarial environment, the interests of human expert could also change accordingly regarding to the detected anomaly types. It brings further challenges to conventional anomaly detection algorithms as they are often applied in a batch setting and are incapable to interact with the environment. To tackle the above issues, in this paper, we investigate the problem of anomaly detection on attributed networks in an interactive setting by allowing the system to proactively communicate with the human expert in making a limited number of queries about ground truth anomalies. Our objective is to maximize the true anomalies presented to the human expert after a given budget is used up. Along with this line, we formulate the problem through the principled multi-armed bandit framework and develop a novel collaborative contextual bandit algorithm, named GraphUCB. In particular, our developed algorithm: (1) explicitly models the nodal attributes and node dependencies seamlessly in a joint framework; and (2) handles the exploration-exploitation dilemma when querying anomalies of different types. Extensive experiments on real-world datasets show the improvement of the proposed algorithm over the state-of-the-art algorithms.

ResGCN: attention-based deep residual modeling for anomaly detection on attributed networks

“…In the experiments, we set s = 15 and set t to 10, 15, and 20 for BlogCatalog, Flickr and ACM, respectively which are the same to (Ding et al, 2019a) in order to make the comparison with DOMINANT (Ding et al, 2019a). To facilitate the ing process, in our experiments, we follow (Ding et al, 2019b) to reduce the dimensionality of attributes using Principal Component Analysis (PCA) and the dimension is set to 20.…”

Multi-Scale Anomaly Detection on Attributed Networks

“…AMEN (Perozzi and Akoglu 2018) considers egonetworks to characterize anomalous neighbors in attributed networks. More recent deep learning approaches (Ding, Li, and Liu 2019) introduce an interactive approach incorporating the feedback form the end user. Unlike the previous methods, our MADAN approach allows to spot anomalous nodes across all scales of the network uncovering the relevant scales spanned by the nodes attributes and the graph structure.…”

REA: Robust Cross-lingual Entity Alignment Between Knowledge Graphs

“…We first review some anomaly detection works on graphs. Graph-based anomaly detection [3] mainly focuses on plain graphs [1,2], attributed graphs [9,20] and dynamic graphs [46,47]. However, the relevant methods only aim to detect the anomalies without iterative learning by using the detected anomalies to obtain more accurate representation.…”