Learning-Based Link Anomaly Detection in Continuous-Time Dynamic Graphs

Tim Postuvan, Claas Grohnfeldt, Michele Russo, Giulio Lovisotto

Abstract: Anomaly detection in continuous-time dynamic graphs is an emerging field yet under-explored in the context of learning algorithms. In this paper, we pioneer structured analyses of link-level anomalies and graph representation learning for identifying categorically anomalous graph links. First, we introduce a fine-grained taxonomy for edge-level anomalies leveraging structural, temporal, and contextual graph properties. Based on these properties, we introduce a method for generating and injecting typed anomalies into graphs. Next, we introduce a novel method to generate continuous-time dynamic graphs featuring consistencies across either or combinations of time, structure, and context. To enable temporal graph learning methods to detect specific types of anomalous links rather than the bare existence of a link, we extend the generic link prediction setting by: (1) conditioning link existence on contextual edge attributes; and (2) refining the training regime to accommodate diverse perturbations in the negative edge sampler. Comprehensive benchmarks on synthetic and real-world datasets -- featuring synthetic and labeled organic anomalies and employing six state-of-the-art link prediction methods -- validate our taxonomy and generation processes for anomalies and benign graphs, as well as our approach to adapting methods for anomaly detection. Our results reveal that different learning methods excel in capturing different aspects of graph normality and detecting different types of anomalies. We conclude with a comprehensive list of findings highlighting opportunities for future research.

Submission Length: Regular submission (no more than 12 pages of main content)

Previous TMLR Submission Url: https://openreview.net/forum?id=lcXI5h2JI5

Changes Since Last Submission:

We added the following content based on suggestions made by the reviewers:
(1) We added a new section (Appendix D) with comparative statistical analyses of the synthetic and real-world graphs used throughout the paper, focussing on properties indicative of consistencies in structure, context, and time.
(2) We added minor clarifying statements in Sections 4 and 5.

Code: https://github.com/timpostuvan/CTDG-link-anomaly-detection

Assigned Action Editor: ~Giannis_Nikolentzos1

Submission Number: 2794