OWLEYE: Zero-Shot Learner for Cross-Domain Graph Data Anomaly Detection

TL;DR

OWLEYE is a zero-shot graph anomaly detection framework that learns transferable normal behavior patterns across domains, enabling effective anomaly detection without retraining or labeled data, and demonstrating superior generalization on real datasets.

Contribution

It introduces a novel cross-domain feature alignment, multi-pattern dictionary learning, and attention-based reconstruction modules for zero-shot anomaly detection in graphs.

Findings

Outperforms state-of-the-art baselines in real-world datasets.

Demonstrates strong generalization across multiple domains.

Enables label-efficient anomaly detection without retraining.

Abstract

Graph data is informative to represent complex relationships such as transactions between accounts, communications between devices, and dependencies among machines or processes. Correspondingly, graph anomaly detection (GAD) plays a critical role in identifying anomalies across various domains, including finance, cybersecurity, manufacturing, etc. Facing the large-volume and multi-domain graph data, nascent efforts attempt to develop foundational generalist models capable of detecting anomalies in unseen graphs without retraining. To the best of our knowledge, the different feature semantics and dimensions of cross-domain graph data heavily hinder the development of the graph foundation model, leaving further in-depth continual learning and inference capabilities a quite open problem. Hence, we propose OWLEYE, a novel zero-shot GAD framework that learns transferable patterns of normal behavior from multiple graphs, with a threefold contribution. First, OWLEYE proposes a cross-domain feature alignment module to harmonize feature distributions, which preserves domain-specific semantics during alignment. Second, with aligned features, to enable continuous learning capabilities, OWLEYE designs the multi-domain multi-pattern dictionary learning to encode shared structural and attribute-based patterns. Third, for achieving the in-context learning ability, OWLEYE develops a truncated attention-based reconstruction module to robustly detect anomalies without requiring labeled data for unseen graph-structured data. Extensive experiments on real-world datasets demonstrate that OWLEYE achieves superior performance and generalizability compared to state-of-the-art baselines, establishing a strong foundation for scalable and label-efficient anomaly detection.