GeneralDyG - A general dynamic graph anomaly detection method launched by Nanyang Technological University

What is GeneralDyG?

GeneralDyG, proposed by a research team at Nanyang Technological University, is a general dynamic graph anomaly detection method that addresses the anomaly detection problem in dynamic graph data across fields such as social networks, e-commerce, and cybersecurity. Through a temporal ego-graph sampling module, a graph neural network extraction module, and a time-aware Transformer module, it effectively tackles challenges such as diverse data distributions, difficulties in capturing dynamic features, and high computational costs. Experimental results on multiple real-world datasets show that GeneralDyG significantly outperforms several existing mainstream methods, demonstrating superior versatility and detection capabilities.

Main functions of GeneralDyG

• Adaptation to Data Distribution DiversityBy extracting key information about nodes, edges, and their topology, GeneralDyG can adapt to the complex feature distributions of different datasets.
• Dynamic feature captureThis method combines global temporal dynamics and local structural changes to deeply model multi-scale dynamic patterns in dynamic graphs.
• High-efficiency computing frameworkA lightweight framework was constructed that can efficiently capture key dynamic features and significantly improve computational efficiency.
• Time ego-graph samplingBy constructing a compact subgraph structure, the computational pressure brought by large-scale dynamic graph data can be effectively addressed.
• Fusion of structural and temporal featuresBy integrating time series and structural features using the time-aware Transformer module, the accuracy of anomaly detection is ensured.

GeneralDyG's technical principles

• Time-based ego-graph sampling moduleThis module effectively addresses the computational burden of large-scale dynamic graph data by constructing a compact subgraph structure. Based on the central event, it extracts the surrounding interaction history using the k-hop algorithm to construct a temporal ego-graph. The k-hop algorithm considers the temporal order and topological relationships between events, ensuring that the sampling process takes into account both temporal dynamics and structural characteristics. The module introduces special markers to separate interaction information at different levels, helping the Transformer module better identify and learn the hierarchical dynamics in the time series.
• Graph Neural Network Extraction ModuleBuilding upon temporal ego-graph, a novel graph neural network (TensGNN) is designed to extract rich structural information. TensGNN achieves feature propagation and updating by alternately applying node and edge layers, thereby establishing strong correlations between node and edge features. The node layer performs convolution operations using the node's adjacency matrix and a specific Laplacian matrix, while simultaneously updating the node representation based on edge features. The edge layer updates the edge feature representation based on the edge's adjacency relationship and the node's state.
• Time-aware Transformer moduleThis module integrates time series and structural features. In its self-attention mechanism, the model encodes the topological structure information of the Query and Key graphs respectively, preserving the Value as the original event feature to ensure accurate anomaly detection. Through this module, the model can effectively capture global temporal dependencies and local dynamic changes in the dynamic graph, achieving accurate modeling of complex anomaly patterns.

GeneralDyG's project address

• Github repository:https://github.com/YXNTU/GeneralDyG
• arXiv technical paper:https://arxiv.org/pdf/2412.16447

Application scenarios of GeneralDyG

• Social NetworksIn social networks, GeneralDyG can be used to detect anomalous behavior, such as the spread of spam and the identification of fake accounts. By analyzing the interactions between users and how these interactions change over time, it can effectively identify abnormal behaviors that deviate from normal social patterns.
• e-commerceIn the e-commerce sector, GeneralDyG can be used to detect fraudulent transactions. By analyzing the correlation between user transaction behavior and products, it can identify abnormal transaction patterns, helping e-commerce platforms improve transaction security and reliability.
• CybersecurityIn the area of network security, GeneralDyG can be used to detect network intrusions and abnormal traffic. By analyzing packet transmissions and connections between nodes in the network, it can promptly identify potential security threats and improve network system security.
• Financial SystemIn the financial sector, GeneralDyG can be used to detect financial fraud and unusual transaction behavior. By analyzing the flow of funds and relationships between accounts within a financial transaction network, it can identify abnormal financial activities, helping financial institutions mitigate risks.