CaCo: Attributed Network Anomaly Detection via Canonical Correlation Analysis

Abstract

Capturing the complex interaction between the node attribute and the network structure is important for attributed network embedding and anomaly detection. However, there are few methods to explicitly model the correlation between these two views of the node attribute and the network structure. In this paper, we propose an attributed network anomaly detection (CaCo) method based on canonical correlation analysis, which assumes that there should be a strong correlation between the attribute and structure features of normal nodes, and a weak correlation ones between those abnormal nodes, in the attributed networks. Consequently, a joint learning mechanism is designed in CaCo to explicitly measure the correlation between two views in the latent space. Specifically, the backbone of a weight-sharing graph convolutional network is employed to encode the node feature from two views of attribute and structure in the latent space, respectively. Then, a Kullback-Leibler (KL) divergence regularization is used to align the distributions of the two views. Finally, the parameters of CaCo are optimized by maximizing the correlation between attribute and structure features of normal nodes in the training phase, and anomalies can be detected by measuring the correlation between two views in the testing phase. Extensive experiments on six real-world datasets demonstrate the effectiveness of the proposed method compared to the state-of-art techniques.