Semi-supervised Anomaly Detection with Extremely Limited Labels in Dynamic Graphs

TL;DR

This work tackles anomaly detection in dynamic graphs under the constraint of extremely limited labeled data. It introduces EL$^{2}$-DGAD, a framework that combines a transformer-based dynamic graph encoder with two context-aware losses: an ego-context hypersphere loss that uses the latent $x^t=h^t-h^{t^{-}}$ and an ego-context contrastive loss, enabling effective learning from limited labels while exploiting abundant unlabeled data. The approach demonstrates superior performance over state-of-the-art GAD methods across four dynamic datasets, with thorough ablations validating the contributions of temporal modeling, local/global attention, and the proposed losses. By preserving continuous-time dynamics and leveraging ego-contextual information, the method offers robust and scalable anomaly detection suitable for real-world evolving networks.

Abstract

Semi-supervised graph anomaly detection (GAD) has recently received increasing attention, which aims to distinguish anomalous patterns from graphs under the guidance of a moderate amount of labeled data and a large volume of unlabeled data. Although these proposed semi-supervised GAD methods have achieved great success, their superior performance will be seriously degraded when the provided labels are extremely limited due to some unpredictable factors. Besides, the existing methods primarily focus on anomaly detection in static graphs, and little effort was paid to consider the continuous evolution characteristic of graphs over time (dynamic graphs). To address these challenges, we propose a novel GAD framework (EL$^{2}$-DGAD) to tackle anomaly detection problem in dynamic graphs with extremely limited labels. Specifically, a transformer-based graph encoder model is designed to more effectively preserve evolving graph structures beyond the local neighborhood. Then, we incorporate an ego-context hypersphere classification loss to classify temporal interactions according to their structure and temporal neighborhoods while ensuring the normal samples are mapped compactly against anomalous data. Finally, the above loss is further augmented with an ego-context contrasting module which utilizes unlabeled data to enhance model generalization. Extensive experiments on four datasets and three label rates demonstrate the effectiveness of the proposed method in comparison to the existing GAD methods.

Figures (3)

• Figure 1: The architecture of EL$^{2}$-DGAD. The bottom section shows the ego and context graphs for two example edges (one normal and one abnormal), processed by the graph encoder in the top section. For a given edge, the distance between encoded ego and context graphs is minimized if the edge is normal and maximized if it is abnormal (via $\mathcal{L}^{ecc}$). Additionally, $\mathcal{L}^{echsc}$ regularizes all edges, enforcing consistency between each edge’s representation and its context graph. For the graph encoder, each layer includes a local MHA module that aggregates information from neighboring edges and nodes, along with the time difference relative to the edge’s timestamp. The local MHA outputs are then fed into a global MHA, followed by feed-forward networks and layer normalization.
• Figure 2: Sensitivity analysis of $\lambda$ and neighbors number when there is one labeled anomaly available in the training dataset.
• Figure 3: t-SNE Visualization on the Wikipedia dataset.