OWLEYE: Zero-Shot Learner for Cross-Domain Graph Data Anomaly Detection

TL;DR

OwlEye tackles zero-shot cross-domain graph anomaly detection by learning transferable normal-patterns across graphs. It projects heterogeneous node features to a common dimension via PCA, aligns domains through pairwise-distance statistics, and stores both attribute- and structure-level patterns in a dynamic dictionary. In unseen graphs, a truncated attention reconstruction uses these dictionaries to compute an anomaly score $S_{v_j}= \|\hat{\mathbf{H}}^i_{v_j}-\mathbf{H}^i_{v_j}\|^2 + \beta \|\hat{\mathbf{R}}^i_{v_j}-\mathbf{R}^i_{v_j}\|^2$, enabling zero-shot detection without labels. Extensive experiments across eight real-world datasets show OwlEye achieves state-of-the-art transferability and demonstrates continual-learning benefits via dictionary augmentation without retraining, making it practical for scalable, label-efficient GAD across domains.

Abstract

Graph data is informative to represent complex relationships such as transactions between accounts, communications between devices, and dependencies among machines or processes. Correspondingly, graph anomaly detection (GAD) plays a critical role in identifying anomalies across various domains, including finance, cybersecurity, manufacturing, etc. Facing the large-volume and multi-domain graph data, nascent efforts attempt to develop foundational generalist models capable of detecting anomalies in unseen graphs without retraining. To the best of our knowledge, the different feature semantics and dimensions of cross-domain graph data heavily hinder the development of the graph foundation model, leaving further in-depth continual learning and inference capabilities a quite open problem. Hence, we propose OWLEYE, a novel zero-shot GAD framework that learns transferable patterns of normal behavior from multiple graphs, with a threefold contribution. First, OWLEYE proposes a cross-domain feature alignment module to harmonize feature distributions, which preserves domain-specific semantics during alignment. Second, with aligned features, to enable continuous learning capabilities, OWLEYE designs the multi-domain multi-pattern dictionary learning to encode shared structural and attribute-based patterns. Third, for achieving the in-context learning ability, OWLEYE develops a truncated attention-based reconstruction module to robustly detect anomalies without requiring labeled data for unseen graph-structured data. Extensive experiments on real-world datasets demonstrate that OWLEYE achieves superior performance and generalizability compared to state-of-the-art baselines, establishing a strong foundation for scalable and label-efficient anomaly detection.

Figures (7)

• Figure 1: Performance Visualization of SOTA GAD methods, denotes best. Top row: TSNE embeddings of Facebook and Weibo graph data for (a) original features, (b) ARC, (c) UNPrompt, and (d) OwlEye (ours). ARC pushes the two graphs apart rather than aligning them. Middle and bottom rows: pairwise Euclidean distances for Normal-Normal, Normal-Anomaly, and Anomaly-Anomaly node pairs on Weibo and Facebook dataset, respectively. In the original graph (middle row, (a)), Normal-Normal pairs are denser than Normal-Anomaly pairs on Weibo dataset—an important pattern reversed by UNPrompt (middle row, (c)). The existing data preprocessing methods fail to either align the graphs into the share space or preserve important patterns after normalization.
• Figure 2: Overview of OwlEye.
• Figure 3: Left: Ablation Study. Right: Efficiency Analysis.
• Figure 4: Visualization of cross-attention map on the Cora dataset. Subfigures (a) and (b) display the cross-attention scores across the graphs, where the y-axis corresponds to the graph indices (0–3 indicating the four training graphs and 4 representing the test graph) and the x-axis denotes the ten extracted patterns learned for each graph. The top row shows the attribute attention and structural attention for a normal node and the bottom row shows the attribute attention and structural attention for an anomalous one. Subfigure (c) in both figures presents the ground-truth label matrices that specify whether each node is normal or abnormal.
• Figure 5: Performance Visualization of SOTA GAD methods, denotes best. Top row: TSNE embeddings of Facebook and Weibo graph data for (a) original graph, (b) ARC, (c) UNPrompt, and (d) OwlEye (ours). ARC pushes the two graphs apart rather than aligning them. Middle and bottom rows: pairwise Euclidean distances for Normal-Normal, Normal-Anomaly, and Anomaly-Anomaly node pairs on Weibo and Cora dataset, respectively. In the original graph (middle row, (a)), Normal-Normal pairs are denser than Normal-Anomaly pairs on Weibo dataset—an important pattern reversed by UNPrompt (middle row, (c)). The existing data preprocessing methods fail to either align the graphs into the share space or preserve important patterns after normalization.