Learning-Based Link Anomaly Detection in Continuous-Time Dynamic Graphs

TL;DR

This paper pioneer structured analyses of link-level anomalies and graph representation learning for identifying categorically anomalous graph links and introduces a fine-grained taxonomy for edge-level anomalies leveraging structural, temporal, and contextual graph properties.

Abstract

Anomaly detection in continuous-time dynamic graphs is an emerging field yet under-explored in the context of learning algorithms. In this paper, we pioneer structured analyses of link-level anomalies and graph representation learning for identifying categorically anomalous graph links. First, we introduce a fine-grained taxonomy for edge-level anomalies leveraging structural, temporal, and contextual graph properties. Based on these properties, we introduce a method for generating and injecting typed anomalies into graphs. Next, we introduce a novel method to generate continuous-time dynamic graphs featuring consistencies across either or combinations of time, structure, and context. To enable temporal graph learning methods to detect specific types of anomalous links rather than the bare existence of a link, we extend the generic link prediction setting by: (1) conditioning link existence on contextual edge attributes; and (2) refining the training regime to accommodate diverse perturbations in the negative edge sampler. Comprehensive benchmarks on synthetic and real-world datasets -- featuring synthetic and labeled organic anomalies and employing six state-of-the-art link prediction methods -- validate our taxonomy and generation processes for anomalies and benign graphs, as well as our approach to adapting methods for anomaly detection. Our results reveal that different learning methods excel in capturing different aspects of graph normality and detecting different types of anomalies. We conclude with a comprehensive list of findings highlighting opportunities for future research.

Figures (5)

• Figure 1: A CTDG with the proposed synthetic anomaly types, visualized in snapshots for clarity. Timestamps $t_0$ to $t_{n-5}$ represent the normal graph behavior, characterized by the properties discussed in §\ref{['sec:synthetic-anomaly-types']}: (1) two node communities define the structure, i.e., , , (2) there are two types of message contexts, tied to these communities, (3) the timing of edges follows the Temporal Activity at the bottom, i.e., , indicate the node is active at this time. From timestamp $t_{n-4}$ to $t_n$ we highlight and categorize edge anomalous behavior. (t): Edge appears at an unexpected time. (c): Edge message differs from the expected message between the two nodes. (t-c): Edge appears at an unexpected time and its message differs from the expected message between the two nodes. (s-c): Edge connects two nodes that are expected to be active at this time but do not usually connect with each other, its message is out-of-distribution (). (t-s-c): Edge connects two nodes that do not usually connect with each other, the nodes are not expected to be active at this time and its message is out-of-distribution. Icons , mark temporal anomalies.
• Figure 2: Distributions of node degrees in synthetic and real-world graphs.
• Figure 3: Joint degree matrices of synthetic and real-world graphs.
• Figure 4: Distributions of the standard deviations of edge messages across timestamps for edges in synthetic and real-world graphs.
• Figure 5: Distributions of the standard deviations of inter-event times for edges in synthetic and real-world graphs.

Theorems & Definitions (5)

• Definition 1
• Definition 2
• Definition 3
• Definition 4
• Definition 5