Detecting Anomalies in Dynamic Graphs via Memory enhanced Normality

TL;DR

This paper tackles anomaly detection in dynamic graphs by introducing STRIPE, a memory-enhanced graph autoencoder that explicitly models distinct spatial and temporal normal patterns. It employs a spatial-temporal encoder (GNN + gated temporal convolution), two memory banks (spatial and temporal) with mutual attention for read/write, and a decoder that reconstructs graph streams to serve as a proxy task for anomaly detection. By optimizing reconstruction together with compactness and separateness losses and using memory-guided reconstruction, STRIPE achieves state-of-the-art AUC improvements (average 5.8%) and substantially faster training (up to 4.62x) on six benchmark datasets. The approach demonstrates scalable, non-contrastive learning without negative sampling, enabling efficient anomaly detection in large, evolving graphs with practical impact for real-world network monitoring.

Abstract

Anomaly detection in dynamic graphs presents a significant challenge due to the temporal evolution of graph structures and attributes. The conventional approaches that tackle this problem typically employ an unsupervised learning framework, capturing normality patterns with exclusive normal data during training and identifying deviations as anomalies during testing. However, these methods face critical drawbacks: they either only depend on proxy tasks for representation without directly pinpointing normal patterns, or they neglect to differentiate between spatial and temporal normality patterns. More recent methods that use contrastive learning with negative sampling also face high computational costs, limiting their scalability to large graphs. To address these challenges, we introduce a novel Spatial-Temporal memories-enhanced graph autoencoder (STRIPE). Initially, STRIPE employs Graph Neural Networks (GNNs) and gated temporal convolution layers to extract spatial and temporal features. Then STRIPE incorporates separate spatial and temporal memory networks to capture and store prototypes of normal patterns, respectively. These stored patterns are retrieved and integrated with encoded graph embeddings through a mutual attention mechanism. Finally, the integrated features are fed into the decoder to reconstruct the graph streams which serve as the proxy task for anomaly detection. This comprehensive approach not only minimizes reconstruction errors but also emphasizes the compactness and distinctiveness of the embeddings w.r.t. the nearest memory prototypes. Extensive experiments on six benchmark datasets demonstrate the effectiveness and efficiency of STRIPE, where STRIPE significantly outperforms existing methods with 5.8% improvement in AUC scores and 4.62X faster in training time.

Figures (10)

• Figure 1: Statistical observations of dynamic graphs on DGraph dataset. Left: Average degrees of fraudsters and benign users on snapshot #0. Right: Degree curves of fraudsters and benign users as time evolves. Anomalous samples typically exhibit a higher frequency of vibrations, indicating that fraudsters frequently change their connections to other nodes.
• Figure 2: Overall framework of the proposed STRIPE.
• Figure 3: The illustration of (a) memory read and (b) memory update procedures in the spatial memory module.
• Figure 4: Anomaly detection under different anomaly rates on DBLP-3 (left) and Reddit (right) datasets.
• Figure 5: Evaluation of time efficiency. Left: The linear increase of both training and inference time of STRIPE w.r.t. node numbers in DGraph dataset. Right: Comparison of training and inference time of STRIPE with three most competitive baselines on DGraph dataset.