Graph Contrastive Learning for Anomaly Detection

TL;DR

This paper introduces GraphCAD, a graph contrastive learning framework for anomaly detection that effectively distinguishes abnormal nodes from normal ones, even with limited labels, by leveraging global context and self-supervised strategies.

Contribution

The paper proposes a novel supervised and self-supervised graph contrastive learning method for anomaly detection, incorporating a graph neural network encoder that removes suspicious links and learns global context.

Findings

GraphCAD outperforms existing baselines on four datasets.

Self-supervised GraphCAD achieves comparable results to fully supervised version.

The approach effectively detects anomalies with scarce labels.

Abstract

Graph-based anomaly detection has been widely used for detecting malicious activities in real-world applications. Existing attempts to address this problem have thus far focused on structural feature engineering or learning in the binary classification regime. In this work, we propose to leverage graph contrastive coding and present the supervised GraphCAD model for contrasting abnormal nodes with normal ones in terms of their distances to the global context (e.g., the average of all nodes). To handle scenarios with scarce labels, we further enable GraphCAD as a self-supervised framework by designing a graph corrupting strategy for generating synthetic node labels. To achieve the contrastive objective, we design a graph neural network encoder that can infer and further remove suspicious links during message passing, as well as learn the global context of the input graph. We conduct extensive experiments on four public datasets, demonstrating that 1) GraphCAD significantly and consistently outperforms various advanced baselines and 2) its self-supervised version without fine-tuning can achieve comparable performance with its fully supervised version.