Abstract: The dynamic graph anomaly detection method based on graph convolution utilizes graph modeling strategies to capture information about anomalous nodes or edges, and has wide applications in fields such as network security, social networks, and recommendation systems. However, these methods face two main challenges: first, it is difficult to fully learn discriminative knowledge from dynamic graphs where the graph structure and temporal information are coupled, and second, they are ineffective in detecting anomalies in nodes with no attributes. To address these challenges, a novel dynamic graph anomaly detection framework is proposed— the Bidirectional Encoder Representations from Transformers for Graph & Temporal Anomaly Detection (GTBAD). This method first designs a subgraph sampling module based on edges, which centers on target edges and constructs local substructures across multiple time slices, thereby enhancing the contextual awareness of anomaly detection. It then designs an encoding module that comprehensively considers both the graph structure and temporal aspects, aiming to better extract the structural and temporal features of each node in dynamic graphs. Additionally, BERT is employed in the downstream encoder to further extract information from dynamic graphs, enabling the model to effectively capture dynamic graphs of nodes without attributes. Finally, a discriminative anomaly detector is introduced to compute the anomaly scores of edges. Extensive experiments were conducted on four real-world datasets, with the area under the receiver operating characteristic curve (AUC) as the evaluation metric. The experimental results demonstrate that the proposed GTBAD framework outperforms existing frameworks in dynamic graph anomaly detection tasks, achieving higher AUC values, thereby providing a novel solution and approach for dynamic graph anomaly detection.

摘要： 基于图卷积的动态图异常检测方法利用图建模策略捕获异常节点或边的信息，在网络安全、社交网络、推荐系统等领域都有广泛应用。然而，这些方法存在以下两个挑战：一是难以充分从图结构与时间信息耦合的动态图中学习判别知识，二是对于无属性节点异常检测效果不佳。为了应对这些挑战，提出了一种新的动态图异常检测框架——用于动态图异常检测的时间和图结构综合编码的双向Transformer编码器（Bidirectional Encoder Representations from Transformers， BERT）(Graph & Temporal BERT for Anomaly Detection, GTBAD)。该方法首先设计了基于边的子结构采样模块，以目标边为中心，在多时间片上构建局部子结构，从而提高异常检测的上下文感知能力，然后设计了一种综合考虑图结构与时间的编码模块，旨在更好的提取每个节点在动态图中的结构与时间特征。同时，BERT在编码器下游进一步提取动态图的信息，使得模型能够有效提取无属性节点的动态图，最后，一个判别式异常检测器被引入去计算边的异常分数。在4个真实数据集上进行了大量实验并以受试者工作特征曲线下面积(AUC)作为评价指标，实验结果表明，所提出的GTBAD框架在动态图异常检测任务中比其他现有框架均获得了更高的AUC值，这为动态图异常检测提供了一种新的解决方案和思路。