Empowering Graph Neural Networks for Graph Anomaly Detection

Abstract

Anomalies, which are rare observations deviating from others in data samples, can be found across various domains, such as finance, medicine, and the web. Anomaly detection aims to identify these uncommon occurrences by learning data features. However, relational information among real-world data have been overlooked. Graph-structured data is widely used to describe relational information, which gives rise to the importance of graph anomaly detection —identifying anomalous nodes and/or edges in a single graph, or anomalous graphs in a set/database of graphs. Graph Neural Networks (GNNs) have achieved empirical success in learning graph-structured data, but their potential in detecting graph anomalies remains under-explored. This thesis undertakes a series of studies on empowering GNNs for graph anomaly detection.First, we propose the Competitive Graph Neural Network (CGNN) to detect fraudulent behaviours on e-commerce platforms, i.e., identifying anomalous edges within a single graph. Contrary to fraud detection systems that rely on confirmed fraud cases, CGNN takes a different approach by incorporating normal behaviours as supervisory information to train a GNN encoder, allowing it to effectively represent the input heterogeneous graph. A pair of competitive graph decoders are connected with GNNs to reconstruct users’ behaviours. Discriminative labeling for normal and fraudulent behaviours can be realized by comparing the reconstruction errors of these two decoders. CGNN eliminates the algorithm’s dependence on confirmed fraud and consistently achieves competitive performance, even when faced with upgraded fraud patterns.Second, we present a Dual-resistant Graph Neural Network named FRAUDRE to detect fraudsters in camouflage, i.e., identifying anomalous nodes within a single multi-relation graph. Fraudsters typically try to camouflage themselves with “normal” behaviours, resulting in graph inconsistencies. These inconsistencies lead GNNs to aggregate numerous normal user attributes onto fraudsters, making their identification more challenging. Furthermore, the highly imbalanced distribution between fraudsters and normal users can lead to GNNs being biased towards normal users. FRAUDRE is a novel GNN framework containing four specialised modules. These modules are specifically crafted to tackle the dual challenges of graph inconsistency and imbalance.Third, we introduce a Dual-discriminative Graph Neural Network named iGAD to detect anomalous graphs. The anomalous property of a graph may be referable to its anomalous attributes of particular nodes and anomalous substructures. To empower GNNs with the capacity to explore various anomaly notions, iGAD integrates anomalous attribute-aware graph convolution layers and substructure-aware deep Random Walk Kernels into GNNs to learn anomalous attributes and substructures, respectively. In addition, due to the imbalance nature of anomaly problem, anomalous information will be diluted by normal graphs with overwhelming quantities. To address this issue, iGAD employs a Point Mutual Information-based loss function to capture essential correlation between graphs and their anomalous/normal properties.Fourth, we address the challenges posed by out-of-distribution (OOD) graphs (a type of anomalous graphs) to GNN deployment. GNNs assume that both training and test graphs are independently sampled from the identical distribution (i.i.d.). However, OOD graphs from unfamiliar domains often arise in real-world scenarios. Targeting this issue, we introduce a novel OOD graph detection GNN (ODGNN). Leveraging the class-conditioned Gaussian distributions to model known graph classes, ODGNN establishes substantial separation between known graph classes and OOD graphs in the representation space. Consequently, distance-based OOD detection methods exhibit a significant gap in OOD score distributions of known graph classes and OOD graphs.We verify the effectiveness of proposed graph anomaly detection algorithms through comprehensive experiments conducted on real-world datasets. Experiment results confirm that these algorithms can indeed enhance GNNs in graph anomaly detection.