Multi-Scale Anomaly Detection on Attributed Networks

Abstract

Many social and economic systems can be represented as attributed networks encoding the relations between entities who are themselves described by different node attributes. Finding anomalies in these systems is crucial for detecting abuses such as credit card frauds, web spams or network intrusions. Intuitively, anomalous nodes are defined as nodes whose attributes differ starkly from the attributes of a certain set of nodes of reference, called the context of the anomaly. While some methods have proposed to spot anomalies locally, globally or within a community context, the problem remain challenging due to the multi-scale composition of real networks and the heterogeneity of node metadata. Here, we propose a principled way to uncover outlier nodes simultaneously with the context with respect to which they are anomalous, at all relevant scales of the network. We characterize anomalous nodes in terms of the concentration retained for each node after smoothing specific signals localized on the vertices of the graph. Besides, we introduce a graph signal processing formulation of the Markov stability framework used in community detection, in order to find the context of anomalies. The performance of our method is assessed on synthetic and real-world attributed networks and shows superior results concerning state of the art algorithms. Finally, we show the scalability of our approach in large networks employing Chebychev polynomial approximations.

ResGCN: attention-based deep residual modeling for anomaly detection on attributed networks

“…ROC-AUC for networks with ground-truth labels are shown in Table 4. We observe from these results the following: (Breunig et al 2000) 0.300 0.220 0.180 0.183 Radar (Li et al 2017) 0.660 0.670 0.550 0.416 ANOMALOUS (Peng et al 2018) 0.640 0.650 0.515 0.417 DOMINANT (Ding et al 2019a) 0 (Breunig et al 2000) 0.060 0.060 0.045 0.037 Radar (Li et al 2017) 0.560 0.580 0.520 0.430 ANOMALOUS (Peng et al 2018) 0.600 0.570 0.510 0.410 DOMINANT (Ding et al 2019a) 0.620 0.590 0.540 0.497 MADAN (Gutiérrez-Gómez et al 2019) The experimental results w.r.t. Precision@K and Recall@K for networks without groundtruth labels are shown in Tables 5, 6, 7, 8, 9 and 10.…”

“…In order to evaluate the effectiveness of our proposed method, we conduct experiments on two types of real-world attributed networks: data with and without ground-truth anomaly labels. All networks have been widely used in previous studies (Li et al, 2017;Peng et al, 2018;Ding et al, 2019a;Gutiérrez-Gómez et al, 2019):…”

“…-ROC-AUC : we use the area under the receiver operating characteristic curve (ROC-AUC) as the evaluation metric for anomaly detection as it has been widely used in previous studies (Li et al, 2017;Peng et al, 2018;Ding et al, 2019a;Gutiérrez-Gómez et al, 2019). ROC-AUC can quantify the trade-off between true positive rate (TP) and false positive rate (FP) across different thresholds.…”

“…Besides, we use a two-layer autoencoder as a simple baseline. It disregards the structural information (Breunig et al 2000) 0.490 ± 0.006 0.440 ± 0.013 AMEN (Perozzi and Akoglu 2016) 0.470 ± 0.005 0.470 ± 0.008 Radar (Li et al 2017) 0.580 ± 0.007 0.650 ± 0.009 ANOMALOUS (Peng et al 2018) 0.602 ± 0.004 0.695 ± 0.007 DOMINANT (Ding et al 2019a) 0.625 ± 0.005 0.685 ± 0.015 MADAN (Gutiérrez-Gómez et al 2019) 0.680 ± 0.016 0.680 ± 0.009 ResGCN (Our Model) 0.710 ± 0.010 0.660 ± 0.007 and only reconstructs the attributes. Then the reconstruction errors are used as the ranking score to detect anomalies.…”

“…DOMINANT (Ding et al, 2019a) utilizes GCN to compress the input attributed network to succinct low-dimensional embedding representations and then reconstruct both the topological structure and nodal attributes with these representations. MADAN (Gutiérrez-Gómez et al, 2019) is a multi-scale anomaly detection method. It uses the heat kernel as filtering operator to exploit the link with the Markov stability to find the context for outlier nodes at all relevant scales of the network.…”