H-VGRAE: A Hierarchical Stochastic Spatial-Temporal Embedding Method for Robust Anomaly Detection in Dynamic Networks

Abstract

Detecting anomalous edges and nodes in dynamic networks is critical in various areas, such as social media, computer networks, and so on. Recent approaches leverage network embedding technique to learn how to generate node representations for normal training samples and detect anomalies deviated from normal patterns. However, most existing network embedding approaches learn deterministic node representations, which are sensitive to fluctuations of the topology and attributes due to the high flexibility and stochasticity of dynamic networks. In this paper, a stochastic neural network, named by Hierarchical Variational Graph Recurrent Autoencoder (H-VGRAE), is proposed to detect anomalies in dynamic networks by the learned robust node representations in the form of random variables. H-VGRAE is a semi-supervised model to capture normal patterns in training set by maximizing the likelihood of the adjacency matrix and node attributes via variational inference. The encoder of the H-VGRAE encodes hierarchical spatial-temporal information of topology and node attribute into multi-layer conditional random variables, and then the decoder reconstructs the dynamic network based on the latent random variables. For a new observation of the dynamic network, the reconstruction probabilities of edges and node attributes can be obtained from the trained H-VGRAE, and those with low reconstruction probabilities are declared as anomalous. Comparing with existing methods, H-VGRAE has three main advantages: 1) H-VGRAE learns robust node representations through stochasticity modeling and the extraction of multi-scale spatial-temporal features; 2) H-VGRAE can be extended to deep structure with the increase of the dynamic network scale; 3) the anomalous edge and node can be located and interpreted from the probabilistic perspective. Extensive experiments on four realworld datasets demonstrate the outperformance of H-VGRAE on anomaly detection in dynamic networks compared with state-ofthe-art competitors.

Dynamic Network Embedding Survey

“…Anomaly detection is also important for defending network attack, detecting ticket scalper in E-commerce, etc.. Serval works have utilized dynamic network to perform detection. [34,30,66,67,68] • Recommender System Network-based recommender systems usually take items and users as nodes and build up connections between items and items, users and users, items and users. Besides, temporal network provides fine-grained granularity of history which contains more information than static network.…”

Anomaly Detection in Dynamic Graphs via Transformer

“…Firstly, when facing the lack of raw node attributes, they do not create informative node encoding to represent the nodes' property. Concretely, the onehot identity feature in [6], [11] and the random initialized feature in [7] cannot express any structural or temporal property of each node. The distance-based node labeling strategy in [8] only considers local structural information, which also has a shortage of expression power.…”

“…The learning model is trained in an end-to-end way with negative sampling from "context-dependent" noise distribution. H-VGRAE [11] builds a hierarchical model by combining variational graph autoencoder and recurrent neural network. To detect anomalous edges, the edge reconstruction probability is used to measure the abnormality.…”

“…Very recently, as a novel branch, deep learning-based methods, have shown to be a powerful solution for dynamic graph learning. For example, NetWalk [6] leverages dynamic deep graph embedding technique with a clustering-based detector to detect anomalies; AddGraph [7], StrGNN [8] and H-VGRAE [11] further exploit end-to-end deep neural network models to solve the problem.…”

Anomaly Detection in Dynamic Graphs via Transformer

“…Very recently, as a novel branch, deep learning-based methods, have shown to be a powerful solution for dynamic graph learning. For example, NetWalk [9] leverages dynamic deep graph embedding technique with a clusteringbased detector to detect anomalies; AddGraph [10], StrGNN [13] and H-VGRAE [14] further exploit end-to-end deep neural network models to solve the problem.…”