A Graph Encoder-Decoder Network for Unsupervised Anomaly Detection

TL;DR

This paper introduces an unsupervised graph encoder-decoder model with a novel, parameter-free pooling method called LCPool, designed for efficient and interpretable anomaly detection in large graphs, outperforming existing methods.

Contribution

The paper proposes LCPool, a locality-constrained linear coding pooling mechanism that is parameter-free and effective for large-scale graph anomaly detection, along with an unpooling operation for graph reconstruction.

Findings

LCPool effectively captures structural features without learnable parameters.

The method outperforms state-of-the-art anomaly detection approaches on benchmark datasets.

The approach handles large graphs efficiently with high accuracy.

Abstract

A key component of many graph neural networks (GNNs) is the pooling operation, which seeks to reduce the size of a graph while preserving important structural information. However, most existing graph pooling strategies rely on an assignment matrix obtained by employing a GNN layer, which is characterized by trainable parameters, often leading to significant computational complexity and a lack of interpretability in the pooling process. In this paper, we propose an unsupervised graph encoder-decoder model to detect abnormal nodes from graphs by learning an anomaly scoring function to rank nodes based on their degree of abnormality. In the encoding stage, we design a novel pooling mechanism, named LCPool, which leverages locality-constrained linear coding for feature encoding to find a cluster assignment matrix by solving a least-squares optimization problem with a locality regularization term. By enforcing locality constraints during the coding process, LCPool is designed to be free from learnable parameters, capable of efficiently handling large graphs, and can effectively generate a coarser graph representation while retaining the most significant structural characteristics of the graph. In the decoding stage, we propose an unpooling operation, called LCUnpool, to reconstruct both the structure and nodal features of the original graph. We conduct empirical evaluations of our method on six benchmark datasets using several evaluation metrics, and the results demonstrate its superiority over state-of-the-art anomaly detection approaches.