UniGAD: Unifying Multi-level Graph Anomaly Detection (2411.06427v1)

Abstract: Graph Anomaly Detection (GAD) aims to identify uncommon, deviated, or suspicious objects within graph-structured data. Existing methods generally focus on a single graph object type (node, edge, graph, etc.) and often overlook the inherent connections among different object types of graph anomalies. For instance, a money laundering transaction might involve an abnormal account and the broader community it interacts with. To address this, we present UniGAD, the first unified framework for detecting anomalies at node, edge, and graph levels jointly. Specifically, we develop the Maximum Rayleigh Quotient Subgraph Sampler (MRQSampler) that unifies multi-level formats by transferring objects at each level into graph-level tasks on subgraphs. We theoretically prove that MRQSampler maximizes the accumulated spectral energy of subgraphs (i.e., the Rayleigh quotient) to preserve the most significant anomaly information. To further unify multi-level training, we introduce a novel GraphStitch Network to integrate information across different levels, adjust the amount of sharing required at each level, and harmonize conflicting training goals. Comprehensive experiments show that UniGAD outperforms both existing GAD methods specialized for a single task and graph prompt-based approaches for multiple tasks, while also providing robust zero-shot task transferability. All codes can be found at https://github.com/lllyyq1121/UniGAD.

• The paper introduces UniGAD, which unifies anomaly detection at node, edge, and graph levels using the MRQSampler and GraphStitch Network.
• The research demonstrates robust performance across 14 datasets and superior zero-shot task transferability compared to existing methods.
• The framework enables cross-level information sharing, offering practical solutions for real-world applications like fraud detection, network security, and social media monitoring.

Analysis and Evaluation of "UniGAD: Unifying Multi-level Graph Anomaly Detection"

The presented paper contributes a significant advancement in the field of Graph Anomaly Detection (GAD) through the introduction of UniGAD, a framework designed to address the anomalies at node, edge, and graph levels cohesively. The research underscores the importance of identifying and leveraging the inherent connections between various anomaly types within graph-structured data, an aspect often overlooked by existing methodologies focused on single-object types.

Core Contributions

The authors propose the Maximum Rayleigh Quotient Subgraph Sampler (MRQSampler) and a novel GraphStitch Network as the cornerstones of UniGAD. These components are engineered to address the core challenges in multi-level GAD:

1. Unifying Multi-level Formats: MRQSampler addresses the challenge of transforming tasks of different types into uniform graph-level tasks. It operates by maximizing the accumulated spectral energy in sampled subgraphs, theoretically guaranteeing the retention of critical anomaly information. The sampler effectively converts node-level and edge-level tasks into graph-level tasks by focusing on subgraphs that contain anomalous nodes and edges.
2. Unifying Multi-level Training: The GraphStitch Network is employed to manage and optimize training across multiple levels. It enables information sharing across node, edge, and graph tasks without undermining individual task effectiveness. The network achieves this through the innovative GraphStitch Unit, harmonizing different training goals while maintaining the benefits of multi-task learning.

Experimental Evaluation

The paper's robust experimental framework across 14 datasets, encompassing both single-graph and multi-graph datasets, illustrates the effectiveness of UniGAD. The authors meticulously compare UniGAD with nine node-level, nine edge-level, and six graph-level anomaly detection methods, alongside two multi-task learning frameworks. The comprehensive evaluations demonstrate UniGAD's superior performance in multi-level anomaly detection tasks and further highlight its ability in zero-shot task transferability.

UniGAD demonstrates the ability to capture and utilize cross-level correlations effectively. For instance, its performance on large datasets like MNIST0 and MNIST1 showcases the advantages of leveraging strong node-level detection capability to enhance graph-level performance. However, on smaller datasets, the model's graph-level structural comprehension appears limited, an area potentially attributable to the node-level focused backbone models that UniGAD builds upon.

In scenarios involving zero-shot learning, UniGAD notably surpasses existing multi-task models, providing compelling evidence of its transferability across graph anomaly detection tasks. This flexibility underscores UniGAD's potential applicability in diverse real-world GAD scenarios.

Theoretical and Practical Implications

Theoretically, this research sheds light on the interplay between spectral energy distributions and anomaly detection across different graph levels. By maximizing the Rayleigh quotient, UniGAD aligns its subgraph sampling with spectral properties indicative of anomalies, offering a quantitative metric for anomaly assessment in graphs.

Practically, UniGAD provides a versatile tool for industries reliant on detecting anomalies within graph data—ranging from financial fraud detection, social media surveillance, to network security. The framework’s adaptability to various anomaly types without the need for extensive retraining renders it a practical solution for dynamic, complex environments.

Future Directions

Future exploration could address the limitations related to graph-level feature representations by integrating multi-level tasks directly into the pre-training phase. Moreover, expanding UniGAD's utility across increasingly complex graph data types and investigating its optimization within diverse computational environments could further refine its performance and applicability.

In summary, the UniGAD framework pioneers a unified approach to multi-level GAD, marked by robust experimental validation and potential for substantial practical impact, while laying the groundwork for future innovations in anomaly detection across graph-structured domains.