A Full-Granularity Anomaly Detection Model Based on Attribute-Enhanced Sampling

The network with attributes at the nodes is called an attribute network. Detecting abnormal nodes in the attribute network has a wide range of applications in real life, such as detecting malicious actors in social networks, fraudsters in financial networks, and traffic congestion in transportation networks. Existing methods mainly use contrastive learning to detect abnormal nodes, and have achieved better results than traditional and compressed-reconstruction methods. However, existing contrastive learning-based abnormal node detection methods have limitations in ensuring sufficient contrast between positive and negative samples and in capturing comprehensive abnormal features, and the detection accuracy needs to be further improved. This paper proposes a novel anomaly detection model called FGAnomAES, which aims to simultaneously discover anomalies at the full granularity level. The model builds an attribute-enhanced network, allowing nodes with attribute similarity to have edges connected in the original network. Based on this network, positive and negative sample subgraphs with sufficient contrast in both structure and attribute can be obtained by interval sampling. On the basis of node-to-subgraph and node-to-node contrastive learning, node-to-global contrast is added to learn subgraph-level, node-level, and global abnormal features. Finally, the graded comparison results of each node are combined to calculate the full-graded abnormal score of each node. Based on the abnormal scores, abnormal nodes are detected. Comparative experiments were conducted on four real-world datasets, including BlogCatalog, Cora, Flickr, and ACM, compared with models such as GRADATE, CoLA, and DOMINANT. The results show that compared with the benchmark models, the AUC values of FGAnomAES increased by 1.75%-9.23%, 1.33%-4.46%, 3.17%-11.46%, and 1.61-7.01%.

I. Introduction

There are many types of networks in the real world, which can be represented by attribute networks, such as social networks, financial networks, and transportation networks. Attribute networks contain nodes with attributes, and they are becoming increasingly popular in real life with the development of information technology. There are often some abnormal nodes in different types of attribute networks, such as malicious actors in social networks[1], fraudsters in financial networks[2], and traffic congestion in transportation networks. These abnormal nodes can affect people's normal lives, so researching abnormal node detection techniques in attribute networks has important practical significance.