Learning Discriminative and Generalizable Anomaly Detector for Dynamic Graph with Limited Supervision

TL;DR

An effective, generalizable, and model-agnostic framework with three main components that capture deviations between current interactions and their historical context, providing anomaly-relevant signals and a bi-boundary optimization strategy that learns a discriminative and robust boundary using the normal log-likelihood distribution modeled by a normalizing flow.

Abstract

Dynamic graph anomaly detection (DGAD) is critical for many real-world applications but remains challenging due to the scarcity of labeled anomalies. Existing methods are either unsupervised or semi-supervised: unsupervised methods avoid the need for labeled anomalies but often produce ambiguous boundary, whereas semi-supervised methods can overfit to the limited labeled anomalies and generalize poorly to unseen anomalies. To address this gap, we consider a largely underexplored problem in DGAD: learning a discriminative boundary from normal/unlabeled data, while leveraging limited labeled anomalies \textbf{when available} without sacrificing generalization to unseen anomalies. To this end, we propose an effective, generalizable, and model-agnostic framework with three main components: (i) residual representation encoding that capture deviations between current interactions and their historical context, providing anomaly-relevant signals; (ii) a restriction loss that constrain the normal representations within an interval bounded by two co-centered hyperspheres, ensuring consistent scales while keeping anomalies separable; (iii) a bi-boundary optimization strategy that learns a discriminative and robust boundary using the normal log-likelihood distribution modeled by a normalizing flow. Extensive experiments demonstrate the superiority of our framework across diverse evaluation settings.

Figures (7)

• Figure 1: Conceptual illustration. (a) Unsupervised methods often yield ambiguous decision boundaries, with anomaly scores collapse into a narrow range. (b) The objective of our framework.
• Figure 2: Framework overview. We first encode each sample's residual representation by contrasting two node-pair embeddings (Sec \ref{['sec:enc']}). Then the residual representations of normal samples (green dots) are constrained into an interval region between two co-centered hypersphere, while anomalous samples (red dots) are pushed outside (Sec \ref{['sec:rr']}). Finally, normalizing flow is used to model the normal log-likelihood distribution and then a discriminative and robust boundary is explicitly learned by the bi-boundary optimization(Sec \ref{['sec:distribution_normalizing']}).
• Figure 3: Visualization of anomaly score distributions on the Wikipedia (1) and Enron (2) test set. (a–b) Kernel Density Estimates (KDE) of anomaly scores. (c–d) Corresponding anomaly score of each sample over time. Our framework provides significant better score separability and threshold-ability. Results on other datasets are provided in Fig. \ref{['fig:score_syn']} in the Appendix.
• Figure 4: Visualization of log-likelihood distributions under different ablation variants. Top: baseline without any components (Left) vs. adding residual representations without restriction (Right). Bottom: representation restriction without bi-boundary optimization (Left) vs. full framework (Right).
• Figure 5: Parameter sensitivity with different $\alpha$ and $\gamma$ on Enron dataset