Semi-supervised Anomaly Detection with Extremely Limited Labels in Dynamic Graphs

In this paper, we define a dynamic graph as $\mathcal{G}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}$ represents the set of nodes and $\mathcal{E}$ consists of temporal edges. Each edge, denoted by $\delta^{t}=(v_{i},v_{j},t,x_{ij})$, captures an interaction from node $v_{i}$ to node $v_{j}$ at time $t$, with $x_{ij}$ serving as the edge feature. To model the temporal dynamics effectively, we introduce two key subgraphs: the ego-graph $\mathcal{G}^{t}$, which includes all events up to and including time $t$, and the context graph $\mathcal{G}^{t^{-}}$, which contains all events up to time $t$ but excludes the event occurring at $t$. Specifically, our method learns to capture the consistency between the ego-graph and its historical context graph. If an event at time $t$ significantly deviates from this learned consistency, it is flagged as potentially anomalous.

Our proposed EL²-DGAD framework aims to detect anomalous edges in this dynamic graph setting, where each edge $\delta^{t}$ is associated with a latent label $y^{t}$, indicating whether the edge is normal ($y^{t}=0$) or abnormal ($y^{t}=1$). In this study, we have access to only a limited number of labeled edges, denoted as $Y^{L}$, while the majority of edges remain unlabeled ($Y^{U}$), with $|Y^{L}|\ll|Y^{U}|$. The goal is to develop an algorithm that assigns an anomaly score $s^{t}$ to each edge, represented as $f(\delta^{t})=s^{t}$, to effectively distinguish between normal and anomalous edges.

The overview of EL²-DGAD is shown in Figure 1. Specifically, for each input sample, an ego and a context graph are simultaneously defined. Each of the graphs is encoded through a transformer-based dynamic graph encoder, which builts on top of a series of local and global attentions (Section 2.3). During model training, we introduce an ego-context hypersphere classification loss in Section 2.4.1 that classifies edges by quantifying the similarity between their ego representation and the corresponding dynamic neighboring context. Finally, an ego-context contrastive loss in Section 2.4.2 is incorporated that is designed to mine and learn from the patterns of normality prevalent within the graph based on unlabeled data.

In scenarios with extremely limited labeled data, it is crucial to design a robust model that effectively captures the temporal and structural dependencies within dynamic graphs. These graphs are constantly evolving, and anomalies may manifest through unexpected temporal patterns or deviations from typical dynamic behaviors. For example, a node that is usually inactive suddenly exhibiting a surge in activity could indicate anomalous behavior. In addition to temporal patterns, both the influence of a node’s neighbors and the overall graph structure can reveal anomalies. Neighbor relationships capture local patterns within a node’s immediate vicinity, where anomalies might appear as atypical connections or attribute deviations. Conversely, graph-wide structures represent the global organization of the graph, where anomalies may disrupt community structures or introduce unexpected cross-community interactions. Therefore, a robust backbone model must integrate both local and global information while simultaneously capturing the temporal evolution of the graph.

To address these challenges, we propose a transformer-based dynamic graph encoder designed to effectively capture the temporal and structural properties of dynamic graphs. Drawing inspiration from recent advancements in graph transformers [30, 3], our approach leverages local attention mechanisms to extract fine-grained patterns from a node’s neighborhood and global attention mechanisms to aggregate these patterns across the entire graph, thereby modeling both local and global dependencies. Furthermore, continuous-time embeddings are integrated into the attention mechanism, allowing the model to seamlessly incorporate temporal dynamics.

Concretely, our graph encoder takes a subgraph at time $t$ as the input (e.g., ${\mathcal{G}}^{t}$ or ${\mathcal{G}}^{t^{-}}$) and generates node representations that reflect the dynamic status of the nodes. We start by aggregating 1-hop neighborhood information through masked multi-head self-attention, which we refer to as local MHA. To capture the evolving nature of dynamic graphs, we define the entries of $Q$, $K$, and $V$ at layer $l$ as follows:

where $z^{l-1}_{i}$ is the output for node $i$ from layer $l-1$, and $z_{i}^{0}$ is a learnable embedding vectors specified by the degree of $v_{i}$, as detailed in [30]. MLP denotes the multi-layer perceptrons. $\Delta_{t}=t-t_{ij}$, where $t_{ij}$ is the occurring time of edge $(v_{i},v_{j})$. $\phi(\cdot)$ is the sinusoidal embedding function [24], which generates a time representation by applying sine and cosine functions to the input time difference $\Delta_{t}$, scaled by a range of frequencies.

Then, the attention output of node $i$ for a single head can be formulated as:

where $M$ is the adjacency matrix of the input graph. Next, we fed the node representation obtained from the local MHA, as the input to the regular multi-head self-attention in [24], which we referred to as the global MHA. Local MHA focuses on learning neighborhood information which is similar to GNNs but with their inherent limitations, whereas global attention broadens the perspective without explicit structural reliance. Thus, this combination enhances the expressiveness of our model in representing graph structures, effectively balancing the strengths of local and global information processing.

Finally, the output of layer $l$ is obtained as

where $z^{l-1,loc}$ and $z^{l-1,glo}$ are the output from the local MHA and global MHA, LN and FFN denote the layer normalization [14] and the feed-forward blocks respectively.

We evaluate our approach on four dynamic network datasets: UCI [19], Digg [7], Wikipedia [13], and Reddit [13]. The Wikipedia dataset tracks user interactions, where each interaction corresponds to a user editing a wiki page, with the network evolving as users contribute over time. Dynamic labels indicate whether a user is banned from posting. The UCI Messages dataset represents a social network from an online community of students at the University of California, Irvine, where each node denotes a user, and edges signify exchanged messages. The Digg dataset is collected from the social news website Digg.com, which captures user interactions with nodes representing users and edges indicating replies between them. The Reddit dataset is a dynamic network that tracks active users posting across various subreddits, with each interaction representing a user posting in a specific subreddit. Dynamic labels indicate whether a user is banned from posting in a particular subreddit.

Since UCI and Digg do not contain labeled anomalous edges, we introduce synthetic anomalies using an anomaly injection procedure, following a similar setting as in [16]. The process involves clustering nodes into multiple clusters using spectral clustering based on the graph’s structure and then generating a small portion of anomalous edges by randomly connecting nodes from different clusters, ensuring these connections are absent in the original graph. $3\%$ of anomalies are injected to reflect the realistic scenario where anomalies are typically rare. To seamlessly integrate these synthetic anomalies into the dynamic setting, the generated edges are uniformly inserted at random positions among the original edges. Each anomalous edge is assigned a timestamp by randomly selecting a value between the nearest preceding and succeeding normal edges’ timestamps, thus maintaining temporal consistency with the original data.

The datasets are chronologically divided into training, validation, and testing sets based on interaction timings, with a split ratio of 50/20/30. This approach ensures that the model is trained on earlier interactions, validated on more recent data, and tested on the latest interactions, which mirrors real-world scenarios where future data is unknown at training time. In our experiments, we focus on evaluating performance under extremely limited label conditions by providing only 1, 2, or 3 labeled anomaly examples. For the labeled normal samples, we retain a proportion that matches the ratio of labeled anomalies to the total number of anomalies. The summary statistics of all datasets is shown in Table 1.

To construct the ego-graph $\mathcal{G}^{t}$, we include all edges with timestamps up to and including time $t$, capturing the interactions leading up to that specific time point. For the context graph $\mathcal{G}^{t^{-}}$, we similarly include all edges up to time $t$, but explicitly exclude any edge that occurs exactly at time $t$. This differentiation ensures that the context graph only represents historical information, without the current event. To manage the potentially large sizes of $\mathcal{G}^{t}$ and $\mathcal{G}^{t^{-}}$, we implement a sampling strategy that retains a subset of neighboring nodes for each edge endpoint. Specifically, we randomly sample 25, 10, and 5 neighboring nodes at the first, second, and third hops, respectively, with the condition that each sampled neighbor event must have a timestamp no later than the target edge’s timestamp, ensuring that only past interactions are considered.

In addition, our model uses a two-layer transformer with 4 attention heads, and the hidden size is set to 128 across all modules. The contrastive loss weight $\lambda$ is set to 0.01 for Digg, UCI, Reddit and 10 for Wikipedia. The models are trained for 20 epochs using the Adam optimizer [10], with a learning rate of 0.0001 for the Digg and UCI datasets, and 0.001 for the Wikipedia and Reddit dataset.

We benchmark our proposed method against several recent GAD models, namely GDN [9], SL-GAD [34], PREM [20], AddGraph [33], TADDY [16], TGAT [27], and SAD [23]. Among these, GDN, SL-GAD, and PREM are designed for static graph anomaly detection, while AddGraph, TADDY, TGAT, and SAD are tailored for dynamic graph settings.

Note that only GDN, TADDY, AddGraph, and SAD can utilize label information by design. For a fair, label-inclusive comparison for other models, we perform a similar setting as in [23]: applying a cross-entropy loss to the edge representations, which are derived from the concatenated node embeddings of the edge endpoints. Specifically, these edge representations are computed using a MLP network, as outlined in Eq. 8. Thus, the performance of all models can be evaluated based on the classification results.

Extensive results in Table 2 show that our EL²-DGAD consistently surpasses all comparison methods across four datasets, particularly in scenarios where labeled anomalies are extremely limited. The results highlight the effectiveness of our approach in incorporating both temporal and structural context, enabling the model to maintain robustness even under severe label scarcity.

For models like GDN, PREM, and SL-GAD, which do not incorporate temporal information into their design, the decline in performance underscores the critical importance of capturing temporal dependencies in dynamic graph anomaly detection. Although AddGraph and TADDY are designed for dynamic graphs, their performance still lags behind ours by a significant margin. These methods rely on discrete graph snapshots, where timestamps of events within a single snapshot are assumed to be identical. Consequently, this can miss important details about the continuous evolution of the graph’s structure. Moreover, they lack a robust semi-supervised learning mechanism, making it challenging to effectively utilize the limited labeled data. In contrast, our approach operates directly on continuous dynamic graphs, with the transformer-based encoder attending to the most relevant neighbors based on fine-grained temporal information. Additionally, we introduce an ego-context hypersphere classification loss that enforces the alignment of each edge with its immediate surrounding temporal and structural context. Together, these features enable EL²-DGAD to more efficiently utilize the continuously evolving graph patterns, making it better suited to detect anomalies that are difficult to align with the normal behavior.

While SAD is also a semi-supervised anomaly detection framework designed for dynamic graphs, it exhibits a notable drop in performance under extreme label scarcity. Specifically, SAD relies on a deviation network as the main supervised learning component, using it to generate pseudo-labeled data that guides a separate contrastive learning process. However, when only a few labeled examples are available, the quality of these pseudo-labels declines, undermining the effectiveness of the contrastive learning component. In contrast, our approach decouples the unsupervised learning from the supervised training, allowing the model to retain its ability to generalize effectively even under extremely limited conditions. Furthermore, our approach offers additional advantages. First, the ego-context hypersphere classification loss provides a more precise instance-wise contextual comparison, compared to the deviation network used in SAD, which relies on comparisons to only global statistics. Second, our model employs a more robust transformer-based encoder, compared to the GAT encoder used in SAD, allowing it to more effectively capture temporal interactions between nodes from both local and global perspectives.

Table 3 presents the results of the ablation study. Overall, EL²-DGAD achieves optimal performance when all components are included. Removing the local MHA leads to a significant performance drop, highlighting its essential role in capturing neighborhood structures. Similarly, omitting the global MHA also results in a noticeable decrease in performance, underscoring the importance of capturing global node interactions. The exclusion of fine-grained timestamp integration within the Transformer’s attention mechanism also considerably degrades performance, especially in the Wikipedia dataset, where a node-to-node interaction can occur at many distinct timestamps. Ignoring these timestamps results in large information loss, as it prevents the model from capturing the temporal dynamics necessary to detect time-sensitive anomalies effectively. This further emphasizes the importance of modeling temporal changes in dynamic graphs. Additionally, the drop in performance without the contrastive loss component $\mathcal{L}^{ecc}$ indicates the value of leveraging unlabeled data to improve anomaly detection accuracy. Lastly, removing the ego-context contrast from $\mathcal{L}^{echsc}$ leads to a notable decline in performance. Without ego-context contrast, the model no longer minimizes the distance between each ego graph and its context graph; instead, all normal instances are pulled toward a single center, imposing a stronger regularization. This limits the model’s ability to capture the diverse characteristics of normal instances, thereby reducing its ability to distinguish anomalies from normal events.

Figure 2 illustrates the AUC performance for three datasets (Digg, UCI, and Wikipedia) as it varies with changes in the balance parameter $\lambda$ for the ego-context contrastive learning component and the number of neighbors in the first hop. In Figure 2(a), the Wikipedia dataset shows improved AUC scores with higher $\lambda$ values compared to Digg and UCI. This may be due to the greater complexity of anomalies in Wikipedia, making it a more challenging task under extremely limited conditions. Consequently, increasing $\lambda$ enhances the model’s ability to capture general patterns of normal samples, which improves the robustness of the model.

In Figure 2(b), AUC performance for all three datasets slightly increases as the number of neighbors rises, indicating that additional neighborhood information helps the model better distinguish between normal and anomalous interactions within the graphs. Overall, the model’s sensitivity to changes in $\lambda$ and the number of neighbors remains relatively low, suggesting that it is robust to variations in these hyperparameters.

Figure 3 shows t-SNE visualizations of the output embeddings from the layer before anomaly scoring in the Wikipedia dataset, where the selected four models were trained with supervision from only one labeled anomaly. In these visualizations, blue points represent normal instances, while orange points denote anomalies. In the embeddings produced by TGAT and AddGraph, anomalies are dispersed throughout the normal samples, indicating a limited capacity for distinguishing between normal and anomalous instances. Similarly, SAD shows slight improvement with a somewhat better separation, but anomalies remain scattered and intermingled within the normal clusters, lacking a clear boundary.

In contrast, our proposed EL²-DGAD exhibits a relatively clearer separation, with anomalies forming distinct clusters that are well-separated from normal samples. This distinct clustering suggests that EL²-DGAD more effectively learns discriminative embeddings, allowing it to capture the subtle distinctions between normal and anomalous interactions. This improved separation highlights the robustness and effectiveness of our approach for the GAD task, particularly in the challenging scenario of training with extremely limited labeled anomalies.