PRA-TAM: prototype-regularised residual affinity maximisation for unsupervised graph anomaly detection

Abstract

Graph anomaly detection plays a critical role in identifying irregular patterns in complex networked data arising in domains such as social networks, e-commerce systems, and cybersecurity. Existing approaches, particularly affinity-based methods, have demonstrated promising performance by leveraging local neighbourhood consistency. However, they often rely on a single anomaly indicator and lack an explicit mechanism to model normal behaviour, limiting their ability to detect subtle, heterogeneous anomalies. To address these challenges, this paper proposes a novel framework, prototype-regularised residual affinity maximisation (PRA-TAM), for unsupervised graph anomaly detection. The proposed method extends affinity-based learning by introducing a prototype-guided normality modelling mechanism that captures dominant patterns of normal nodes in the latent space using a compact set of learnable prototypes. In addition, a residual inconsistency calibration strategy is developed to quantify deviations across the feature, embedding, and neighbourhood spaces, enabling a more comprehensive assessment of node abnormality. To further enhance robustness, a lightweight multi-view learning strategy based on fixed graph truncation is employed to capture structural variations without introducing additional computational complexity. Extensive experiments across multiple benchmark datasets, including Facebook, ACM, Amazon, and YelpChi, demonstrate that the proposed method achieves competitive AUROC and AUPRC performance while demonstrating robust performance across multiple benchmark datasets and remains competitive on YelpChi. The results highlight the effectiveness of integrating affinity learning with prototype modelling and residual-based scoring for improved anomaly detection performance. The proposed framework is computationally efficient, scalable, and well-suited to real-world graph anomaly detection applications characterised by complex, heterogeneous data distributions.