Multitask Active Learning for Graph Anomaly Detection

TL;DR

This work tackles graph anomaly detection under limited supervision by introducing MITIGATE, a multitask active learning framework that leverages node classification as auxiliary supervision to detect anomalies and actively query informative nodes. A shared GCN encoder drives two decoders—one for classification and one for anomaly scoring—and a hybrid score combines their signals. The node-selection strategy blends distance-based clustering with cross-task confidence differences, using a masked aggregation to ensure representativeness and diversity. Empirical results on four datasets show MITIGATE outperforms state-of-the-art baselines, especially under small labeling budgets, and ablations confirm the importance of uncertainty loss, the confidence-difference informativeness, and masked-distance features. This approach provides a scalable, label-efficient pathway for robust graph anomaly detection in security-sensitive web contexts, with publicly available code for reproducibility.

Abstract

In the web era, graph machine learning has been widely used on ubiquitous graph-structured data. As a pivotal component for bolstering web security and enhancing the robustness of graph-based applications, the significance of graph anomaly detection is continually increasing. While Graph Neural Networks (GNNs) have demonstrated efficacy in supervised and semi-supervised graph anomaly detection, their performance is contingent upon the availability of sufficient ground truth labels. The labor-intensive nature of identifying anomalies from complex graph structures poses a significant challenge in real-world applications. Despite that, the indirect supervision signals from other tasks (e.g., node classification) are relatively abundant. In this paper, we propose a novel MultItask acTIve Graph Anomaly deTEction framework, namely MITIGATE. Firstly, by coupling node classification tasks, MITIGATE obtains the capability to detect out-of-distribution nodes without known anomalies. Secondly, MITIGATE quantifies the informativeness of nodes by the confidence difference across tasks, allowing samples with conflicting predictions to provide informative yet not excessively challenging information for subsequent training. Finally, to enhance the likelihood of selecting representative nodes that are distant from known patterns, MITIGATE adopts a masked aggregation mechanism for distance measurement, considering both inherent features of nodes and current labeled status. Empirical studies on four datasets demonstrate that MITIGATE significantly outperforms the state-of-the-art methods for anomaly detection. Our code is publicly available at: https://github.com/AhaChang/MITIGATE.

Figures (4)

• Figure 1: An illustration of the proposed MITIGATE. For a graph $\mathcal{G}$ with partial classification labels, MITIGATE employs a GNN encoder to generate node representations $\mathbf{H}$, and then employs a node classifier and an anomaly score predictor. In each selection iteration, MITIGATE assesses the representativeness and informativeness of nodes using a distance-based clustering and confidence difference across tasks for anomaly detection, respectively. Then, it picks $b$ nodes from clustering centers with high informative scores and queries an oracle to identify whether they are anomalies or not. Finally, the queried set will be incorporated into the labeled set, and continue training of the model. (a) A 2-dimensional confidence difference space. (b) An example of candidates' confidence difference. We select the candidates with high confidence difference (i.e., in the upper left corner and lower right corner).
• Figure 2: Performance over different numbers of labeled nodes in selection averaged from 5 runs on four datasets.
• Figure 3: Weight analysis for the node classifier and anomaly score predictor with various values of $\alpha$ and $\beta$ on Citeseer.
• Figure 4: Sensitivity analysis on Citeseer for (a) overall anomaly scores weight term $\phi$, and (b) number of cluster $m$.