Learning Discriminative and Generalizable Anomaly Detector for Dynamic Graph with Limited Supervision

TL;DR

This paper introduces a novel framework for dynamic graph anomaly detection that effectively leverages limited labeled anomalies and normal data to learn a discriminative and generalizable boundary, outperforming existing methods.

Contribution

It proposes a model-agnostic framework with residual encoding, restriction loss, and bi-boundary optimization to improve anomaly detection with limited supervision.

Findings

Outperforms existing DGAD methods across various datasets.

Effectively leverages limited labeled anomalies for better generalization.

Provides a robust boundary for anomaly detection using normalizing flow.

Abstract

Dynamic graph anomaly detection (DGAD) is critical for many real-world applications but remains challenging due to the scarcity of labeled anomalies. Existing methods are either unsupervised or semi-supervised: unsupervised methods avoid the need for labeled anomalies but often produce ambiguous boundary, whereas semi-supervised methods can overfit to the limited labeled anomalies and generalize poorly to unseen anomalies. To address this gap, we consider a largely underexplored problem in DGAD: learning a discriminative boundary from normal/unlabeled data, while leveraging limited labeled anomalies \textbf{when available} without sacrificing generalization to unseen anomalies. To this end, we propose an effective, generalizable, and model-agnostic framework with three main components: (i) residual representation encoding that capture deviations between current interactions and their historical context, providing anomaly-relevant signals; (ii) a restriction loss that constrain the normal representations within an interval bounded by two co-centered hyperspheres, ensuring consistent scales while keeping anomalies separable; (iii) a bi-boundary optimization strategy that learns a discriminative and robust boundary using the normal log-likelihood distribution modeled by a normalizing flow. Extensive experiments demonstrate the superiority of our framework across diverse evaluation settings.