GADY: Unsupervised Anomaly Detection on Dynamic Graphs

TL;DR

GADY introduces an unsupervised method for detecting anomalies in dynamic graphs by modeling continuous graph evolution and generating negative samples with GANs, outperforming previous methods on real datasets.

Contribution

The paper presents a novel unsupervised approach combining continuous dynamic graph modeling and GAN-based negative sampling for anomaly detection.

Findings

GADY outperforms state-of-the-art methods on three real-world datasets.

The continuous graph model captures fine-grained temporal information effectively.

GAN-based negative sampling improves anomaly detection accuracy.

Abstract

Anomaly detection on dynamic graphs refers to detecting entities whose behaviors obviously deviate from the norms observed within graphs and their temporal information. This field has drawn increasing attention due to its application in finance, network security, social networks, and more. However, existing methods face two challenges: dynamic structure constructing challenge - difficulties in capturing graph structure with complex time information and negative sampling challenge - unable to construct excellent negative samples for unsupervised learning. To address these challenges, we propose Unsupervised Generative Anomaly Detection on Dynamic Graphs (GADY). To tackle the first challenge, we propose a continuous dynamic graph model to capture the fine-grained information, which breaks the limit of existing discrete methods. Specifically, we employ a message-passing framework combined with positional features to get edge embeddings, which are decoded to identify anomalies. For the second challenge, we pioneer the use of Generative Adversarial Networks to generate negative interactions. Moreover, we design a loss function to alter the training goal of the generator while ensuring the diversity and quality of generated samples. Extensive experiments demonstrate that our proposed GADY significantly outperforms the previous state-of-the-art method on three real-world datasets. Supplementary experiments further validate the effectiveness of our model design and the necessity of each module.