Robust Anomaly Detection Under Normality Distribution Shift in Dynamic Graphs

2025-09-22

AI Summary

Dynamic graph anomaly detection commonly assumes stable normal patterns; however, in practice, the distribution of normal behavior drifts over time—a phenomenon termed Normality Distribution Shift (NDS)—leading to increased false positives. This work presents the first systematic modeling of NDS and proposes an unsupervised, robust detection framework. It leverages dynamic graph embedding to obtain temporal edge representations, introduces a cross-timestep edge embedding whitening transformation to align normal patterns and calibrate temporal consistency, and explicitly decouples normal evolution from genuine anomalies via distributional statistical estimation. Evaluated on four mainstream dynamic graph benchmarks, the method significantly outperforms nine strong baselines and achieves state-of-the-art performance, effectively mitigating detection degradation induced by NDS.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Reasoning under Uncertainty: Graphical Models

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Web Mining and Content Analysis: Models for Web evolution
• Semantics and Knowledge: Scalable techniques for the creation, curation, publication, maintenance, and consumption of large, Web-based, structured, reusable, knowledge graphs and ontologies

Abstract

Anomaly detection in dynamic graphs is a critical task with broad real-world applications, including social networks, e-commerce, and cybersecurity. Most existing methods assume that normal patterns remain stable over time; however, this assumption often fails in practice due to the phenomenon we refer to as normality distribution shift (NDS), where normal behaviors evolve over time. Ignoring NDS can lead models to misclassify shifted normal instances as anomalies, degrading detection performance. To tackle this issue, we propose WhENDS, a novel unsupervised anomaly detection method that aligns normal edge embeddings across time by estimating distributional statistics and applying whitening transformations. Extensive experiments on four widely-used dynamic graph datasets show that WhENDS consistently outperforms nine strong baselines, achieving state-of-the-art results and underscoring the importance of addressing NDS in dynamic graph anomaly detection.

Problem

• Addresses normality distribution shift in dynamic graph anomaly detection
• Prevents misclassification of evolving normal behaviors as anomalies
• Aligns normal edge embeddings across time using whitening transformations

Innovation

• Whitening transformations align normal edge embeddings
• Estimates distributional statistics across time periods
• Unsupervised method handles evolving normal behaviors