End-to-End Abnormal Subgraph Detection via Subgraph-Level Contrastive Learning.

Area of Science:

• Graph theory
• Machine learning
• Network security

Background:

• Abnormal subgraph (AS) detection is crucial for security but challenging due to vast subgraph spaces and lack of supervision.
• Traditional methods struggle with unknown anomalies and deep learning models often overlook collaborative node behaviors in subgraphs.
• Existing research lacks dedicated evaluation metrics for subgraph anomaly detection.

Purpose of the Study:

• To propose an end-to-end unsupervised framework, EndSubG, for joint subgraph partition and AS detection.
• To address limitations of existing methods in handling complex subgraph spaces and unknown anomalies.
• To introduce a novel evaluation metric, AS-WNMI, for subgraph anomaly detection.

Main Methods:

• EndSubG models AS boundaries by predicting edge existence probability, refining topology for anomaly-aware graph embedding and partitioning.
• It forms a coarsened subgraph network to identify anomalies via "subgraph-vicinity" matching patterns.
• A new metric, AS-WNMI, is designed to evaluate both subgraph partition and anomaly recognition.

Main Results:

• EndSubG demonstrates superior performance on synthetic and real-world datasets compared to existing methods.
• The framework achieves high scores in Area Under the Curve (AUC), Average Precision (AP), and the novel AS-WNMI metric.
• Visualizations provide intuitive analysis of detected subgraphs.

Conclusions:

• EndSubG offers an effective end-to-end unsupervised approach for subgraph anomaly detection.
• The proposed framework and evaluation metric advance the field of graph-based anomaly detection.
• This work provides a robust solution for enhancing security in high-impact domains through improved AS detection.