Anomaly Detection On Large-scale Attributed Networks

Graph(or network) is a ubiquitous data structure and general language to describe a realworld system.However,anomalies are quite common on graphs.They are hidden in complex topological structures and high-dimension attributes as latent hazards.Once detected correctly,anomalies can be used as import instructions,for example,computer network admins can react to data leakage and other serious hazards when intruders are identified.Nevertheless,anomaly detection is not always easy.As one of the graph analytical tasks,anomaly detection should deal with complex non-Euclidean data where the efficient detectors in Euclidean data will fail.In addition,the anomaly is a statistical notion that derives from significant deviation from normal nodes without clear metrics for quantitative analysis.Also,the definition of anomaly naturally dictates a quantity gap between anomalous and normal data,resulting in an extremely unbalanced data condition.Extensive research has driven progress in graph anomaly detection,improving the quality of existing systems to some extent.But they are not practical enough.Few-shot anomaly detection is a more realistic setting as anomalies are rare in real-world systems.The quantity of anomalies does not always grow with graph size,often with fewer than 10 anomalies in a graph of tens of thousands of nodes,exacerbating the data imbalance.Whereas existing methods rarely cope with extremely unbalanced data conditions,we present investigate anomaly detection in a few-shot setting.We propose an end-to-end model.It is an extension of the MAML(Model-agnostic Metalearning)framework where a graph representation learning module and a gradient-based learnable hypersphere detector are built to address the unbalanced classification challenge,and this model can scale to large networks.The model performs hypersphere learning on a single subgraph and learns to maintain the learnable radius of the hypersphere adaptively between normal and anomalous nodes across multiple subgraphs,thus forming evolving boundaries for anomaly detection.The model iterates rapidly by the gradient updating steps of MAML in a cross-subgraph way and adapts to new tasks quickly.Furthermore,the model requires only a few nodes around the target node to test its anomalousness.The superior performance of the model is demonstrated in experiments on 5 datasets(including a large-scale dataset),and 6comparison methods(including 3 state-of-the-art methods).