[Paper Review] GraphSAC: Detecting anomalies in large-scale graphs

Vassilis N. Ioannidis, Dimitris Berberidis+1 more|arXiv (Cornell University)|Oct 21, 2019

Complex Network Analysis Techniques29 references22 citations

TL;DR

GraphSAC is a scalable, sampling-based anomaly detection framework for large-scale attributed graphs that uses graph-aware consensus to filter contaminated node subsets before applying semi-supervised learning (SSL) to estimate nominal class distributions. By minimizing reliance on potentially compromised global attributes and links, GraphSAC achieves robust anomaly detection, outperforming state-of-the-art methods in detecting random walk-based, clustered, and adversarial anomalies with linear per-draw complexity and strong theoretical guarantees.

ABSTRACT

A graph-based sampling and consensus (GraphSAC) approach is introduced to effectively detect anomalous nodes in large-scale graphs. Existing approaches rely on connectivity and attributes of all nodes to assign an anomaly score per node. However, nodal attributes and network links might be compromised by adversaries, rendering these holistic approaches vulnerable. Alleviating this limitation, GraphSAC randomly draws subsets of nodes, and relies on graph-aware criteria to judiciously filter out sets contaminated by anomalous nodes, before employing a semi-supervised learning (SSL) module to estimate nominal label distributions per node. These learned nominal distributions are minimally affected by the anomalous nodes, and hence can be directly adopted for anomaly detection. Rigorous analysis provides performance guarantees for GraphSAC, by bounding the required number of draws. The per-draw complexity grows linearly with the number of edges, which implies efficient SSL, while draws can be run in parallel, thereby ensuring scalability to large graphs. GraphSAC is tested under different anomaly generation models based on random walks, clustered anomalies, as well as contemporary adversarial attacks for graph data. Experiments with real-world graphs showcase the advantage of GraphSAC relative to state-of-the-art alternatives.

Motivation & Objective

• To address the vulnerability of existing graph anomaly detection methods that rely on global node attributes and connections, which can be compromised by adversaries.
• To develop a scalable, efficient, and robust method for detecting anomalies in large-scale attributed graphs under adversarial conditions.
• To estimate nominal class distributions per node that are minimally affected by anomalous nodes through a consensus-based sampling strategy.
• To provide theoretical performance guarantees on the number of required draws for reliable anomaly detection.
• To demonstrate superior detection performance on real-world graphs under diverse anomaly models, including clustered and adversarial attacks.

Proposed method

• GraphSAC randomly samples subsets of nodes from the graph to avoid reliance on potentially corrupted global information.
• It applies graph-aware filtering criteria to discard subsets containing anomalous nodes, ensuring only 'clean' samples are used for learning.
• A semi-supervised learning (SSL) module is applied to each filtered subset to estimate a nominal class distribution per node.
• The method leverages the principle that anomalous nodes will exhibit poor predictive performance in SSL tasks, enabling their identification.
• The number of required draws is theoretically bounded using concentration inequalities, ensuring convergence with high probability.
• Draws are computationally efficient (linear in number of edges) and can be parallelized, enabling scalability to large graphs.

Experimental results

Research questions

• RQ1 Can a sampling-based approach effectively detect anomalies in large-scale attributed graphs when node attributes and links are subject to adversarial corruption?
• RQ2 How can graph-aware filtering of sampled subsets improve the robustness of semi-supervised learning for anomaly detection?
• RQ3 What theoretical bounds can be established on the number of random draws required for reliable anomaly detection in the presence of adversarial contamination?
• RQ4 How does GraphSAC perform compared to state-of-the-art methods under diverse anomaly generation models, including random walks and clustered anomalies?
• RQ5 To what extent does GraphSAC maintain performance and efficiency under adversarial attacks targeting graph data?

Key findings

• GraphSAC achieves state-of-the-art AUC performance on benchmark graphs, with 0.88 AUC on Citeseer and 0.97 on Cora for detecting clustered anomalies, significantly outperforming baselines like GAE (0.50 and 0.58) and AMEN (0.10 and 0.48).
• In random walk-based anomaly detection, GraphSAC maintains high AUC (e.g., ~0.90 on Citeseer) even as the number of anomalous nodes increases, while performance of competitors degrades.
• GraphSAC is significantly faster than competing methods, with runtime performance orders of magnitude better on large graphs, due to linear per-draw complexity and parallelizability.
• The method remains robust even when contaminated samples contain up to 83 anomalous nodes, as the maximum number of anomalies in misclassified samples (Kₘ) is substantially lower than the total, preserving overall AUC.
• GraphSAC's performance is stable across different values of the consensus threshold T and number of iterations I, indicating low sensitivity to hyperparameter settings.
• Theoretical analysis confirms that GraphSAC requires a bounded number of draws to achieve reliable anomaly detection, with convergence guaranteed under mild assumptions.