Research map / Graph learning / Knowledge and temporal graphs

A Generalizable Anomaly Detection Method in Dynamic Graphs

AAAI 2025 · Graph learning › Knowledge and temporal graphs · approach: Continuous-time dynamic graph learning · 15 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes GeneralDyG, which samples temporal k-hop ego-graphs around anomalous events, encodes them with a node-edge alternating GNN (TensGNN) and a temporal-aware Transformer, to detect node and edge anomalies in dynamic graphs with better generalizability.

Problem

Anomaly detection in dynamic graphs lacks generalizability across datasets and task types (node-level and edge-level), due to poor encoding of anomalous events, weak temporal capture, and high computational cost on large graphs.

Approach

Sample temporal ego-graphs around each event as tokens, insert hierarchical special tokens, encode structure with TensGNN that alternately applies node and edge message passing, and feed both raw and structure-enriched sequences into a Transformer whose query/key carry structural information and value carries event features.

Key results

• On Bitcoin-Alpha at 1% anomaly injection, GeneralDyG reaches AP 24.00 versus the best baseline's 19.99 (SAD); AUC at 10% is 96.28 vs TADDY's 94.23.
• On SWaT node-level F1, GeneralDyG reaches 85.19 vs FuSAGNet's 83.69, while on WADI it reaches 60.43 vs FuSAGNet's 60.70 (slightly lower).
• Ablations show removing TensGNN drops WADI F1 from 60.43 to 55.13 and Bitcoin-Alpha AUC from 96.28 to 92.02.

Measured effects reported in the paper

Surprising findings

• Removing the ego-graph sampling barely changes AUC on Bitcoin-Alpha (96.28 to 96.01) even though AP drops substantially.
• GeneralDyG is slightly below FuSAGNet on WADI F1 (60.43 vs 60.70).

Limitations

• Inconsistent reporting: the text says AP improvement is 19.8% and 20.2% but baseline numbers are not clearly matched; some claims (e.g., ablation AP drops) are not consistent across tables.
• Generalizability is evaluated only on four datasets across two task types, with no cross-dataset training transfer.
• Efficiency claims are not backed by measured runtime or memory results.

Experimental setup

Datasets: SWaT WADI Bitcoin-Alpha Bitcoin-OTC

Benchmarks: Bitcoin-Alpha Bitcoin-OTC SWaT WADI

Metrics: AUC AP F1

Baselines: node2vec DeepWalk TGAT TGN ADDGRAPH StrGNN TADDY SAD SLADE GDN MST-GAT FuSAGNet

Builds on: TADDY SimpleDyG StrGNN GDN

Closest papers by meaning

• ARC: A Generalist Graph Anomaly Detector with In-Context Learning (NeurIPS 2024 · similarity 0.88)
• Dynamic Spectral Graph Anomaly Detection (AAAI 2025 · similarity 0.88)
• Multi-Scale Dynamic Graph Learning for Time Series Anomaly Detection (Student Abstract) (AAAI 2024 · similarity 0.87)
• UniFORM: Towards Unified Framework for Anomaly Detection on Graphs (AAAI 2025 · similarity 0.86)
• Graph Mixture of Experts and Memory-augmented Routers for Multivariate Time Series Anomaly Detection (AAAI 2025 · similarity 0.86)
• A Deep Probabilistic Framework for Continuous Time Dynamic Graph Generation (AAAI 2025 · similarity 0.86)