[Paper Review] Hop-Count Based Self-Supervised Anomaly Detection on Attributed Networks

Tianjin Huang, Yulong Pei+2 more|arXiv (Cornell University)|Apr 16, 2021

Complex Network Analysis Techniques54 references4 citations

TL;DR

This paper proposes HCM, a self-supervised graph anomaly detection model for attributed networks that leverages both local and global structural context via hop-count prediction. By training a GCN-based model to predict shortest-path distances (hop counts) between node pairs and using Bayesian inference via SGLD, HCM achieves superior anomaly detection performance by identifying nodes with abnormally large hop counts to their neighbors, outperforming state-of-the-art methods on real-world datasets.

ABSTRACT

Recent years have witnessed an upsurge of interest in the problem of anomaly detection on attributed networks due to its importance in both research and practice. Although various approaches have been proposed to solve this problem, two major limitations exist: (1) unsupervised approaches usually work much less efficiently due to the lack of supervisory signal, and (2) existing anomaly detection methods only use local contextual information to detect anomalous nodes, e.g., one- or two-hop information, but ignore the global contextual information. Since anomalous nodes differ from normal nodes in structures and attributes, it is intuitive that the distance between anomalous nodes and their neighbors should be larger than that between normal nodes and their neighbors if we remove the edges connecting anomalous and normal nodes. Thus, hop counts based on both global and local contextual information can be served as the indicators of anomaly. Motivated by this intuition, we propose a hop-count based model (HCM) to detect anomalies by modeling both local and global contextual information. To make better use of hop counts for anomaly identification, we propose to use hop counts prediction as a self-supervised task. We design two anomaly scores based on the hop counts prediction via HCM model to identify anomalies. Besides, we employ Bayesian learning to train HCM model for capturing uncertainty in learned parameters and avoiding overfitting. Extensive experiments on real-world attributed networks demonstrate that our proposed model is effective in anomaly detection.

Motivation & Objective

• Address the limitations of existing unsupervised anomaly detection methods on attributed networks, which often rely only on local neighborhood information and lack supervisory signals.
• Overcome the poor performance of purely unsupervised methods by introducing a self-supervised learning task based on predicting shortest-path distances (hop counts).
• Integrate both local and global structural context to improve anomaly detection by capturing the intuitive idea that anomalous nodes are structurally farther from normal neighbors.
• Utilize Bayesian learning with Stochastic Gradient Langevin Dynamics (SGLD) to model uncertainty and prevent overfitting in the absence of ground-truth labels.
• Develop novel anomaly scores based on predicted hop counts to effectively distinguish anomalous nodes from normal ones.

Proposed method

• Design a self-supervised learning task where the model predicts the shortest-path length (hop count) between pairs of nodes in the graph.
• Use a Graph Convolutional Network (GCN) to learn node representations that encode both local and global structural information.
• Train the model to predict hop counts between node pairs using a contrastive learning objective derived from the self-supervised task.
• Introduce two anomaly scores: one based on the average predicted hop count to neighbors (S_AHP), and another based on the maximum deviation (SHAV), to detect structural and attribute anomalies.
• Apply Bayesian learning via Stochastic Gradient Langevin Dynamics (SGLD) to optimize the model, enabling uncertainty estimation and improved generalization.
• Preprocess the graph by randomly dropping low-similarity edges with a controllable drop ratio R to enhance the model's robustness to noise and improve anomaly detection.

Experimental results

Research questions

• RQ1 Can a self-supervised learning task based on hop-count prediction effectively capture both local and global structural context for anomaly detection in attributed networks?
• RQ2 How does incorporating global structural context—beyond immediate neighborhoods—improve the detection of structural and attribute-based anomalies?
• RQ3 To what extent does Bayesian learning with SGLD enhance model robustness and generalization in the absence of labeled anomalies?
• RQ4 How sensitive is the performance of the HCM model to key hyperparameters such as drop ratio, number of hop-count classes, and sampling ratio?
• RQ5 Does the proposed anomaly scoring mechanism based on predicted hop counts outperform existing methods in detecting diverse anomaly types?

Key findings

• HCM consistently outperforms state-of-the-art unsupervised anomaly detection methods on real-world attributed networks, including ACM, BlogCatalog, and Flickr.
• The use of SGLD for Bayesian optimization leads to better and more stable anomaly detection performance compared to standard SGD, as shown by higher and steadier ROC-AUC trends during training.
• Removing a small fraction of low-similarity edges (drop ratio R ≈ 0.2–0.3) improves detection performance on BlogCatalog and Flickr, indicating that noise reduction enhances model generalization.
• Increasing the number of hop-count classes C improves performance, especially on Flickr and BlogCatalog, confirming the value of global structural context.
• The sampling ratio S has minimal impact on performance, indicating the model is robust to variations in training batch size and data sampling.
• The anomaly scores S_AHP and SHAV, derived from predicted hop counts, effectively identify both structural and attribute-based anomalies, as validated in the toy example and real-world experiments.