AddGraph: Anomaly Detection in Dynamic Graph Using Attention-based
Temporal GCN
Li Zheng
1,2
, Zhenpeng Li
3
, Jian Li
3
, Zhao Li
3∗
and Jun Gao
1,2∗
1
The Key Laboratory of High Confidence Software Technologies, Ministry of Education, China
2
School of EECS, Peking University, China
3
Alibaba Group, China
{greezheng, gaojun}@pku.edu.cn, {zhen.lzp,zeshan.lj,lizhao.lz}@alibaba-inc.com
Abstract
Anomaly detection in dynamic graphs becomes
very critical in many different application scenar-
ios, e.g., recommender systems, while it also raises
huge challenges due to the high flexible nature of
anomaly and lack of sufficient labelled data. It is
better to learn the anomaly patterns by consider-
ing all possible hints including the structural, con-
tent and temporal features, rather than utilizing
heuristic rules over the partial features. In this pa-
per, we propose AddGraph, a general end-to-end
anomalous edge detection framework using an ex-
tended temporal GCN (Graph Convolutional Net-
work) with an attention model, which can capture
both long-term patterns and the short-term patterns
in dynamic graphs. In order to cope with insuffi-
cient explicit labelled data, we employ a selective
negative sampling and margin loss in training of
AddGraph in a semi-supervised fashion. We con-
duct extensive experiments on real-world datasets,
and illustrate that AddGraph can outperform the
state-of-the-art competitors in anomaly detection
significantly.
1 Introduction
The recent years witness the rapid development of dynamic
graphs. Taking the e-commerce sites as an example. Massive
users perform different operations, such as item clicking, item
buying, in the sites every day, which contribute to millions of
newly-added edges into the graph. The modification of other
attributes for accounts/items also produces a large amount of
content information. These dynamic graphs serve as the basis
for the most important tasks in the e-commerce sites like the
query and item recommendation.
Anomalous users may perform some operations to gener-
ate fake data in the dynamic graphs to achieve the potential
gain. These fake data are called anomaly in this paper. Taking
the anomaly in the recommendation as an example. Anoma-
lous users can improve the popularity of their target items
through a large number of new operations related to target
∗
Contact Author
items, like clicking both target items and popular ones fre-
quently. Then, the target items may show some similarities to
other popular ones, which increases the chances and upgrade
rankings in the recommendation
[
Hooi et al., 2016
]
. In order
to achieve the goal quickly, anomalous users usually control
multiple accounts to perform these operations in a short time
period. The anomaly detection in dynamic graph, especially
anomalous edges detection, is then highly needed before the
data are fed into the following tasks
[
Akoglu et al., 2015;
Ranshous et al., 2015
]
.
It is not trivial to detect the anomaly due to its flexible and
dynamic nature. Some anomalous operations show some ex-
plicit patterns but try to hide them in a large graph, while oth-
ers are with implicit patterns. Take an explicit anomaly pat-
tern in the recommender system as an example. As anoma-
lous users usually control multiple accounts to promote the
target items, the edges between these accounts and items may
compose a dense subgraph, which emerge in a short time pe-
riod. In addition, although the accounts which involve the
anomaly perform anomalous operations sometimes, these ac-
counts perform normally most of the time, which hides their
long-term anomalous behavior and increases the difficulty of
detection. The similar anomaly pattern appears in the net-
work attack against IP-IP network
[
Eswaran et al., 2018
]
,
where there are sudden large number of connections, forming
a very dense subgraph in the network. Such cases indicate
the flexible nature of anomaly, which requires us to learn the
anomaly patterns by combining all available hints like struc-
tural, temporal and content features.
Another challenge in the anomaly detection lies in the in-
sufficient labelled data. Even if the initial data are normal,
anomaly data will be finally mixed with the normal ones in
the real-world applications as time goes by. It results in high
burden or is even infeasible if we check the anomaly every
day by hand. Even if we can label some anomaly operations,
they may occupy a small part of anomalies. It indicates that
the explicit labelled data may be not representative, and re-
sults in the poor performance if we learn a detection model in
a supervised way.
Most of existing approaches to detecting the anomalies in
dynamic large graphs rely on the heuristic rules which con-
sider the above features in a rigid way. For example,
[
Hooi
et al., 2016
]
mainly relies on the structural features. They
define a density function and discover the target mainly us-
下载后可阅读完整内容，剩余6页未读，立即下载
weixin_38519060
- 粉丝: 1
- 资源: 900
我的内容管理
展开
最新资源
- zlib-1.2.12压缩包解析与技术要点
- 微信小程序滑动选项卡源码模版发布
- Unity虚拟人物唇同步插件Oculus Lipsync介绍
- Nginx 1.18.0版本WinSW自动安装与管理指南
- Java Swing和JDBC实现的ATM系统源码解析
- 掌握Spark Streaming与Maven集成的分布式大数据处理
- 深入学习推荐系统：教程、案例与项目实践
- Web开发者必备的取色工具软件介绍
- C语言实现李春葆数据结构实验程序
- 超市管理系统开发：asp+SQL Server 2005实战
- Redis伪集群搭建教程与实践
- 掌握网络活动细节：Wireshark v3.6.3网络嗅探工具详解
- 全面掌握美赛：建模、分析与编程实现教程
- Java图书馆系统完整项目源码及SQL文件解析
- PCtoLCD2002软件：高效图片和字符取模转换
- Java开发的体育赛事在线购票系统源码分析
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
