DP-DGAD: A Generalist Dynamic Graph Anomaly Detector with Dynamic Prototypes

TL;DR

This paper introduces DP-DGAD, a dynamic graph anomaly detection model that captures evolving patterns across domains using dynamic prototypes, achieving state-of-the-art results on diverse datasets.

Contribution

The paper proposes a novel DGAD model with dynamic prototypes that adaptively learn evolving domain-specific and domain-agnostic patterns in dynamic graphs.

Findings

Achieves state-of-the-art performance on ten real-world datasets.

Effectively captures evolving anomalies in dynamic graphs across domains.

Utilizes confidence-based pseudo-labeling for self-supervised adaptation.

Abstract

Dynamic graph anomaly detection (DGAD) is essential for identifying anomalies in evolving graphs across domains such as finance, traffic, and social networks. Recently, generalist graph anomaly detection (GAD) models have shown promising results. They are pretrained on multiple source datasets and generalize across domains. While effective on static graphs, they struggle to capture evolving anomalies in dynamic graphs. Moreover, the continuous emergence of new domains and the lack of labeled data further challenge generalist DGAD. Effective cross-domain DGAD requires both domain-specific and domain-agnostic anomalous patterns. Importantly, these patterns evolve temporally within and across domains. Building on these insights, we propose a DGAD model with Dynamic Prototypes (DP) to capture evolving domain-specific and domain-agnostic patterns. Firstly, DP-DGAD extracts dynamic prototypes, i.e., evolving representations of normal and anomalous patterns, from temporal ego-graphs and stores them in a memory buffer. The buffer is selectively updated to retain general, domain-agnostic patterns while incorporating new domain-specific ones. Then, an anomaly scorer compares incoming data with dynamic prototypes to flag both general and domain-specific anomalies. Finally, DP-DGAD employs confidence-based pseudo-labeling for effective self-supervised adaptation in target domains. Extensive experiments demonstrate state-of-the-art performance across ten real-world datasets from different domains.