Open-Set Graph Anomaly Detection via Normal Structure Regularisation

2023-11-12

International Conference on Learning Representations

AI Summary

To address the problem of overfitting to known anomalies and poor generalization to unseen anomalies in open-set graph anomaly detection (GAD), this paper proposes Normal Structure Regularization (NSReg), a novel framework. NSReg leverages a small set of labeled normal and known anomalous nodes, employing a graph neural network to jointly optimize structure-aware node embeddings, supervised anomaly classification loss, and a newly introduced normal structure regularization term—explicitly modeling topological consistency among normal nodes to learn compact and semantically robust normal representations. Evaluated on seven real-world datasets, NSReg achieves over 14% improvement in AUC-ROC for detecting unseen anomalies and a 10% gain in overall anomaly detection AUC, significantly outperforming state-of-the-art methods. To our knowledge, NSReg is the first approach to enable unified, generalizable detection of both known and unknown anomalies in open-set GAD.

Abstract

This paper considers an important Graph Anomaly Detection (GAD) task, namely open-set GAD, which aims to train a detection model using a small number of normal and anomaly nodes (referred to as seen anomalies) to detect both seen anomalies and unseen anomalies (i.e., anomalies that cannot be illustrated the training anomalies). Those labelled training data provide crucial prior knowledge about abnormalities for GAD models, enabling substantially reduced detection errors. However, current supervised GAD methods tend to over-emphasise fitting the seen anomalies, leading to many errors of detecting the unseen anomalies as normal nodes. Further, existing open-set AD models were introduced to handle Euclidean data, failing to effectively capture discriminative features from graph structure and node attributes for GAD. In this work, we propose a novel open-set GAD approach, namely normal structure regularisation (NSReg), to achieve generalised detection ability to unseen anomalies, while maintaining its effectiveness on detecting seen anomalies. The key idea in NSReg is to introduce a regularisation term that enforces the learning of compact, semantically-rich representations of normal nodes based on their structural relations to other nodes. When being optimised with supervised anomaly detection losses, the regularisation term helps incorporate strong normality into the modelling, and thus, it effectively avoids over-fitting the seen anomalies and learns a better normality decision boundary, largely reducing the false negatives of detecting unseen anomalies as normal. Extensive empirical results on seven real-world datasets show that NSReg significantly outperforms state-of-the-art competing methods by at least 14% AUC-ROC on the unseen anomaly classes and by 10% AUC-ROC on all anomaly classes.

Problem

• Detect unseen anomalies in graph data effectively
• Reduce overfitting to seen anomalies in supervised GAD
• Improve normality boundary for better anomaly detection

Innovation

• Normal structure regularisation for generalised anomaly detection
• Compact representations of normal nodes via structural relations
• Combining supervised losses with normality regularisation