Abstract
Anomaly detection in dynamic graphs presents a significant challenge due to the temporal evolution of graph structures and attributes. The conventional approaches that tackle this problem typically employ an unsupervised learning framework, capturing normality patterns with exclusive normal data during training and identifying deviations as anomalies during testing. However, these methods face critical drawbacks: they either only depend on proxy tasks for general representation without directly pinpointing normal patterns, or they neglect to differentiate between spatial and temporal normality patterns, leading to diminished efficacy in anomaly detection. To address these challenges, we introduce a novel Spatial-Temporal memories-enhanced graph autoencoder (STRIPE). Initially, STRIPE employs Graph Neural Networks (GNNs) and gated temporal convolution layers to extract spatial features and temporal features, respectively. Then STRIPE incorporates separate spatial and temporal memory networks, which capture and store prototypes of normal patterns, thereby preserving the uniqueness of spatial and temporal normality. After that, through a mutual attention mechanism, these stored patterns are then retrieved and integrated with encoded graph embeddings. Finally, the integrated features are fed into the decoder to reconstruct the graph streams which serve as the proxy task for anomaly detection. This comprehensive approach not only minimizes reconstruction errors but also refines the model by emphasizing the compactness and distinctiveness of the embeddings in relation to the nearest memory prototypes. Through extensive testing, STRIPE has demonstrated a superior capability to discern anomalies by effectively leveraging the distinct spatial and temporal dynamics of dynamic graphs, significantly outperforming existing methodologies, with an average improvement of 15.39% on AUC values.
Abstract (translated)
在动态图中的异常检测是一个挑战性的任务，因为图结构和属性的时间演化。解决这个问题的传统方法通常采用无监督学习框架，在训练期间捕获规范模式，并在测试期间识别异常。然而，这些方法面临着关键的缺陷：它们要么只依赖于一般表示的代理任务，没有直接确定规范模式，要么忽视了空间和时间规范模式之间的区别，导致异常检测的有效性降低。为了应对这些挑战，我们引入了一种新颖的空间-时间记忆增强图自编码器（STRIPE）。 首先，STRIPE采用图神经网络（GNNs）和有门时间卷积层来提取空间特征和时间特征。然后，STRIPE引入了单独的空间和时间记忆网络，它们捕获并存储规范模式的模板，从而保留空间和时间的独特性。接下来，通过自注意力机制，这些存储的模式被检索并整合与编码的图嵌入。最后，将整合的嵌入输入解码器以重构图流作为异常检测的代理任务。 这种全面的方法不仅减少了重构误差，而且通过强调嵌入与最近记忆原型之间的简洁性和差异性，优化了模型。通过广泛的测试，STRIPE已经证明了自己在区分异常方面的优越性能，有效提高了平均异常检测的准确率15.39%。
URL
https://arxiv.org/abs/2403.09039
