A Deep Multi-View Framework for Anomaly Detection on Attributed Networks

Abstract

The explosion of modeling complex systems using attributed networks boosts the research on anomaly detection in such networks, which can be applied in various high-impact domains. Many existing attempts, however, do not seriously tackle the inherent multi-view property in attribute space but concatenate multiple views into a single feature vector, which inevitably ignores the incompatibility between heterogeneous views caused by their own statistical properties. Actually, the distinct but complementary information brought by multi-view data promises the potential for more effective anomaly detection than the efforts only based on single-view data. Furthermore, the abnormal patterns naturally behave diversely in different views, which coincides with people's desire to discover specific abnormality according to their preferences for views (attributes). Most existing methods cannot adapt to people's requirements as they fail to consider the idiosyncrasy of user preferences. Therefore, we propose a multi-view framework Alarm to incorporate user preferences into anomaly detection and simultaneously tackle heterogeneous attribute characteristics through multiple graph encoders and a well-designed aggregator that supports self-learning and user-guided learning. Experiments on synthetic and real-world datasets, e.g., Disney, Books, and Enron, corroborate the improvement of Alarm in detection accuracy evaluated by the AUC metric and its effectiveness in supporting user-oriented anomaly detection.