Learning-Based Link Anomaly Detection in Continuous-Time Dynamic Graphs

TL;DR

This paper introduces a structured approach to detect link anomalies in continuous-time dynamic graphs using novel data generation, a taxonomy, and adapted learning methods, validated through extensive benchmarks.

Contribution

It presents a new taxonomy for link anomalies, a method for generating synthetic anomalous graphs, and adaptations of learning algorithms for anomaly detection in continuous-time graphs.

Findings

Different methods excel at detecting different anomaly types.

The proposed generation process produces realistic synthetic anomalies.

Benchmark results validate the effectiveness of the taxonomy and detection approach.

Abstract

Anomaly detection in continuous-time dynamic graphs is an emerging field yet under-explored in the context of learning algorithms. In this paper, we pioneer structured analyses of link-level anomalies and graph representation learning for identifying categorically anomalous graph links. First, we introduce a fine-grained taxonomy for edge-level anomalies leveraging structural, temporal, and contextual graph properties. Based on these properties, we introduce a method for generating and injecting typed anomalies into graphs. Next, we introduce a novel method to generate continuous-time dynamic graphs featuring consistencies across either or combinations of time, structure, and context. To enable temporal graph learning methods to detect specific types of anomalous links rather than the bare existence of a link, we extend the generic link prediction setting by: (1) conditioning link existence on contextual edge attributes; and (2) refining the training regime to accommodate diverse perturbations in the negative edge sampler. Comprehensive benchmarks on synthetic and real-world datasets -- featuring synthetic and labeled organic anomalies and employing six state-of-the-art link prediction methods -- validate our taxonomy and generation processes for anomalies and benign graphs, as well as our approach to adapting methods for anomaly detection. Our results reveal that different learning methods excel in capturing different aspects of graph normality and detecting different types of anomalies. We conclude with a comprehensive list of findings highlighting opportunities for future research.