Dual contrastive learning-based reconstruction for anomaly detection in attributed networks.

Area of Science:

• Graph Neural Networks
• Machine Learning
• Cybersecurity

Background:

• Anomaly detection in attributed networks is crucial for cybersecurity, identifying threats like financial fraud and intrusions.
• Existing graph-based methods have limitations in capturing fine-grained patterns and utilizing cross-view discrepancies.

Purpose of the Study:

• To propose a novel method, Dual Contrastive Learning-based Reconstruction (DCOR), to overcome limitations in current graph anomaly detection techniques.
• To improve the fidelity of both network structure and attributes during anomaly detection.

Main Methods:

• DCOR employs a dual autoencoder with a shared Graph Neural Network (GNN) encoder.
• It contrasts reconstructions at the reconstruction level (not embeddings) between original and augmented graph views.
• Both adjacency and attributes are reconstructed and contrasted across views to preserve fine-grained information.

Main Results:

• DCOR achieved state-of-the-art Area Under the Receiver Operating Characteristic curve (AUROC) across six benchmark datasets (Enron, Amazon, Facebook, Flickr, ACM, Reddit).
• DCOR demonstrated an average AUROC improvement of 11.3% over the best non-DCOR baseline, with a maximum gain of 21.3% on the Enron dataset.
• Ablation studies confirmed the necessity of reconstruction-level contrastive learning, showing a 25.5% AUROC reduction when this component was removed on the Amazon dataset.

Conclusions:

• DCOR effectively addresses limitations in existing graph anomaly detection methods by leveraging reconstruction-level contrastive learning.
• The proposed method significantly enhances the accuracy and fidelity of anomaly detection in attributed networks.
• DCOR offers a robust solution for identifying complex threats in diverse real-world applications.