Generate and Filter: A GNN-Based Approach for Graph Anomaly Detection.

Graph Anomaly Detection via Feature Selection with Local Topological Residuals

Anomaly Detection via Contrastive Learning on Graph using Embedding

A graph embedding-based error detection method via contrastive learning that treats each triple as a hyper-node, enabling data-driven modeling of semantic consistency and integrates a semantic matching-based scoring mechanism with a contrastive learning-based scoring mechanism.

CR-Aug: Community Risk-Guided Adaptive Augmentation for Semi-supervised Graph Anomaly Detection

Recently, semi-supervised graph anomaly detection (GAD) has garnered increasing attention under a challenging setting where only a limited number of normal nodes are labeled during training. To better exploit the limited normal supervision and compensate for the absence of real anomaly labels, existing methods often adopt a single, uniform anomaly modeling and pseudo-anomaly generation strategy applied across the entire graph, while overlooking the inherent heterogeneity among communities in graph data. Consequently, the generated pseudo-anomalies exhibit limited diversity and specificity, failing to represent the complex distributions of real-world anomalies. To address this challenge, we propose CR-Aug, a novel Community Risk-Guided Adaptive Augmentation framework, which is designed to overcome this limitation by leveraging community-specific prior knowledge more effectively. It comprises two core components: Community Risk Profiling (CRP) and Risk-Guided Synthesis (RGS). Specifically, CRP quantifies community-level risks by measuring the affinity discrepancy between the labeled normal subset and the overall community. Guided by the derived risk scores, RGS then dynamically adapts the generation process through risk-weighted sampling and adaptive mixing. This strategy facilitates the synthesis of diverse pseudo-anomalies, thereby providing the classifier with more discriminative supervisory signals. Extensive experiments on multiple benchmark datasets demonstrate that CR-Aug significantly outperforms state-of-the-art semi-supervised GAD methods, validating the effectiveness of incorporating community-level risk profiles.

Feature Transformation Enhanced Jacobi Polynomial Graph Filtering for Graph Anomaly Detection

In recent years, graph anomaly detection (GAD) based on frequency-domain filtering have achieved promising results. However, existing approaches still face three major challenges: First, they use static basic function to constructed graph filter which cannot effectively adapt to the frequency-domain distribution of graph data. Second, they fail to adequately consider the importance information of each attribute in the node feature vector, leading to the loss of fine-grained information. Third, they insufficiently utilize node labels for GAD. To address these issues, this paper proposes a novel graph anomaly detection method called JPGFN (Feature Transformation Enhanced Jacobi Polynomial Graph Filtering Network). First, a Feature Separation Transformation Network (FSTNN) is developed to better learn fine-grained node features by feature separation and applying nonlinear transformations to node features across different dimensions. Second, an adaptive Jacobi polynomial graph filtering module is constructed based on Jacobi polynomials to adaptively capture complex frequency-domain features of graph signals. Finally, a node label constraint module is developed to facilitate the use of node labels and enhance the performance of GAD. Experimental results on multiple real-world datasets demonstrate that the proposed method significantly outperforms mainstream approaches.

Local anomaly detection via subgraph embedding on multivariate data streams

This study addresses the crucial challenge of local anomaly detection in multivariate data streams, which is essential for applications such as fault detection and damage localization in industrial contexts. Traditional approaches often neglect two critical aspects: the significance of relational features in assessing similarity and the necessity of pinpointing specific data streams that exhibit abnormal patterns. To address these gaps, we introduce a novel subgraph embedding-based method. Our approach constructs dynamic graphs to model relational features and identifies anomalies by detecting subgraphs within these graphs. The core innovation lies in an entropy-based transformer integrated with an autoencoder, which maps subgraphs into a low-dimensional space to effectively discriminate abnormal subgraphs. Experiments on EEG and industrial datasets show that the proposed model achieves average F1-score improvements of 0.07 and 0.105 over the compared baselines, respectively. The results indicate that entropy-based subgraph embedding can improve local anomaly detection performance, although the model does not achieve the best value for every metric on every dataset.

Dual-autoencoder multi-task self-supervised one-class graph anomaly detection for network traffic

To address the limitations of intrusion detection under unknown attacks and label scarcity, this paper proposes GDAE, a multi-task self-supervised one-class anomaly detection framework for network traffic graphs. It constructs an edge-level directed graph from NetFlow, employs E-GraphSAGE for structure-aware edge embeddings, and captures multi-scale normal patterns via local structure and global semantic autoencoders with a structure consistency prediction task. To compensate for the lack of negative samples, a dual-path pseudo-anomaly generation mechanism using feature perturbation and structural discarding is designed, with an anomaly discriminator to learn the normal-abnormal boundary. Training employs Kendall uncertainty for adaptive multi-task loss weighting and extreme value theory for threshold estimation, demonstrating strong performance on two large-scale benchmark datasets. Experiments on NF-UNSW-NB15-v2 and NF-CSE-CIC-IDS2018-v2 demonstrate GDAE’s superior performance over unsupervised and graph-based baselines in PR-AUC and Macro-F1, with strong stability and efficiency, offering a new pathway for lightweight, robust self-supervised one-class intrusion detection.