Online Test-Time Adaptation for Generalizable Dynamic Graph Anomaly Detection
Authors: Jialun Zheng, Hanchen Yang, Jiannong Cao, Yankai Chen, Yuanjing Feng, Philip S. Yu
Organizations: Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China · Department of Computer Science, University of Illinois at Chicago (UIC), Chicago, IL, USA · Institute of Information Processing and Automation, Zhejiang University of Technology, Zhejiang, China
Generalizable dynamic graph anomaly detection (DGAD) enables pretrained detectors to identify anomalies in unseen target domains without costly retraining. However, existing methods often fail for two reasons. First, they mainly rely on domain-agnostic patterns and miss domain-specific patterns that keep evolving. Second, they assume access to the full target domain data, whereas in more practical online test-time adaptation settings, target data arrive sequentially in unlabeled chunks. To address these limitations, we formulate online test-time adaptation for generalizable DGAD and propose OTTA-DGAD. OTTA-DGAD first extracts dynamic prototypes, i.e., evolving representations of normal and anomalous patterns, from temporal ego-graphs and stores them in a memory buffer. The buffer selectively retains general patterns shared across the source domains used for pretraining while incorporating new patterns from the target domain. An anomaly scorer then compares incoming edge representations against these prototypes to identify both general and domain-specific anomalies. During adaptation, OTTA-DGAD updates the memory buffer using reliable pseudo-labels identified through confidence-based detection. It further enriches each target chunk with relevant representations retained from previous chunks, compensating for information loss resulting from the sequential arrival of data. Extensive experiments under strict test-then-adapt OTTA settings demonstrate state-of-the-art performance on ten real-world datasets from diverse domains.
Figures & tables
Fig. 1: Motivating experiments. (a) Anomalous patterns change over time, chunks and cross datasets. (b) Existing generalist methods capture only domain agnostic patterns, without cross chunk information preservation. (c) Our method, OTTA-DGAD, captures both domain-agnostic and domain-specific patterns. Cross chunk information is also preserved.
Fig. 2: General framework of OTTA-DGAD . (a) Starting with the first source dataset, we extract ego-graphs to capture temporal patterns and store the most distinct prototype pairs in a memory buffer. (b) As we pretrain on the following source datasets, new domain-specific patterns are added while general domain-agnostic patterns are retained. Prototype distributions are then compared with edge embeddings for anomaly scoring. (c) On target chunks, reliable detections, measured by prediction entropy and agreement with neighboring edges, provide pseudo-labels for memory updates. The buffer retains representations with high similarity to chunk distribution, which we define as coverage score and different with stored entries. These representations enrich subsequent chunks with cross-chunk context, while the generalist model remains frozen.
Dataset
Domain
#Nodes
#Edges
Avg. Degree
Wikipedia
Online Collaboration
9,227
157,474
34.13
Bitcoin-OTC
Transaction Network
5,881
35,588
12.10
Bitcoin-Alpha
Transaction Network
3,777
24,173
12.80
Email-DNC
Online Communication
1,866
39,264
42.08
UCI Messages
Online Communication
1,899
13,838
14.57
AS-Topology
Autonomous Systems
34,761
171,420
9.86
TABLE I: Statistics of datasets
Metrics
Category
Methods
AS-Topology
Bitcoin-Alpha
Email-DNC
UCI Messages
Bitcoin-OTC
TAX51
DBLP
Synthetic-Hijack
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
AUROC
DGADs
SAD
40.16
43.81
43.43
57.61
55.59
60.27
50.05
54.54
52.28
56.91
58.28
59.74
70.04
69.19
74.12
42.52
43.56
46.39
43.02
42.98
47.87
59.85
59.67
58.14
SLADE
40.47
42.21
44.42
60.62
59.25
62.98
47.98
50.37
52.11
54.64
55.28
58.32
67.34
66.35
70.44
46.68
48.04
49.33
42.11
41.17
41.35
60.53
60.34
59.99
FALCON
46.73
50.24
53.09
57.13
61.48
66.76
76.81
72.71
75.02
59.36
57.05
62.22
67.37
68.43
70.16
45.27
48.79
50.28
44.41
46.30
47.11
59.06
60.17
65.55
GeneralDyG
41.99
43.51
45.80
62.26
63.03
65.09
50.93
52.63
54.78
50.33
53.50
58.91
70.91
71.77
73.84
52.79
50.58
50.42
48.33
47.34
46.78
56.78
53.47
54.02
TADDY
40.11
42.57
41.08
43.69
45.44
42.03
50.77
53.27
56.90
49.82
50.39
56.12
44.47
50.79
48.72
40.48
42.21
46.94
40.32
40.59
42.40
58.77
60.59
62.10
TABLE II: Overall model performance under the OTTA setting across eight datasets with three anomaly percentages.
Fig. 3: Visualization of chunk-wise metric and coefficient of variation over domain/chunks on TAX51 10% anomaly ratio.
Metric
Variants
Dataset
AS-Topology
Bitcoin-Alpha
Email-DNC
UCI Messages
Bitcoin-OTC
TAX51
DBLP
Synthetic-Hijack
AUROC
w/o DPA
53.64
62.21
66.77
58.90
70.53
44.11
49.06
60.12
w/o DPAD
40.10
45.03
47.82
50.41
54.74
48.09
45.09
47.22
w/o CDGA
63.34
69.98
72.50
60.19
74.57
60.13
55.58
70.26
w/o Wiki
60.01
53.16
67.21
52.83
48.04
46.32
50.28
67.97
w/o MOOC
55.86
60.07
53.15
60.37
62.94
56.36
46.12
58.81
TABLE III: Ablation results of different variants of OTTA-DGAD.
Fig. 4: Impact of dynamic prototype memory buffer size M , momentum α , confident detection Ncon and chunk size on the OTTA-DGAD performance .
Fig. 5: Effect of Cross-Chunk Context Enrichment and Structural-Guided Pseudo-labeling accuracy.