Recently, graph anomaly detection has attracted increasing attention in data mining and machine learning communities. Apart from existing attribute anomalies, graph anomaly detection also captures suspicious topological-abnormal nodes that differ from the major counterparts. Although massive graph-based detection approaches have been proposed, most of them focus on node-level comparison while pay insufficient attention on the surrounding topology structures. Nodes with more dissimilar neighborhood substructures have more suspicious to be abnormal. To enhance the local substructure detection ability, we propose a novel Graph Anomaly Detection framework via Multi-scale Substructure Learning (GADMSL for abbreviation). Unlike previous algorithms, we manage to capture anomalous substructures where the inner similarities are relatively low in dense-connected regions. Specifically, we adopt a region proposal module to find high-density substructures in the network as suspicious regions. Their inner-node embedding similarities indicate the anomaly degree of the detected substructures. Generally, a lower degree of embedding similarities means a higher probability that the substructure contains topology anomalies. To distill better embeddings of node attributes, we further introduce a graph contrastive learning scheme, which observes attribute anomalies in the meantime. In this way, GADMSL can detect both topology and attribute anomalies. Ultimately, extensive experiments on benchmark datasets show that GADMSL greatly improves detection performance (up to 7.30% AUC and 17.46% AUPRC gains) compared to state-of-the-art attributed networks anomaly detection algorithms.

Graph anomaly detection (GAD) is a vital task in graph-based machine learning and has been widely applied in many real-world applications. The primary goal of GAD is to capture anomalous nodes from graph datasets, which evidently deviate from the majority of nodes. Recent methods have paid attention to various scales of contrastive strategies for GAD, i.e., node-subgraph and node-node contrasts. However, they neglect the subgraph-subgraph comparison information which the normal and abnormal subgraph pairs behave differently in terms of embeddings and structures in GAD, resulting in sub-optimal task performance. In this paper, we fulfill the above idea in the proposed multi-view multi-scale contrastive learning framework with subgraph-subgraph contrast for the first practice. To be specific, we regard the original input graph as the first view and generate the second view by graph augmentation with edge modifications. With the guidance of maximizing the similarity of the subgraph pairs, the proposed subgraph-subgraph contrast contributes to more robust subgraph embeddings despite of the structure variation. Moreover, the introduced subgraph-subgraph contrast cooperates well with the widely-adopted node-subgraph and node-node contrastive counterparts for mutual GAD performance promotions. Besides, we also conduct sufficient experiments to investigate the impact of different graph augmentation approaches on detection performance. The comprehensive experimental results well demonstrate the superiority of our method compared with the state-of-the-art approaches and the effectiveness of the multi-view subgraph pair contrastive strategy for the GAD task.

归因网络上的异常检测最近在许多研究领域（例如控制论异常检测和财务欺诈检测）受到了越来越多的关注。随着深度学习在图表表示上的广泛应用，现有的方法选择将欧几里得图编码器作为骨架进行应用，这可能会失去重要的层次结构信息，尤其是在复杂的网络中。为了解决这个问题，我们建议使用双曲线自我监督对比度学习有效的异常检测框架。具体而言，我们首先通过执行子图抽样进行数据增强。然后，我们通过指数映射和对数映射利用双曲线空间中的分层信息，并通过通过区分过程从负对中减去正对的分数来获得异常得分。最后，在四个现实世界数据集上进行的广泛实验表明，我们的方法在代表性基线方法上的表现优越。

近年来，由于其在研究和实践中的重要性，对归属网络的异常检测问题有望的兴趣。虽然已经提出了各种方法来解决这个问题，但存在两种主要限制：（1）由于缺乏监控信号，未经监督的方法通常会效率低得多，（2）现有的异常检测方法仅使用本地语境信息来检测异常信息以检测异常信息节点，例如，单跳或两跳信息，但忽略全局上下文信息。由于异常节点与结构和属性中的正常节点不同，因此如果我们删除连接异常和正常节点的边缘，异常节点和其邻居之间的距离应该大于正常节点和其邻居之间的距离直观。因此，基于全局和本地上下文信息的跳数可以作为异常的指标。通过这种直觉激励，我们提出了一种基于跳数的模型（HCM）来通过建模本地和全局上下文信息来检测异常。为了更好地利用异常识别的跳跃计数，我们建议使用跳数预测作为自我监督任务。我们根据HOP计数通过HCM模型设计了两个异常的分数来识别异常。此外，我们雇用贝叶斯学习培训HCM模型，以捕获学习参数的不确定性，避免过度装备。关于现实世界归属网络的广泛实验表明，我们所提出的模型在异常检测中是有效的。

A large number of studies on Graph Outlier Detection (GOD) have emerged in recent years due to its wide applications, in which Unsupervised Node Outlier Detection (UNOD) on attributed networks is an important area. UNOD focuses on detecting two kinds of typical outliers in graphs: the structural outlier and the contextual outlier. Most existing works conduct experiments based on datasets with injected outliers. However, we find that the most widely-used outlier injection approach has a serious data leakage issue. By only utilizing such data leakage, a simple approach can achieve state-of-the-art performance in detecting outliers. In addition, we observe that most existing algorithms have a performance drop with varied injection settings. The other major issue is on balanced detection performance between the two types of outliers, which has not been considered by existing studies. In this paper, we analyze the cause of the data leakage issue in depth since the injection approach is a building block to advance UNOD. Moreover, we devise a novel variance-based model to detect structural outliers, which outperforms existing algorithms significantly at different injection settings. On top of this, we propose a new framework, Variance-based Graph Outlier Detection (VGOD), which combines our variance-based model and attribute reconstruction model to detect outliers in a balanced way. Finally, we conduct extensive experiments to demonstrate the effectiveness and efficiency of VGOD. The results on 5 real-world datasets validate that VGOD achieves not only the best performance in detecting outliers but also a balanced detection performance between structural and contextual outliers. Our code is available at https://github.com/goldenNormal/vgod-github.

Anomaly detection is defined as discovering patterns that do not conform to the expected behavior. Previously, anomaly detection was mostly conducted using traditional shallow learning techniques, but with little improvement. As the emergence of graph neural networks (GNN), graph anomaly detection has been greatly developed. However, recent studies have shown that GNN-based methods encounter challenge, in that no graph anomaly detection algorithm can perform generalization on most datasets. To bridge the tap, we propose a multi-view fusion approach for graph anomaly detection (Mul-GAD). The view-level fusion captures the extent of significance between different views, while the feature-level fusion makes full use of complementary information. We theoretically and experimentally elaborate the effectiveness of the fusion strategies. For a more comprehensive conclusion, we further investigate the effect of the objective function and the number of fused views on detection performance. Exploiting these findings, our Mul-GAD is proposed equipped with fusion strategies and the well-performed objective function. Compared with other state-of-the-art detection methods, we achieve a better detection performance and generalization in most scenarios via a series of experiments conducted on Pubmed, Amazon Computer, Amazon Photo, Weibo and Books. Our code is available at https://github.com/liuyishoua/Mul-Graph-Fusion.

Anomaly analytics is a popular and vital task in various research contexts, which has been studied for several decades. At the same time, deep learning has shown its capacity in solving many graph-based tasks like, node classification, link prediction, and graph classification. Recently, many studies are extending graph learning models for solving anomaly analytics problems, resulting in beneficial advances in graph-based anomaly analytics techniques. In this survey, we provide a comprehensive overview of graph learning methods for anomaly analytics tasks. We classify them into four categories based on their model architectures, namely graph convolutional network (GCN), graph attention network (GAT), graph autoencoder (GAE), and other graph learning models. The differences between these methods are also compared in a systematic manner. Furthermore, we outline several graph-based anomaly analytics applications across various domains in the real world. Finally, we discuss five potential future research directions in this rapidly growing field.

近年来，由于其在金融，网络安全和医学等广泛的领域中的应用，近年来，归因网络中的异常检测受到了极大的关注。传统方法不能在属性网络的设置上采用以解决异常检测问题。这种方法的主要局限性是它们固有地忽略了数据特征之间的关系信息。随着基于深度学习和图神经网络技术的快速爆炸，由于深度技术在提取复杂关系方面的潜力，因此在归因网络上发现稀有对象已大大发展。在本文中，我们提出了有关异常检测的新架构。设计这种体系结构的主要目标是利用多任务学习，以增强检测性能。基于多任务的基于学习的异常检测仍处于起步阶段，现有文献中只有少数研究迎合了同样的研究。我们合并了社区检测和多视图表示学习技术，以从属性网络中提取明显和互补的信息，并随后融合捕获的信息以获得更好的检测结果。该体系结构中采用的两个主要组成部分（即社区特定的学习和多视图表示学习）之间的相互合作展示了一种有希望的解决方案，以达到更有效的结果。

异常检测属性网络广泛用于Web购物，金融交易，通信网络等。但是，大多数工作都试图仅考虑单个交互动作，检测属性网络上的异常，这不能考虑在多视图归属网络中的丰富种类的交互动作。事实上，它仍然是一个具有挑战性的任务，可以均匀地考虑所有不同类型的交互动作，并检测多视图归属网络中的异常情况。在本文中，我们提出了一个基于图形卷积的框架，Anomman，以检测\ textBF {Anom} Aly On \ TextBF {M} Ulti-View \ TextBF {A} Ttributed \ TextBF {n} etworks。要在共同考虑属性和所有交互操作，我们使用注意机制来定义网络中所有视图的重要性。此外，由于其低通特性，图形卷积操作不能简单地应用于异常检测任务。因此，Anomman使用图形自动编码器模块来克服缺点并将其转化为我们的实力。根据真实世界数据集的实验，Anomman优于最先进的模型和我们所提出的模型的两个变体。此外，Anomman的精度@ 50指示器在数据集上达到1.000，这表明由Anomman检测到的前50个异常实例是所有异常的。

对于由硬件和软件组件组成的复杂分布式系统而言，异常检测是一个重要的问题。对此类系统的异常检测的要求和挑战的透彻理解对于系统的安全性至关重要，尤其是对于现实世界的部署。尽管有许多解决问题的研究领域和应用领域，但很少有人试图对这种系统进行深入研究。大多数异常检测技术是针对某些应用域的专门开发的，而其他检测技术则更为通用。在这项调查中，我们探讨了基于图的算法在复杂分布式异质系统中识别和减轻不同类型异常的重要潜力。我们的主要重点是在分布在复杂分布式系统上的异质计算设备上应用时，可深入了解图。这项研究分析，比较和对比该领域的最新研究文章。首先，我们描述了现实世界分布式系统的特征及其在复杂网络中的异常检测的特定挑战，例如数据和评估，异常的性质以及现实世界的要求。稍后，我们讨论了为什么可以在此类系统中利用图形以及使用图的好处。然后，我们将恰当地深入研究最先进的方法，并突出它们的优势和劣势。最后，我们评估和比较这些方法，并指出可能改进的领域。

图形离群值检测是一项具有许多应用程序的新兴但至关重要的机器学习任务。尽管近年来算法扩散，但缺乏标准和统一的绩效评估设置限制了它们在现实世界应用中的进步和使用。为了利用差距，我们（据我们所知）（据我们所知）第一个全面的无监督节点离群值检测基准为unod，并带有以下亮点：（1）评估骨架从经典矩阵分解到最新图形神经的骨架的14个方法网络； （2）在现实世界数据集上使用不同类型的注射异常值和自然异常值对方法性能进行基准测试； （3）通过在不同尺度的合成图上使用运行时和GPU存储器使用算法的效率和可扩展性。基于广泛的实验结果的分析，我们讨论了当前渠道方法的利弊，并指出了多个关键和有希望的未来研究方向。

脑电图（EEG）信号是用于癫痫发作分析的有效工具，其中最重要的挑战之一是对癫痫发作或发起的癫痫发作事件和大脑​​区域的准确检测。但是，所有基于机器学习的癫痫发作分析算法都需要访问标记的癫痫发作数据，同时获取标记的数据是非常劳动密集型，昂贵的，并且鉴于EEG信号的视觉定性解释的主观性质。在本文中，我们建议以自我监督的方式检测癫痫发道和剪辑，在这种方式中不需要访问癫痫发作数据。所提出的方法考虑了通过使用正和负子图的局部结构和上下文信息，这些信息嵌入了EEG图中。我们通过最大程度地减少对比度和生成性损失来训练我们的方法。当地脑电图子图的使用使该算法在访问所有脑电图通道时成为适当的选择，这是由于诸如颅骨骨折之类的并发症。我们对最大的癫痫发作数据集进行了一系列广泛的实验，并证明我们提出的框架在基于EEG的癫痫发作研究中优于最新方法。提出的方法是唯一需要在其训练阶段访问癫痫发作数据的研究，但可以建立一个新的领域最新技术，并且胜过所有相关的监督方法。

Most existing deep learning models are trained based on the closed-world assumption, where the test data is assumed to be drawn i.i.d. from the same distribution as the training data, known as in-distribution (ID). However, when models are deployed in an open-world scenario, test samples can be out-of-distribution (OOD) and therefore should be handled with caution. To detect such OOD samples drawn from unknown distribution, OOD detection has received increasing attention lately. However, current endeavors mostly focus on grid-structured data and its application for graph-structured data remains under-explored. Considering the fact that data labeling on graphs is commonly time-expensive and labor-intensive, in this work we study the problem of unsupervised graph OOD detection, aiming at detecting OOD graphs solely based on unlabeled ID data. To achieve this goal, we develop a new graph contrastive learning framework GOOD-D for detecting OOD graphs without using any ground-truth labels. By performing hierarchical contrastive learning on the augmented graphs generated by our perturbation-free graph data augmentation method, GOOD-D is able to capture the latent ID patterns and accurately detect OOD graphs based on the semantic inconsistency in different granularities (i.e., node-level, graph-level, and group-level). As a pioneering work in unsupervised graph-level OOD detection, we build a comprehensive benchmark to compare our proposed approach with different state-of-the-art methods. The experiment results demonstrate the superiority of our approach over different methods on various datasets.

由于其在许多有影响力的领域中的广泛应用，归因网络上的图形异常检测已成为普遍的研究主题。在现实情况下，属性网络中的节点和边缘通常显示出不同的异质性，即不同类型的节点的属性显示出大量的多样性，不同类型的关系表示多种含义。在这些网络中，异常在异质性的各个角度上的表现通常与大多数不同。但是，现有的图异常检测方法不能利用归因网络中的异质性，这与异常检测高度相关。鉴于这个问题，我们提出了前方的提议：基于编码器解码器框架的异质性无监督图异常检测方法。具体而言，对于编码器，我们设计了三个关注级别，即属性级别，节点类型级别和边缘级别的关注，以捕获网络结构的异质性，节点属性和单个节点的信息。在解码器中，我们利用结构，属性和节点类型重建项来获得每个节点的异常得分。广泛的实验表明，与无监督环境中的艺术品相比，在几个现实世界中的异质信息网络上，前方的优势。进一步的实验验证了我们三重注意力，模型骨干和解码器的有效性和鲁棒性。

基于图的异常检测已被广泛用于检测现实世界应用中的恶意活动。迄今为止，现有的解决此问题的尝试集中在二进制分类制度中的结构特征工程或学习上。在这项工作中，我们建议利用图形对比编码，并提出监督的GCCAD模型，以将异常节点与正常节点的距离与全球环境（例如所有节点的平均值）相比。为了使用稀缺标签处理场景，我们通过设计用于生成合成节点标签的图形损坏策略，进一步使GCCAD成为一个自制的框架。为了实现对比目标，我们设计了一个图形神经网络编码器，该编码器可以在消息传递过程中推断并进一步删除可疑链接，并了解输入图的全局上下文。我们在四个公共数据集上进行了广泛的实验，表明1）GCCAD显着且始终如一地超过各种高级基线，2）其自我监督版本没有微调可以通过其完全监督的版本来实现可比性的性能。

Due to the issue that existing wireless sensor network (WSN)-based anomaly detection methods only consider and analyze temporal features, in this paper, a self-supervised learning-based anomaly node detection method based on an autoencoder is designed. This method integrates temporal WSN data flow feature extraction, spatial position feature extraction and intermodal WSN correlation feature extraction into the design of the autoencoder to make full use of the spatial and temporal information of the WSN for anomaly detection. First, a fully connected network is used to extract the temporal features of nodes by considering a single mode from a local spatial perspective. Second, a graph neural network (GNN) is used to introduce the WSN topology from a global spatial perspective for anomaly detection and extract the spatial and temporal features of the data flows of nodes and their neighbors by considering a single mode. Then, the adaptive fusion method involving weighted summation is used to extract the relevant features between different models. In addition, this paper introduces a gated recurrent unit (GRU) to solve the long-term dependence problem of the time dimension. Eventually, the reconstructed output of the decoder and the hidden layer representation of the autoencoder are fed into a fully connected network to calculate the anomaly probability of the current system. Since the spatial feature extraction operation is advanced, the designed method can be applied to the task of large-scale network anomaly detection by adding a clustering operation. Experiments show that the designed method outperforms the baselines, and the F1 score reaches 90.6%, which is 5.2% higher than those of the existing anomaly detection methods based on unsupervised reconstruction and prediction. Code and model are available at https://github.com/GuetYe/anomaly_detection/GLSL

图表表示学习（GRL）对于图形结构数据分析至关重要。然而，大多数现有的图形神经网络（GNNS）严重依赖于标签信息，这通常是在现实世界中获得的昂贵。现有无监督的GRL方法遭受某些限制，例如对单调对比和可扩展性有限的沉重依赖。为了克服上述问题，鉴于最近的图表对比学习的进步，我们通过曲线图介绍了一种新颖的自我监控图形表示学习算法，即通过利用所提出的调整变焦方案来学习节点表示来学习节点表示。具体地，该机制使G-Zoom能够从多个尺度的图表中探索和提取自我监督信号：MICRO（即，节点级别），MESO（即，邻域级）和宏（即，子图级） 。首先，我们通过两个不同的图形增强生成输入图的两个增强视图。然后，我们逐渐地从节点，邻近逐渐为上述三个尺度建立三种不同的对比度，在那里我们最大限度地提高了横跨尺度的图形表示之间的协议。虽然我们可以从微距和宏观视角上从给定图中提取有价值的线索，但是邻域级对比度基于我们的调整后的缩放方案提供了可自定义选项的能力，以便手动选择位于微观和介于微观之间的最佳视点宏观透视更好地理解图数据。此外，为了使我们的模型可扩展到大图，我们采用了并行图形扩散方法来从图形尺寸下解耦模型训练。我们对现实世界数据集进行了广泛的实验，结果表明，我们所提出的模型始终始终优于最先进的方法。

由于其独立性与标签及其稳健性的独立性，自我监督的学习最近引起了很多关注。目前关于本主题的研究主要使用诸如图形结构的静态信息，但不能很好地捕获诸如边缘时间戳的动态信息。现实图形通常是动态的，这意味着节点之间的交互发生在特定时间。本文提出了一种自我监督的动态图形表示学习框架（DYSUBC），其定义了一个时间子图对比学学习任务，以同时学习动态图的结构和进化特征。具体地，首先提出了一种新的时间子图采样策略，其将动态图的每个节点作为中心节点提出，并使用邻域结构和边缘时间戳来采样相应的时间子图。然后根据在编码每个子图中的节点之后，根据中心节点上的邻域节点的影响设计子图表示功能。最后，定义了结构和时间对比损失，以最大化节点表示和时间子图表示之间的互信息。五个现实数据集的实验表明（1）DySubc比下游链路预测任务中的两个图形对比学习模型和四个动态图形表示学习模型更好地表现出更好的相关基线，（2）使用时间信息不能使用只有更有效的子图，还可以通过时间对比损失来学习更好的表示。

与其他图表相比，图形级异常检测（GAD）描述了检测其结构和/或其节点特征的图表的问题。GAD中的一个挑战是制定图表表示，该图表示能够检测本地和全局 - 异常图，即它们的细粒度（节点级）或整体（图级）属性异常的图形，分别。为了解决这一挑战，我们介绍了一种新的深度异常检测方法，用于通过图表和节点表示的联合随机蒸馏学习丰富的全球和局部正常模式信息。通过训练一个GNN来实现随机初始化网络权重的另一GNN来实现随机蒸馏。来自各种域的16个真实图形数据集的广泛实验表明，我们的模型显着优于七种最先进的模型。代码和数据集可以在https://git.io/llocalkd中获得。

包括传统浅层模型和深图神经网络（GNN）在内的图形嵌入方法已导致有希望的应用。然而，由于其优化范式，浅层模型尤其是基于随机步行的算法无法充分利用采样子图或序列中的邻居接近度。基于GNN的算法遇到了高阶信息的利用不足，在堆叠过多的层时很容易引起过度平滑的问题，这可能会恶化低度（长尾）项目的建议，从而限制了表现力和可伸缩性。在本文中，我们提出了一个新颖的框架SAC，即空间自动回归编码，以统一的方式解决上述问题。为了充分利用邻居接近和高级信息，我们设计了一种新型的空间自回旋范式。具体而言，我们首先随机掩盖了多跳的邻居，并通过以明确的多跳上注意来整合所有其他周围的邻居来嵌入目标节点。然后，我们加强模型，通过对比编码和蒙面邻居的嵌入来学习目标节点的邻居预测性编码，并配备了新的硬性阴性采样策略。为了了解目标到邻居预测任务的最小足够表示并删除邻居的冗余，我们通过最大化目标预测性编码和蒙面邻居的嵌入以及同时约束编码之间的相互信息来设计邻居信息瓶颈和周围的邻居的嵌入。公共推荐数据集和实际方案网络规模数据集Douyin-Friend-Recormendation的实验结果证明了SAC的优势与最先进的方法相比。