GFM4GA: Graph Foundation Model for Group Anomaly Detection

TL;DR

GFM4GA introduces a novel graph foundation model specifically designed for group anomaly detection, leveraging dual-level contrastive learning to effectively identify abnormal groups in network data with minimal labeling.

Contribution

The paper proposes GFM4GA, a new graph foundation model that generalizes GFMs for group anomaly detection using dual-level contrastive pretraining and adaptive fine-tuning.

Findings

GFM4GA outperforms existing group anomaly detectors.

Achieves 2.85% higher AUROC on average.

Achieves 2.55% higher AUPRC on average.

Abstract

Group anomaly detection is crucial in many network applications, but faces challenges due to diverse anomaly patterns. Motivated by the success of large language models (LLMs) in natural language processing, graph foundation models (GFMs) is proposed to handle few-shot learning task with fewer labeling efforts. GFMs have been successfully applied to detection of individual anomalies but cannot be generalized to group anomalies, as group anomaly patterns must be detected as a whole and individuals in an abnormal group can look rather normal. Therefore, we propose GFM4GA, a novel graph foundation model for group anomaly detection. The pipeline is pretrained via dual-level contrastive learning based on feature-based estimation and group extraction, to capture potential group anomaly structure and feature inconsistencies. In the downstream tasks, the pipeline is finetuned in parameter-constrained and group-anomaly-proportion weighted few-shot settings, and its adaptive ability to unseen group anomalies expanded via group contexts determined by labeled anomaly neighbors. Experiments show that GFM4GA surpasses group anomaly detectors and GFMs for individual anomalies, achieving average improvements of 2.85% in AUROC and 2.55% in AUPRC.