Generative semi-supervised graph anomaly detection

• Main Authors: QIAO, Hezhe, WEN, Qingsong, LI, Xiaoli, LIM, Ee-peng, PANG, Guansong
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2024
• Subjects: Graph anomaly detection; GAD; Generative GAD; Anomaly nodes; Databases and Information Systems; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/9763; https://ink.library.smu.edu.sg/context/sis_research/article/10763/viewcontent/10275_Generative_Semi_supervis__1_.pdf
• Institution: Singapore Management University

This work considers a practical semi-supervised graph anomaly detection (GAD) scenario, where part of the nodes in a graph are known to be normal, contrasting to the extensively explored unsupervised setting with a fully unlabeled graph. We reveal that having access to the normal nodes, even just a small percentage of normal nodes, helps enhance the detection performance of existing unsupervised GAD methods when they are adapted to the semi-supervised setting. However, their utilization of these normal nodes is limited. In this paper we propose a novel Generative GAD approach (namely GGAD) for the semi-supervised scenario to better exploit the normal nodes. The key idea is to generate pseudo anomaly nodes, referred to as outlier nodes, for providing effective negative node samples in training a discriminative one-class classifier. The main challenge here lies in the lack of ground truth information about real anomaly nodes. To address this challenge, GGAD is designed to leverage two important priors about the anomaly nodes – asymmetric local affinity and egocentric closeness – to generate reliable outlier nodes that assimilate anomaly nodes in both graph structure and feature representations. Comprehensive experiments on six real-world GAD datasets are performed to establish a benchmark for semi-supervised GAD and show that GGAD substantially outperforms state-of-the-art unsupervised and semi-supervised GAD methods with varying numbers of training normal nodes.