零样本跨域图异常检测新框架,无需训练即可识别未知图数据中的异常。
OWLEYE: Zero-Shot Learner for Cross-Domain Graph Data Anomaly Detection
- 通过特征对齐保留领域语义,实现跨域图数据统一表征
- 构建多模式字典学习机制,捕捉共享结构与属性模式
- 基于截断注意力重建,支持无标签数据的上下文学习
图数据能有效表示账户间交易、设备间通信、机器或流程间依赖等复杂关系。相应地,图异常检测(GAD)在金融、网络安全、制造等领域对识别异常至关重要。面对大规模、多领域的图数据,现有研究尝试构建无需重训练即可检测未见图数据异常的基础通用模型。然而,跨域图数据在特征语义和维度上的差异严重阻碍了图基础模型的发展,持续学习与推理能力仍属开放问题。为此,本文提出OWLEYE,一种新型零样本GAD框架,通过多图学习可迁移的正常行为模式,具有三重贡献:首先,提出跨域特征对齐模块,在对齐过程中保留领域特异性语义;其次,利用对齐特征设计多领域多模式字典学习,编码共享的结构与属性模式;第三,开发截断注意力重建模块,实现上下文学习能力,无需标注数据即可鲁棒检测未见图结构数据中的异常。在真实世界数据集上的大量实验表明,相比现有最优基线,OWLEYE展现出更优性能与泛化能力,为可扩展、低标注成本的异常检测奠定了坚实基础。
原文摘要 · Abstract (English)
Graph data is informative to represent complex relationships such as transactions between accounts, communications between devices, and dependencies among machines or processes. Correspondingly, graph anomaly detection (GAD) plays a critical role in identifying anomalies across various domains, including finance, cybersecurity, manufacturing, etc. Facing the large-volume and multi-domain graph data, nascent efforts attempt to develop foundational generalist models capable of detecting anomalies in unseen graphs without retraining. To the best of our knowledge, the different feature semantics and dimensions of cross-domain graph data heavily hinder the development of the graph foundation model, leaving further in-depth continual learning and inference capabilities a quite open problem. Hence, we propose OWLEYE, a novel zero-shot GAD framework that learns transferable patterns of normal behavior from multiple graphs, with a threefold contribution. First, OWLEYE proposes a cross-domain feature alignment module to harmonize feature distributions, which preserves domain-specific semantics during alignment. Second, with aligned features, to enable continuous learning capabilities, OWLEYE designs the multi-domain multi-pattern dictionary learning to encode shared structural and attribute-based patterns. Third, for achieving the in-context learning ability, OWLEYE develops a truncated attention-based reconstruction module to robustly detect anomalies without requiring labeled data for unseen graph-structured data. Extensive experiments on real-world datasets demonstrate that OWLEYE achieves superior performance and generalizability compared to state-of-the-art baselines, establishing a strong foundation for scalable and label-efficient anomaly detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。