WhENDS: Dynamic Graph Anomaly Detection

• WhENDS is an unsupervised anomaly detection method that mitigates false positives by aligning normal edge embeddings via a whitening transformation under Normality Distribution Shift (NDS).
• It employs a GNN-LSTM hybrid for spatial-temporal encoding and an NSEM with GRU to estimate and track time-dependent normal statistics accurately.
• Empirical evaluations on benchmarks demonstrate state-of-the-art performance, showing significant gains at low anomaly rates and under severe distribution drift.

Searching arXiv for the specified WhENDS paper and closely related work to ground the article in current literature. WhENDS is an unsupervised anomaly detection method for dynamic graphs designed to address Normality Distribution Shift (NDS), a setting in which normal behavior evolves over time rather than remaining stationary. Introduced in "Robust Anomaly Detection Under Normality Distribution Shift in Dynamic Graphs" (Xu et al., 22 Sep 2025), WhENDS aligns normal edge-embedding distributions across timestamps by estimating distributional statistics and applying whitening transformations. Its central objective is to prevent naturally shifted but still normal instances from being misclassified as anomalies, a failure mode that arises when dynamic-graph anomaly detectors implicitly assume temporal stationarity.

1. Definition and problem setting

Dynamic graphs represent evolving interactions among entities and arise in social networks, e-commerce, and cybersecurity (Xu et al., 22 Sep 2025). In this setting, anomaly detection seeks to identify edges or nodes whose behavior deviates from normal patterns. The distinguishing premise of WhENDS is that the normal distribution itself may change over time, rather than remaining fixed.

The paper formalizes this phenomenon as Normality Distribution Shift (NDS). At two different timestamps, $t_1 \neq t_2$, the normal-edge distributions may differ:

$$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$

This formulation captures cases in which new interaction patterns become normal because of temporal evolution rather than because they are anomalous. The motivating example given in the paper is that two user groups may not interact in training data but may later begin interacting naturally; a detector that ignores NDS may then flag these newly normal inter-group edges as anomalous (Xu et al., 22 Sep 2025).

WhENDS addresses this problem by aligning the distributions of normal edge embeddings across time. The method is therefore not merely an anomaly scorer; it is a distribution-alignment framework inserted between representation learning and anomaly scoring. This distinction is central to its design.

2. Normality Distribution Shift as a failure mode

Most existing methods considered in the paper assume that normal patterns remain stable over time (Xu et al., 22 Sep 2025). Under NDS, that assumption breaks down. As a result, shifted normal instances can be confused with outliers, which degrades detection performance.

The paper’s intervention is to model the distribution of normal edge embeddings at each timestamp and then map those distributions to a common reference distribution. Concretely, WhENDS uses a whitening transformation so that normal edge embeddings at each time are aligned toward a standard multivariate Gaussian. This creates a representation space in which temporal drift in normal behavior is attenuated, allowing the downstream anomaly detector to focus on genuinely abnormal edges rather than on distributional drift (Xu et al., 22 Sep 2025).

A common misconception is that NDS is equivalent to anomaly occurrence. WhENDS is built around the opposite view: temporal change in normal behavior is a structural property of many dynamic graphs and should be normalized away before anomaly scoring. This suggests that the method is particularly suited to domains in which evolving normality is expected rather than exceptional.

3. Architecture and core mechanism

WhENDS consists of four main stages at each timestamp: a spatial-temporal encoder, a Normal Statistic Estimation Module (NSEM), a whitening transformation, and an anomaly detector (Xu et al., 22 Sep 2025).

Component	Role
Spatial-Temporal Encoder	Produces edge embeddings from graph snapshots
NSEM	Estimates mean and covariance of normal edge embeddings
Whitening Transformation	Aligns normal embeddings toward $\mathcal{N}(0, I)$
Anomaly Detector	Assigns anomaly scores from whitened embeddings

The spatial-temporal encoder is described as a GNN-LSTM hybrid that captures both structural and temporal information (Xu et al., 22 Sep 2025). It outputs node embeddings $\boldsymbol{z}_i^t$, from which edge embeddings are formed by simple addition:

$$\boldsymbol{z}_{ij}^t = \boldsymbol{z}_i^t + \boldsymbol{z}_j^t.$$

WhENDS then assumes that normal edge embeddings at timestamp $t$ follow a multivariate Gaussian:

$$\boldsymbol{z}_{ij}^t \mid \text{normal} \sim \mathcal{N}(\boldsymbol{\mu}_{\text{norm}}^t, \boldsymbol{\Sigma}_{\text{norm}}^t).$$

Because the test-time collection of edges is contaminated by anomalies, the normal statistics are not directly observable. The NSEM therefore takes the statistics of all edge embeddings at time $t$, predicts the deviation between all-edge statistics and normal-only statistics, and recovers estimated normal statistics. The module uses an MLP together with a GRU so that statistic estimation can track gradual temporal evolution (Xu et al., 22 Sep 2025).

The estimated normal statistics are then used to whiten each edge embedding:

$$\tilde{\boldsymbol{z}}_{ij}^t = (\hat{\boldsymbol{\Sigma}}_{\text{norm}}^t)^{-\frac{1}{2}} \left( \boldsymbol{z}_{ij}^t - \hat{\boldsymbol{\mu}}_{\text{norm}}^t \right).$$

In the aligned space, normal embeddings are intended to approximate $\mathcal{N}(0, I)$. The anomaly detector then operates on the whitened embedding:

$$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$0

where $$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$1 is an MLP and $$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$2 is the sigmoid function (Xu et al., 22 Sep 2025).

The method’s novelty lies not in replacing graph representation learning wholesale, but in inserting a temporally adaptive normalization stage that explicitly targets NDS.

4. Statistic estimation, whitening, and training

The statistic-estimation stage is the technical core of WhENDS. At each timestamp, the mean and covariance of all edge embeddings are computed as

$$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$3

$$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$4

The NSEM receives these contaminated statistics and predicts deviations $$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$5 and $$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$6, from which the normal statistics are recovered as

$$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$7

$$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$8

During training, the paper uses the fact that all training edges are normal, so $$\mathcal{D}_\mathrm{norm}^{t_1} \neq \mathcal{D}_\mathrm{norm}^{t_2}.$$9, and then injects synthetic anomalies to simulate test-time contamination (Xu et al., 22 Sep 2025). This allows the NSEM to learn how to reconstruct clean normal statistics from mixed observations. Temporal modeling is incorporated through a GRU that consumes the evolving sequence of estimated parameters, enabling the estimator to track time-dependent drift.

The training process is unsupervised in the sense that no true anomaly labels are assumed. Instead, pseudo-anomalies are generated by negative sampling, including random edge insertion or rewiring, and the detector is trained with binary cross-entropy (Xu et al., 22 Sep 2025). The paper also lists a statistics loss for NSEM, a reconstruction loss for the encoder, and a BCE loss for the anomaly detector.

A common misunderstanding would be to treat whitening here as a generic preprocessing heuristic. In WhENDS, whitening is conditioned on estimated normal statistics at each timestamp, and its purpose is specifically to neutralize the effect of temporal drift in the normal class.

5. Empirical evaluation

WhENDS is evaluated on four widely used dynamic-graph benchmarks: UCI Messages, Digg, Bitcoin-Alpha, and Bitcoin-OTC (Xu et al., 22 Sep 2025). These datasets represent, respectively, online student communications, a social news platform, and trust networks.

The evaluation metric is AUC-ROC, and synthetic anomalies are injected into test splits at 1%, 5%, and 10% rates (Xu et al., 22 Sep 2025). The comparison set includes classical anomaly scoring methods, graph embedding approaches, and deep anomaly detection methods. The paper states that WhENDS consistently outperforms nine strong baselines and achieves state-of-the-art results across the four datasets (Xu et al., 22 Sep 2025).

The reported gains are especially notable at low anomaly rates and under more severe NDS. On UCI Messages, the paper reports gains of up to 5.38% (Xu et al., 22 Sep 2025). The ablation study shows that removing NSEM significantly degrades performance, which the authors interpret as evidence that distributional alignment is a substantive contributor rather than an incidental regularizer.

The paper further reports that WhENDS remains robust as artificial shift intensity increases, whereas baseline models degrade sharply (Xu et al., 22 Sep 2025). This empirical pattern is consistent with the method’s stated purpose: robustness to evolving normality rather than merely improved separation under stationary conditions.

6. Applications, interpretation, and limitations

The paper positions WhENDS as particularly relevant to settings in which normal behavior is non-stationary and labeled anomalies are scarce (Xu et al., 22 Sep 2025). The cited application domains are social networks, e-commerce, and cybersecurity, all of which can exhibit benign but substantial temporal drift.

Its practical significance lies in reducing the need to reinterpret every change in graph behavior as suspicious. In social networks, evolving interaction patterns may reflect normal social expansion; in e-commerce, changes may reflect shifting purchasing habits; in cybersecurity, benign traffic patterns may change over time without implying attacks (Xu et al., 22 Sep 2025). WhENDS is intended to separate such drift from genuine anomalies.

Several limitations are implicit in the formulation. The method assumes that normal edge embeddings can be modeled by a multivariate Gaussian at each timestamp, and its alignment step depends on accurate mean and covariance estimation. This suggests that performance may depend on how well that approximation captures the geometry of the normal class. Likewise, the approach relies on synthetic anomaly injection during training and on pseudo-anomaly generation through negative sampling (Xu et al., 22 Sep 2025). A plausible implication is that the realism of these synthetic perturbations may influence how well the estimator and detector transfer to deployment conditions.

WhENDS should therefore be understood as a method for distribution-aware anomaly detection under drift, not as a universal replacement for all dynamic-graph detectors. Its contribution is the explicit treatment of NDS as a first-class modeling problem.

7. Position within dynamic-graph anomaly detection

WhENDS occupies a specific methodological position within dynamic-graph anomaly detection: it retains standard components such as graph representation learning and anomaly scoring, but inserts an explicit mechanism for aligning normal distributions across time (Xu et al., 22 Sep 2025). The paper presents this as a response to an overlooked assumption in much prior work, namely that normality is stationary.

This positioning is important because it reframes anomaly detection under temporal drift as a two-part problem: first estimate what normality looks like at each timestamp, then compare candidate edges only after distributional alignment. The resulting system emphasizes normal-statistic recovery, whitening-based alignment, and unsupervised training with pseudo-anomalies rather than direct scoring on raw temporal embeddings.

The broader implication is that temporal robustness can be achieved not only by better encoders, but also by modeling the evolution of the normal class itself. In that sense, WhENDS formalizes a principled answer to a recurrent ambiguity in dynamic graphs: whether novelty reflects anomaly or merely the latest state of normal behavior (Xu et al., 22 Sep 2025).