用图模型检测群体异常，少标注也能准识别。
GFM4GA: Graph Foundation Model for Group Anomaly Detection
- 双层对比学习预训练，捕捉群体结构与特征不一致
- 少样本设置下，AUROC提升2.85%，AUPRC提升2.55%
- 适合小样本、未见群体异常检测场景
群体异常检测在众多网络应用中至关重要，但因异常模式多样而面临挑战。受大语言模型成功的启发，图基础模型（GFMs）被提出以降低标注成本，适用于少样本学习。尽管GFMs在个体异常检测中表现良好，却难以推广至群体异常，因为群体异常需整体识别，且异常组内个体可能看似正常。为此，本文提出GFM4GA，一种新型图基础模型用于群体异常检测。该模型通过基于特征估计和群体提取的双层对比学习进行预训练，以捕捉潜在的群体异常结构与特征不一致性。在下游任务中，模型在参数受限且按群体异常比例加权的少样本设置下微调，并利用已标记异常邻居确定的群体上下文，增强对未见群体异常的适应能力。实验表明，GFM4GA优于现有群体异常检测器及个体异常检测的图基础模型，在平均AUROC上提升2.85%，在平均AUPRC上提升2.55%。
原文摘要 · Abstract (English)
Group anomaly detection is crucial in many network applications, but faces challenges due to diverse anomaly patterns. Motivated by the success of large language models (LLMs) in natural language processing, graph foundation models (GFMs) is proposed to handle few-shot learning task with fewer labeling efforts. GFMs have been successfully applied to detection of individual anomalies but cannot be generalized to group anomalies, as group anomaly patterns must be detected as a whole and individuals in an abnormal group can look rather normal. Therefore, we propose GFM4GA, a novel graph foundation model for group anomaly detection. The pipeline is pretrained via dual-level contrastive learning based on feature-based estimation and group extraction, to capture potential group anomaly structure and feature inconsistencies. In the downstream tasks, the pipeline is finetuned in parameter-constrained and group-anomaly-proportion weighted few-shot settings, and its adaptive ability to unseen group anomalies expanded via group contexts determined by labeled anomaly neighbors. Experiments show that GFM4GA surpasses group anomaly detectors and GFMs for individual anomalies, achieving average improvements of 2.85% in AUROC and 2.55% in AUPRC.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。