Abstract: Graph anomaly detection has important application value in industrial scenarios such as microservice call chain tracing and communication network monitoring. Real-world systems often contain multiple types of entities and interaction relationships, exhibiting significant heterogeneous characteristics. However, existing heterogeneous graph anomaly detection methods usually adopt feature concatenation or simple average pooling when aggregating cross-relation information, implicitly assuming that different relation types have equal importance for anomaly detection. This assumption often does not hold in real data. When anomalies are only reflected in a few key relations, regular relations tend to dilute important anomaly signals. In addition, existing methods are mostly limited to a single pooling mechanism when generating graph-level representations, making it difficult to simultaneously handle both global weak anomalies and local strong mutations. To address these issues, this paper proposes HRA-GNN, a new heterogeneous graph anomaly detection framework based on relation deviation-modulated attention. The method defines relations as type triplets and maintains independent message transformation parameters for each relation. A relation deviation-modulated dynamic attention mechanism is introduced to characterize the deviation strength of each relation channel relative to normal prototypes by establishing normal relation prototypes, achieving anomaly-sensitive relation weighted fusion and effectively suppressing the interference of regular relations. An adaptive gated hybrid readout module is designed to balance local anomalies and global anomalies. Heterogeneous graph data augmentation and self-supervised learning mechanisms are introduced to provide additional structural discriminative signals for unsupervised training. The framework does not require predefined meta-paths and can adaptively capture abnormal patterns in multi-type interactions. Through the synergy of deviation modulation and gated readout, the model maintains stable discriminative capability when facing complex anomaly patterns where local mutations and global distribution shifts coexist, and exhibits good generalization across different data scales and relation types. Experimental results demonstrate that HRA-GNN achieves an AUROC of 0.84 and an AP of 0.78 on the TraceLog dataset, attains 1.0 for both AUROC and AP on the FlowGraph dataset, and yields an AUROC of 0.87 and an AP of 0.85 on the ADFA-LD dataset, verifying the effectiveness of the proposed method.

摘要： 图异常检测在微服务调用链路追踪、通信网络监控等工业场景中具有重要应用价值。真实系统往往包含多种类型的实体和交互关系，呈现显著的异构特性。然而，现有异构图异常检测方法在跨关系信息聚合时，通常采用特征拼接或简单均值池化，隐含假设不同关系类型对异常判定具有同等重要性，但这一假设在真实数据中往往不成立。当异常仅体现在少数关键关系上时，常规关系容易稀释重要的异常信号。此外，现有方法在生成图级表示时多受限于单一池化机制，难以同时兼顾全局性弱异常与局部强突变场景。针对上述问题，本文提出一种基于关系偏差调制注意力的异构图异常检测框架HRA-GNN。该方法将关系定义为类型三元组，并为每种关系维护独立的消息变换参数；引入关系偏差调制的动态注意力机制，通过建立正常关系原型并显式刻画各关系通道相对于正常原型的偏离强度，实现异常敏感的关系加权融合，从而有效抑制常规关系的干扰；设计自适应门控混合读出模块，兼顾局部极值异常与全局分布偏移；引入异构图数据增强与自监督学习机制，为无监督训练提供额外的结构判别信号。该框架无需预定义元路径，能够自适应地捕捉多类型交互中的异常模式。通过偏差调制与门控读出的协同作用，模型在面对局部突变与整体分布漂移并存的复杂异常形态时仍保持稳定判别能力，且在不同数据规模和关系类型下均展现良好的泛化性。实验结果表明，HRA-GNN在TraceLog数据集上取得0.84的AUROC和0.78的AP；在FlowGraph数据集上AUROC和AP均达到1.0；在ADFA-LD数据集上取得0.87的AUROC和0.85的AP，验证了方法的有效性。