SAD: Semi-Supervised Anomaly Detection on Dynamic Graphs

Graph neural networks (GNNs) have been prevalently used to represent structural information from graph data. However, naive applications of static graph learning paradigms Hamilton et al. (2017); Velickovic et al. (2018) in dynamic graphs fail to capture temporal information and show up as suboptimal in dynamic graph scenarios Xu et al. (2020a). Thus, some methods Singer et al. (2019); Pareja et al. (2020) model the evolutionary process of a dynamic graph by discretizing time and reproducing multiple static graph snapshots. Such a paradigm is often infeasible for real-world systems that need to handle each interaction event instantaneously, in which graphs are represented by a continuous sequence of events, i.e., nodes and edges can appear and disappear at any time.

Some recent work has begun to consider the direct modeling of temporal information and proposed a continuous time dynamic graph modeling scheme. For example, DyREP Trivedi et al. (2019) uses a temporal point process model, which is parameterized by a recurrent architecture to learn evolving entity representations on temporal knowledge graphs. TGAT Xu et al. (2020a) proposes a novel functional time encoding technique with a self-attention layer to aggregate temporal-topological neighborhood features. However, the above methods rely heavily on annotated labels, yet obtaining sufficient annotated labels is usually very expensive, which greatly limits their application in real-world scenarios such as anomaly detection.

Anomalies are rare observations (e.g., data records or events) that deviate significantly from the others in the sample, and graph anomaly detection (GAD) aims to identify anomalous graph objects (i.e., nodes, edges, or sub-graphs) in a single graph as well as anomalous graphs among a set/database of graphs Ma et al. (2021). The anomaly detection with GNNs is mainly divided into unsupervised and semi-supervised methods. Unsupervised anomaly detection methods are usually constructed with a two-stage task, where a graph representation learning task is first constructed, and then abnormality measurements are applied based on the latent representations Akoglu et al. (2015). Rader Li et al. (2017) detects anomalies by characterizing the residuals of the attribute information and their correlation with the graph structure. Autoencoder Zhou and Paffenroth (2017) learns graph representations through an unsupervised feature-based deep autoencoder model. DOMINANT Ding et al. (2019) uses a GCN-based autoencoder framework that uses reconstruction errors from the network structure and node representation to distinguish anomalies. CoLA Liu et al. (2022) proposes a self-supervised contrastive learning method based on capturing the relationship between each node and its neighboring substructure to measure the agreement of each instance pair.

A more recent line of work proposes employing semi-supervised learning by using small amounts of labeled samples from the relevant downstream tasks to address the problem that unsupervised learning tends to produce noisy instances. SemiGNN Wang et al. (2019) learn a multi-view semi-supervised graph with hierarchical attention for fraud detection. GDN Ding et al. (2021) adopts a deviation loss to train GNN and uses a cross-network meta-learning algorithm for few-shot node anomaly detection. SemiADC Meng et al. (2021) simultaneously explores the time-series feature similarities and structure-based temporal correlations. TADDY Liu et al. (2021) constructs a node encoding to cover spatial and temporal knowledge and leverages a sole transformer model to capture the coupled spatial-temporal information. However, these methods are based on discrete-time snapshots of dynamical graphs that are not well suited to continuous time dynamical graphs, and the temporal information is simply added to the model using a linear network mapping as features, without taking into account temporal properties such as periodicity.

Notations. Continuous-time dynamic graphs are important for modeling relational data for many real-world complex applications. The dynamic graph can be represented as $\mathcal{G}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}={v_{i}}$ is the set of nodes involved in all temporal events, and $\mathcal{E}$ denotes a sequence of temporal events. Typically, let $\mathcal{E}=\{\delta(t_{1}),\delta(t_{2}),...,\delta(t_{m})\}$ be an event stream that generates the temporal network and $m$ is the number of observed events, with an event $\delta(t)=(v_{i},v_{j},t,x_{ij})$ indicating an interaction or a link happens from source node $v_{i}$ to target node $v_{j}$ at time $t$, with associating edge feature $x_{ij}$. Note that there might be multiple links between the same pair of node identities at different timestamps.

To enable anomaly detection with few-shot labeled data, we construct a graph deviation network following Ding et al. (2021). However, for application to dynamic graphs, we first use a temporal graph encoder based on temporal encoding information to learn node representations and additionally construct a memory bank to dynamically record the overall statistical distribution of normal and unlabeled samples as a reference score to calculate the deviation loss that optimizes the model with few-shot labeled samples. The entire deviation network is semi-supervised, with abundant unlabeled samples used as statistical priors in the memory bank and few-shot labeled data used for calculating deviation losses.

Note that the attribute of the nodes in the dynamic graph evolves continuously, with consequent changes in the labels and anomaly scores. Perceptually, samples with longer time intervals should have less influence on the current statistical distribution, so we also record the corresponding time t for each anomaly score in the memory bank.

Meanwhile, the memory bank $mem$ is designed as a first-in-first-out (FIFO) queue of size $M$. The queue size is controlled by discarding samples that are sufficiently old since outdated samples yield less gain due to changes in model parameters during the model training process.

To obtain the reference score in the memory bank, we assume that the distribution of the anomaly score satisfies the Gaussian distribution, which is a very robust choice to fit the anomaly scores of various datasets Kriegel et al. (2011). Based on this assumption, we randomly sample a set of $M_{s}$ examples from the memory bank for calculating the reference score, which helps to improve the robustness of the model by introducing random perturbations. Meanwhile, we introduce the effect of time decay and use the relative timespan between the timestamp $t$ and the anomaly score storage time $t_{i}$ to calculate the weighting term for each statistical example $w_{i}(t)=\frac{1}{\ln(t-t_{i}+1)+1}$. The reference scores (mean $\mu_{r}(t)$ and standard deviation $\sigma_{r}(t)$) of the normal sample statistical distribution at the timestamp $t$ are calculated as follows:

With the reference scores at the timestamp $t$, we define the deviation $dev(v_{i},t)$ between the anomaly score of node $v_{i}$ and the reference score in the following:

The final deviation loss is then obtained by plugging deviation $dev(v_{i},t)$ into the contrast loss Hadsell et al. (2006) as follows:

where $y_{i}(t)$ is the label information of node $v_{i}$ at timestamp $t$ and $m$ is equivalent to a Z-Score confidence interval parameter. Note that in this semi-supervised task, only labeled samples are directly involved in computing the objective function. Optimizing this loss will enable the anomaly score of normal samples as close as possible to the overall distribution in the memory bank, while the anomaly scores of anomalies are far from the reference distribution.

To fully exploit the potential of unlabeled samples, we generate a pseudo-label $\hat{y}_{i}(t)$ for each sample based on the existing deviation scores $dev(v_{i},t)$ and involve them in the training of the graph encoder network. Here, we design a supervised contrastive learning task such that nodes with closer deviation scores also have more similar node representations, while nodes with larger deviation score differences have larger differences in their corresponding representations. The goal of this task is consistent with our deviation loss, which makes the difference between normal and anomaly samples deviate in both the representation space and anomaly score space. For a batch training sample with batch size $N$, we first obtain the deviation distance $\triangle d_{ij}=|dev(v_{i},t_{i})-dev(v_{j},t_{j})|$ between any two samples $v_{i}$ and $v_{j}$. On the standard normal distribution anomaly space, we group nodes with intervals less than $1\sigma$ into the same class. Thus, for a single sample $v_{i}$, its supervised contrastive learning loss takes the following form:

where $\tau$ is a scalar temperature parameter, and $\frac{1}{1+\triangle d_{ij}}$ denotes similarity weights between positive sample pairs. The final objective function is the sum of the losses of all nodes: $\mathcal{L}^{scl}=\sum^{N}\mathcal{L}_{i}^{scl}$.

For anomaly detection tasks, the optimization of the whole network is based on deviation loss and contrastive learning loss. Noted that the contrastive learning loss is only used to train the parameters of the temporal graph encoder. Specifically, let $\theta_{enc}$ denote all the parameters of the temporal graph encoder, and $\theta_{ano}$ denote the learnable parameters in the anomaly detector. The optimization task of our model is as follows:

where $\alpha$ is a hyperparameter for balancing the contribution of contrastive learning loss.

In addition to anomaly detection tasks, we also present an end-to-end learning procedure to cope with different downstream tasks. Taking the downstream task of node classification as an example, in order to obtain the score results for node classification, we use a simple multi-layer perception (MLP) as the projection network to learn the classification results based on the node representations after the graph encoder. Let $\theta_{pro}$ denote the learnable parameters in the projection network. Assume that the downstream supervised task with loss function $\mathcal{L}^{sup}(\theta_{pro})$, the optimization task of our model is as follows:

where $\alpha$ and $\beta$ are hyperparameters for balancing the contributions of two losses.

Datasets. In this paper, we use four real-world datasets, including three public bipartite interaction dynamic graphs and an industrial dataset. Wikipedia Kumar et al. (2019) is a dynamic network tracking user edits on wiki pages, where an interaction event represents the page edited by the user. Dynamic labels indicate whether a user is banned from posting. Reddit Kumar et al. (2019) is a dynamic network tracking active users posting in subreddits, where an interaction event represents a user posting on a subreddit. The dynamic binary labels indicate if a user is banned from posting under a subreddit. MOOC Kumar et al. (2019) is a dynamic network tracking students’ actions on MOOC online course platforms, where an interaction event represents user actions on the course activity. The Alipay dataset is a dynamic financial transaction network collected from the Alipay platform, and dynamic labels indicate whether a user is a fraudster. Note that the Alipay dataset has undergone a series of data-possessing operations, so it cannot represent real business information. For all tasks and datasets, we adopt the same chronological split with 70% for training and 15% for validation and testing according to node interaction timestamps. The statistics are summarized in Table 1.

We compare our SAD against several strong baselines of graph anomaly detection methods on node classification tasks, the baselines in our experiments include our backbone model TGAT and the state-of-the-art supervised learning method TGN-no-mem  Xu et al. (2020b), as well as five graph anomaly detection methods, which are specifically divided into unsupervised anomaly detection methods (Radar and DOMINANT) and semi-supervised anomaly detection methods (SemiGNN, GDN, and TADDY). In order to be able to fairly compare the performance of the different methods, we use the same structure of the projection network to learn the classification results based on the node embedding outputted by their anomaly detection tasks. Table 2 summarizes the dynamic node classification results on different datasets. For all experiments, we report the average results with standard deviations of 10 different runs.

As shown in Table 2, our approach outperforms all baselines on all datasets. Due to the lack of dynamic information, these static graph anomaly detection methods (Radar, SemiGNN, DOMINANT, and GDN) perform worse than the dynamic graph supervision model TGAT on Reddit and Mooc, which are more sensitive to temporal information. On these datasets with large differences in the proportion of positive and negative samples, our method shows a significant improvement compared to TGAT. Specifically, the relative average AUC value improvements on Wikipedia, Reddit, Mooc, and Alipay are $3.54\%$, $1.70\%$, $2.56\%$, and $1.95\%$, respectively. Compared with the recent dynamic graph anomaly detection method TADDY, our method improves $2.05\%$, $0.82\%$, $0.97\%$, and $1.33\%$ on four datasets, respectively. We believe the significant improvements are that SAD captures more information on time-decaying state changes and that the memory bank mechanism can effectively obtain the distribution of normal data, which helps to detect anomaly samples.

The training samples used in the overall performance are annotated. However, in real application scenarios, annotated samples are always difficult to obtain, and anomaly detection algorithms need to be applied to distinguish anomalous nodes in large-scale unlabeled samples. To thoroughly evaluate the benefits of different graph anomaly detection approaches in few-shot scenarios, we varied the drop rate $p$, i.e., the ratio of randomly removed node labels in the training set, from $0.1$ to $0.9$ with a step size of $0.2$.

The curve of AUC values of different models and datasets along with the label drop ratio is drawn in Figure 3. SAD achieves state-of-the-art performance in all cases across two dynamic datasets. Noticeably, we observe that SAD achieves optimal performance on both datasets when the drop rate is at $0.3$. The result indicates that there is a lot of redundant or noisy information in the current graph datasets, which easily leads to overfitting of the model training. By dropping this part of label information and using pseudo-labeled data to participate in the training, the performance of the model is improved instead. Other methods have a significant degradation in performance at a drop ratio of $0.5$. Nevertheless, SAD still outperforms all the baselines by a large margin on two datasets, and the downstream performance is not significantly sacrificed even for a particular large dropping ratio (e.g., 0.7 and 0.9). This indicates that even for few-shot scenarios, SAD could still mine useful statistical information for downstream tasks and distinguish anomalous nodes with information from abundant unlabeled samples. Overall, we believe that the performance improvement in our model comes from two reasons: one is that the memory bank-dominated anomaly detector allows the model to learn a discriminative representation between normal and anomalous samples, and the other is that contrastive learning based on pseudo labels helps to learn generic representations of nodes even in the presence of large amounts of unlabeled data.

In this part, we visualize the learned node embeddings to evaluate the proposed method. And the 2D t-SNE van der Maaten and Hinton (2008) is used to reduce the dimensions of the hidden layer output node embeddings from 128 to 2. Figure 4 shows the visualization of node embeddings learned by TGAT, GDN, TADDY, and SAD on Alipay. As we can see, the node embeddings of SAD are able to separate the abnormal and normal samples well. The supervised learning method TGAT is prone to overfitting during training on datasets with class imbalance, resulting in poor discrimination of node representation learning. GDN is not effective in learning node embedding because it does not take into account dynamic information and historical data statistical distributions. TADDY is based on modeling discrete-time snapshots of dynamical graphs that are not well suited to continuous-time dynamical graphs. Overall, these results show that the proposed method can learn useful node embeddings for anomaly detection tasks on dynamic graphs.

Finally, we conduct an ablation study to better examine the contribution of different components in the proposed framework, detailed as follows:

• •

  backbone. This entity indicates that only the graph coding network is used for dynamic node classification tasks in a supervised learning manner.

• •

  w/dev. This variant indicates that the deviation network based on standard normal distribution is used on the basis of the backbone model, without the memory bank mechanism.

• •

  w/mem. This variant indicates that the memory bank mechanism without the time decay technique is used on the basis of the w/dev model.

• •

  w/time. This variant indicates that the time decay technique in the memory bank is used on the basis of the w/mem model.

• •

  w/scl. This variant indicates that the supervised contrastive learning module is used on the basis of the w/time model, which corresponds to our full model.

To verify the performance of the model in a large number of unlabeled sample scenarios, we manually drop $0.5$ of the labels of the training set at random. Table 3 present the results given by our several sub-modules. We summarize our observations as follows: Firstly, each of the incremental submodules proposed in our paper helps to improve the performance of the model. Among them, the memory bank mechanism yields the largest performance improvements, e.g., $2.75\%$, $2.81\%$, and $1.92\%$ performance improvement on Wikipedia, Reddit, and Mooc, respectively. Secondly, the complete model outperforms the base model on the three dynamic datasets by $5.04\%$, $4.92\%$, and $3.17\%$, respectively, which verifies the effectiveness of the proposed submodule by introducing the deviation loss and contrastive learning based on pseudo labels.