AHEAD: A Triple Attention Based Heterogeneous Graph Anomaly Detection Approach

TL;DR

AHEAD introduces a novel triple attention mechanism for unsupervised anomaly detection in heterogeneous attributed networks, effectively capturing diverse heterogeneity aspects to improve detection accuracy.

Contribution

It proposes a heterogeneity-aware encoder-decoder framework with three levels of attention, addressing a gap in existing methods that ignore network heterogeneity.

Findings

Outperforms state-of-the-art methods on real-world datasets

Demonstrates robustness and effectiveness of triple attention mechanism

Validates the importance of heterogeneity modeling in anomaly detection

Abstract

Graph anomaly detection on attributed networks has become a prevalent research topic due to its broad applications in many influential domains. In real-world scenarios, nodes and edges in attributed networks usually display distinct heterogeneity, i.e. attributes of different types of nodes show great variety, different types of relations represent diverse meanings. Anomalies usually perform differently from the majority in various perspectives of heterogeneity in these networks. However, existing graph anomaly detection approaches do not leverage heterogeneity in attributed networks, which is highly related to anomaly detection. In light of this problem, we propose AHEAD: a heterogeneity-aware unsupervised graph anomaly detection approach based on the encoder-decoder framework. Specifically, for the encoder, we design three levels of attention, i.e. attribute level, node type level, and edge level attentions to capture the heterogeneity of network structure, node properties and information of a single node, respectively. In the decoder, we exploit structure, attribute, and node type reconstruction terms to obtain an anomaly score for each node. Extensive experiments show the superiority of AHEAD on several real-world heterogeneous information networks compared with the state-of-arts in the unsupervised setting. Further experiments verify the effectiveness and robustness of our triple attention, model backbone, and decoder in general.