A significant number of anomalous nodes in the real world, such as fake news, noncompliant users, malicious transactions, and malicious posts, severely compromises the health of the graph data ecosystem and urgently requires effective identification and processing. With anomalies that span multiple data domains yet exhibit vast differences in features, cross-domain detection models face severe domain shift issues, which limit their generalizability across all domains. This study identifies and quantitatively analyzes a specific feature mismatch pattern exhibited by domain shift in graph anomaly detection, which we define as the Anomaly Disassortativity issue (AD). Based on the modeling of the issue AD, we introduce a novel graph foundation model for anomaly detection. It achieves cross-domain generalization in different graphs, requiring only a single training phase to perform effectively across diverse domains. The experimental findings, based on fourteen diverse real-world graphs, confirm a breakthrough in the model's cross-domain adaptation, achieving a pioneering state-of-the-art (SOTA) level in terms of detection accuracy. In summary, the proposed theory of AD provides a novel theoretical perspective and a practical route for future research in generalist graph anomaly detection (GGAD). The code is available at https://anonymous.4open.science/r/Anonymization-TA-GGAD/.
Figures & tables
Figure 1: A case of the Anomaly Disassortativity ( AD ) issue in Generalist Graph Anomaly Detection. The anomaly pattern (a) is much different from (b).
Figure 2: Overview of TA-GGAD
Method
CS
Facebook
ACM
Cora
T-Finance
CiteSeer
BlogCatalog
elliptic
Amazon
DGraph-Fin
photo
Reddit
Weibo
rank
GAD methods
GCN(2017)
67.55±1.11
29.51±4.86
60.49±9.65
59.64±8.30
68.05±11.82
60.27±8.11
56.19±6.39
50.67±0.49
46.63±3.47
40.21±2.01
58.96±0.69
50.43±4.41
76.64±17.69
9.61
GAT(2018)
53.38±0.39
51.88±2.16
48.79±2.73
50.06±2.65
48.56±3.21
51.59±3.49
50.40±2.80
24.80±0.48
50.52±17.22
OOM
52.34±0.10
51.78±4.04
53.06±7.48
12.69
BGNN(2021)
36.06±0.92
54.74±25.29
44.00±13.69
42.45±11.57
37.05±1.98
42.32±11.82
47.67±8.52
55.29±4.25
52.26±3.31
OOM
41.86±0.25
50.27±3.84
32.75±35.35
14.69
BWGNN(2022)
61.41±10.21
45.84±4.97
67.59±0.70
54.06±3.27
70.36±4.16
52.61±2.88
56.34±1.21
72.41±4.91
55.26±16.95
52.43±2.48
62.47±4.81
48.97±5.74
53.38±1.61
8.85
GHRN(2023)
61.50±0.04
44.81±8.06
55.65±6.37
59.89±6.57
61.14±15.68
56.04±9.19
57.64±3.48
57.02±4.65
49.48±17.13
52.75±1.11
56.22±4.59
46.22±2.33
51.87±14.18
10.08
Table 1: Anomaly detection performance in terms of AUROC (in percent, mean±std). The results ranked first , second , and third .
Dataset
w/o ADA&TSA
w/ADA
w/TSA
TA-GGAD (Full)
CS
71.03
68.31
89.72
98.19
Facebook
77.89
83.13
80.81
83.39
ACM
51.57
87.58
87.31
89.04
Cora
88.23
90.53
88.31
91.07
T-Finance
69.84
72.37
71.93
75.75
CiteSeer
92.41
91.02
93.53
94.12
Table 2: The evaluation of anomaly disassortativity Adapter (ADA), Testing-time Score Adapter (TSA), and TA-GGAD (full).
Figure 3: Effect of voting threshold K on AUROC and AUPRC for ACM and CS datasets.
Target Dataset
ND
SD
AD∗
Δ AUROC
Cora
0.7928
0.3174
0.9800
↑ 3.62
CiteSeer
0.7797
0.3313
0.9425
↑ 3.17
BlogCatalog
0.3682
0.7796
0.7548
↑ 3.15
Elliptic
0.6645
0.3179
0.7747
↑ 2.36
Facebook
0.8054
0.4653
0.7220
↑ 14.78
CS
0.7281
0.4635
0.6062
↑ 15.73
Table 3: The correlation analysis between Δ AUROC and AD compared with previous SOTA methods. Normalized AD∗ derived from AD via smoothed normalization.
Source Dataset
PubMed, Flickr, Questions, YelpChi
Target Dataset
ACM
BlogCatalog
Facebook
CS
T-Finance
ND
0.6224
0.3682
0.8054
0.7281
0.5432
SD
0.3960
0.7796
0.4653
0.4635
0.7302
ARC
79.88
74.76
67.56
82.46
64.10
AnomalyGFM
60.79
57.77
58.64
67.86
67.57
TA-GGAD
89.04
77.91
83.39
98.19
76.29
Table 4: The AUROC of three models with different node disassortativity ( ND ) and structure disassortativity ( SD ) on cross-domain generalization.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Dataset
Train
Test
#Nodes
#Edges
#Features
Avg. Degree
#Anomaly
%Anomaly
Citation networks with injected anomalies
Cora
-
✓
2,708
5,429
1,433
3.90
150
5.53
CiteSeer
-
✓
3,327
4,732
3,703
2.77
150
4.50
ACM
-
✓
16,484
71,980
8,337
8.73
597
3.62
PubMed
✓
-
19,717
44,338
500
4.50
600
3.04
Social networks with injected anomalies
Appendix
Table 5: Statistics of the seventeen datasets used for training and testing.
Method
cs
Facebook
ACM
Cora
T-Finance
CiteSeer
BlogCatalog
elliptic
Amazon
DGraph-Fin
photo
Reddit
Weibo
rank
GAD methods
GCN(2017)
2.88±0.31
1.59±0.11
5.27±1.12
7.41±1.55
7.81±5.33
6.40±1.40
7.44±1.07
15.25±17.70
6.96±2.04
0.95±1.81
4.82±0.29
3.39±0.39
67.21±15.20
12.38
GAT(2018)
4.33±0.10
3.14±0.37
4.70±0.75
6.49±0.84
4.93±2.81
5.58±0.62
12.81±2.08
6.17±0.26
15.74±17.85
OOM
6.04±0.04
3.73±0.54
33.34±9.80
11.58
BGNN(2021)
2.34±0.02
3.81±2.12
3.48±1.33
4.90±1.27
3.56±0.09
3.91±1.01
5.73±1.47
10.78±1.01
7.51±0.58
OOM
4.74±0.01
3.52±0.50
30.26±29.98
14.58
BWGNN(2022)
5.44±2.97
2.54±0.63
7.14±0.20
7.25±0.80
11.31±2.90
6.35±0.73
8.99±1.12
13.79±3.65
13.12±11.82
1.31±0.27
7.41±2.12
3.69±0.81
12.13±0.71
10.62
GHRN(2023)
15.40±1.74
2.41±0.62
5.61±0.71
9.56±2.40
9.36±5.61
7.79±2.01
10.94±2.56
11.37±1.26
7.54±2.01
1.33±0.05
6.86±1.24
3.24±0.33
28.53±7.38
9.92
Appendix
Table 6: Anomaly detection performance in terms of AUPRC (in percent, mean±std). Highlighted are the results ranked first , second , and third .
Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA · Department of Computer Science, University of Southern California, Los Angeles, USA