Enhanced Graph Autoencoder for Graph Anomaly Detection Using Subgraph Information

Abstract

Graph anomaly detection aims at identifying rare, unusual entities in attributed networks with respect to their patterns or structures that deviate significantly from the majority within a graph. Over the years, extensive efforts in this field have been dedicated to the powerful capability of attributed networks to model real-world systems. Given the scarcity of labeled anomalies, current research primarily emphasizes model design via unsupervised learning. Graph autoencoders have been widely utilized for such purposes, leveraging the outstanding capabilities of Graph Neural Networks to model graph structured data. However, most existing graph autoencoder-based anomaly detectors do not exploit the nodes’ local subgraph information, limiting their ability to comprehensively understand the network for better representation learning. Moreover, these methods place greater emphasis on the attribute reconstruction process while neglecting the structure reconstruction aspect. This paper proposes an enhanced graph autoencoder framework for graph anomaly detection tasks that incorporates a subgraph extraction and aggregation preprocessing stage to utilize the nodes’ local topological information for enhanced embedding generation and to induce an additional node–subgraph view through model learning. A graph structure learning-based decoder is introduced as the structure decoder for better relationship learning. Finally, during the anomaly scoring stage, a node neighborhood selection technique is applied to enhance the detection performance. The effectiveness of the proposed framework is demonstrated through comprehensive experiments conducted on six commonly used real-world datasets.

1. Introduction

Graph anomaly detection aims to identify objects that behave significantly differently from the majority of objects in the graph, with respect to their attributes and structures. Due to the widespread use of graph-structured data in modeling real-life systems, studies on graph anomaly detection have garnered increasing attention with applications in a range of fields, such as social activity analysis, e-commerce safety monitoring, and traffic analysis. However, anomalous entities are typically characterized by their rarity in number and high variability in patterns, which has motivated the development of automatic deep learning algorithms for this detection task. Due to the scarcity of ground-truth anomaly labels in real-world datasets, current studies on graph anomaly detection tend to adopt unsupervised learning, and graph autoencoder-based frameworks have been widely applied for representation learning and anomaly identification. However, these models utilize only the node attribute information, and addressing the limitations in capturing local and structural information to achieve better detection performance remains a challenging task [1]. The primary purpose of this study is to propose an improved graph autoencoder-based framework capable of effectively handling the challenges present in current frameworks, through the introduction of the following improvements: (1) a subgraph preprocessing stage to aggregate the nodes’ local topological subgraph topological information and generate enhanced embeddings; (2) a graph structure learning module for improved graph structure reconstruction in the decoding stage; and (3) a neighborhood selection method for better anomaly scoring ability. The goal is to consistently outperform state-of-the-art graph anomaly detection models when evaluated on real-world datasets.

Inspired by recent developments in Graph Neural Network frameworks that incorporate the use of subgraph information and multi-view learning, this paper proposes a subgraph preprocessing stage designed to extract and aggregate subgraph-level topological information, alongside the original node attributes. This enhanced attribute input is intended to strengthen the node representation learning capability of the proposed graph autoencoder-based model. Furthermore, an additional node–subgraph view is introduced to inject more structural information into the learned embeddings, thereby augmenting the model’s understanding of the attributed networks. In the decoder phase, the proposed model employs a neural-based graph structure learning technique within the structure decoder to improve the reconstruction of node relationships based on the learned representations. Finally, a specially designed neighborhood selection method is introduced to provide better performance in the anomaly scoring stage after training.

2. Backgrounds

2.1. Graph Neural Networks

In recent years, Graph Neural Networks (GNNs) have experienced rapid development and emerged as a deep learning architecture widely applied in modeling and learning non-Euclidean data with applications in various fields, including social network analysis [2], drug discovery [3], and traffic network analysis [4]. Currently, most GNN frameworks can be categorized as either spectral-based [5] or spatial-based [6]. Spectral-based methods utilize the Laplacian spectrum to define graph convolution, and the graph convolutional operation is performed in the spectral domain. In contrast, spatial-based methods define graph convolution as a message-passing process, updating node representations by aggregating their neighborhood representations. Since the introduction of the Graph Convolutional Neural Network (GCN) [7], which interrelates the spectral- and spatial-based methods, various GNN models have been proposed, including GAT [8], GraphSAGE [9], and GIN [10]. Due to their high flexibility and efficiency, these models have achieved noticeable success in various application domains recently. Moreover, the graph autoencoder [11] has been proposed as an extension of traditional autoencoders for unsupervised learning on graph-structured data. The model aims to embed node attributes in a low-dimensional vector space using a multi-layered GCN encoder. The training task is set to reconstruct the original graph topology, represented as an adjacency matrix, through a structure decoder with the encoded latent representations.

2.2. Graph Anomaly Detection

Anomaly detection is a data mining task that aims to identify rare and unusual observations, such as data points and events that differ significantly from the standard, expected, and typical majorities in the dataset. Although infrequent in real-world situations, these objects carry critical information that is worth noticing to prevent adverse effects and maintain the safety and stability of the system. Examples of real-world anomalies may include fraudsters in financial transactions [12], fake news over the internet [13], unreliable reviews on websites [14], social bots [15], and network intruders [16]. Conventional approaches for anomaly detection focus on transforming real-world objects into feature vectors and then identifying the anomalous data points as deviating outliers using techniques based on clustering [17,18], classification [19], nearest neighbor [20], and more. However, in addition to their attribute information, real-world objects usually contain rich relational information about each other that can provide valuable insights for anomaly detection. For example, in a social network, users have rich profile information and are connected with each other through various types of relationships. Hence, attributed networks have been widely utilized to study a more complex anomaly detection problem in non-Euclidean space, known as graph anomaly detection; an attributed network is a powerful tool that can encode a set of attributes for each node alongside a graph topology representing the relationships among the nodes. This field of research aims to detect abnormal entities within the graph from both structure and attribute perspectives. Structure anomalies are abnormal entities characterized by their links to uncorrelated neighbors, while attribute anomalies refer to entities that exhibit mismatched attributes with all their neighbors.

In recent years, with their rapid growth and outstanding capability in learning over graph-structured data, a wide range of GNN-based graph anomaly detection frameworks have been proposed, demonstrating notable achievements. Due to the prohibitive cost of accessing ground-truth anomaly labels in real-world applications, existing graph anomaly detection models are mostly unsupervised learning-based or semi-supervised learning-based. ANOMALOUS [21], Radar [22], and ResGCN [23] employ residual analysis to measure pattern deviation in nodes, used as the indicator for the level of anomaly. DOMINANT [24] and AnomalyDAE [25] employ GCN-based autoencoders to learn node representations through neighboring nodes’ representation aggregation and to reconstruct both the attribute and structure information simultaneously. Then, node abnormality is ranked according to their reconstruction errors. The ComGA model [1] extends DOMINANT [24] with extra graph community information to achieve better structural anomaly detection performance. CoLA [26] and ANEMONE [27] utilize a contrastive self-supervised design by generating positive and negative random-walk subgraphs around target nodes to detect anomalies effectively. Finally, OCGNN [28] and AAGNN [29] combine a GCN with hypersphere learning to encode normal instances within a hypersphere while keeping anomalies outside the hypersphere.

2.3. Graph Structure Learning

Despite their powerful capability in learning discriminative embeddings for graph structured data, GNNs tend to suffer from the noisy or incomplete graph structures commonly found in real-world datasets, which can hinder their performance [30]. With the message-passing scheme, noise within the graph is propagated to further layers of nodes in the graph and amplified through the aggregation process. Furthermore, an incomplete or incorrect graph structure can prevent the GNN model’s ability to discover critical structural connections among nodes, impeding its capacity to gather useful information and generate optimal node representations. Prior research has demonstrated that even small alterations to the graph structure can significantly impact the learning capabilities of GNNs [31,32].

The graph structure learning (GSL) method was introduced to address such limitations by aiming to unveil latent graph structures within data. Metric-based graph structure learning approaches measure node similarities by calculating the inner product [33] or cosine similarity [34] of their attributes and construct the adjacency matrix accordingly. Neural-based approaches seek to design deep neural network models to learn the adjacency matrix as a representation of the graph topology. Among them, MTGNN [4] is a representative framework that employs two Fully Connected Neural Networks to embed node representations and model the adjacency matrix, and then identifies the top-k values in each row as neighbors. Another approach involves parameterizing the graph structure under the assumption that the adjacency matrix is sampled from a specific distribution, such as the Bernoulli distribution. Therefore, the values in the adjacency matrix can be sampled from the distribution, which is parameterized by a learnable parameter denoted as θ [35].

3. Proposed Method

3.1. Problem Definition

The commonly used notations throughout this paper are summarized in

Table 1. Notations.

Notation	Description
n	Number of nodes in the graph.
d	Attribute dimension.
G	Attributed graph.
V = {v1, v2, …, vn}	Set of n nodes in the graph.
E	Set of m edges in the graph.
X $\in {\mathbb{R}}^{n \times d}$	Attribute matrix for nodes in the graph.
Xi $\in {\mathbb{R}}^d$	Attribute information for node vi
A $\in {\mathbb{R}}^{n \times n}$	Adjacency matrix of the graph.
I	Identity matrix.
${‖·‖}_{\mathit{F}}$	Frobenius Norm. ${‖\mathit{A}‖}_{\mathit{F}}=\sqrt{{\sum }_{\mathit{i}=1}^{\mathit{m}}{\sum }_{\mathit{j}=1}^{\mathit{n}}{\left|{\mathit{a}}_{\mathit{i},\mathit{j}}\right|}^2}$ for $a_{i,j}$ as elements in $\mathit{A}\in {\mathbb{R}}^{m \times n}$.

below, following the conventional notations used in the research field.

Given an attributed graph G = (V, E, X) with adjacency matrix A and attribute matrix X for nodes in the graph, the task of anomaly detection involves ranking all nodes from high values to low values, where the nodes that differ with respect to their attributes or local structures are assigned higher values than their normal counterparts. It is important to note that the graph anomaly detection is performed in an unsupervised learning scenario, where node anomaly labels are unknown during the training stage.

3.2. Overall Model Framework

In this subsection, the proposed framework is presented in detail, and the overall pipeline is illustrated in Figure 1 below. As shown in the figure, the model consists of several fundamental components:

(1)

The subgraph preprocessing stage, which extracts k-hop subgraphs for each node in the graph to generate enhanced embeddings and the node–subgraph similarity matrix seamlessly.

(2)

The attributed network encoding stage, where two graph encoders (GCNs) are utilized, one with the original adjacency matrix and one with the node–subgraph similarity matrix, to encode the enhanced node embeddings generated in stage (1) for parallel representation learning. Then, the two encoded embeddings are concatenated together and passed through a fully connected layer to obtain the final hidden embeddings.

(3)

The attribute and structure decoding stage, where dedicated GCNs reconstruct the original node attributes with the learned node embeddings, together with a simple graph structure learning layer that reconstructs the graph topology from the learned hidden node embeddings.

(4)

The anomaly scoring stage, which, after training, utilizes node neighborhood selection to optimize the reconstructed adjacency matrix, assigns anomaly scores to nodes in the graph based on the combined reconstruction errors, and ranks them accordingly.

During the subgraph preprocessing stage, k-hop subgraphs centered around each node (marked red in Figure 1) in the graph are extracted. These extracted subgraphs are then employed simultaneously to generate enhanced node embeddings and the node–subgraph similarity matrix used in the next stage. Subgraph centralization, followed by aggregation and pooling operations, is utilized for enhanced node embedding generation. Meanwhile, similar aggregation and pooling strategies are applied to the un-centralized subgraphs to update embeddings and compute the node–subgraph similarity matrix. In the attributed network encoding, two GCN-based encoders work in parallel to embed node information from two different views: one with the original adjacency matrix and another with the node–subgraph similarity matrix. Then, the embedded representations from these two views are concatenated together to generate the final hidden embeddings through an additional fully connected layer. With the generated final hidden embeddings, in the attribute and structure decoding stage, a GCN-based decoder is employed to reconstruct the attributes, and a graph structure learning layer is utilized to reconstruct the graph topology. The weighted sum of the attribute reconstruction error and structure reconstruction error is utilized as the loss for training.

3.3. Subgraph Preprocessing Stage

Recent studies [26,27,36,37,38,39,40] have demonstrated the effectiveness of incorporating subgraph information around nodes into the embedding encoding process. Experimental results from such studies have shown significant improvements in various learning tasks, including graph classification, link prediction, and substructure counting. In this work, the methodology parallels the strategy outlined in [36], involving the extraction and utilization of complete k-hop subgraphs around each node in the graph. This approach enables the model to aggregate subgraph-level information, producing enhanced node representations for subsequent learning tasks. This stands in contrast to the designs in [26,27], which utilized random-walk subgraphs.

In a given attributed graph G = (V, E, X), the k-hop subgraph centered around a source node $v_i\in$ V is denoted as G^k ($v_i$) = ($V_{v_i}^k$, $E_{v_i}^k$, ${\mathit{X}}_{v_i}^k$), where $V_{v_i}^k$ $\subseteq$ V and $E_{v_i}^k$ $\subseteq$ E. $V_{v_i}^k$ consists of all nodes u $\in$ V such that the shortest path between u and source node $v_i$ has length l, where $l\le$ k $\in \mathbb{N}$, and ${\mathit{X}}_{v_i}^k$ includes the node features for every node in the k-hop subgraph G^k ($v_i$).

Given the attributed graph G = (V, E, X) with n nodes and the setting of k, each node in the graph is treated as the source node to extract the k-hop subgraph around it, yielding G^k ($v_i$) = ($V_{v_i}^k$, $E_{v_i}^k$, ${\mathit{X}}_{v_i}^k$) for each node $v_i\in$ V. The subgraph topology can be represented by the adjacency matrix ${\mathit{A}}_{V_{v_i}^k}.$

During the subgraph preprocessing stage, the goal is to generate enhanced node embeddings and a node–subgraph similarity matrix as input for the two encoders in the next stage. To mitigate interference induced by the absolute positions of nodes in the vector space, Ref. [36] introduced a subgraph centralization strategy. This strategy involves translating each subgraph to the same extent, with the source node in each subgraph moved to the origin. Here, the same centralization operation is applied to each subgraph. For each subgraph G^k ($v_i$) with subgraph attribute matrix ${\mathit{X}}_{v_i}^{\mathit{k}}$ and source node attribute X_i, the source node attribute X_i is subtracted from each row in ${\mathit{X}}_{v_i}^k$ to create the centralized subgraph node features $\widetilde{{\mathit{X}}_{v_i}^k}$, therefore ensuring that the source node featured in $\widetilde{{\mathit{X}}_{v_i}^k}$ is translated to the origin. Instead of employing the Weisfeiler–Lehman method [41] to embed the subgraph, as was performed in [36], a subgraph-level topological approach is adopted in this work: a subgraph aggregation process followed by a pooling operation. This approach empowers the framework to capture the topological information of subgraphs and generate enhanced node embeddings.

Let ${\mathit{D}}_{V_{v_i}^k}$ denote the degree matrix of the subgraph adjacency matrix ${\mathit{A}}_{V_{v_i}^k}$. Then, the embedding process for the subgraph centered around node $v_i$ to generate the enhanced node embedding vector ${\widehat{\mathit{x}}}_{v_i}$ is computed as follows:

$${\widehat{\mathit{x}}}_{v_i}={MeanPooling({\mathit{D}}_{V_{v_i}^k}}^{-1}{\mathit{A}}_{V_{v_i}^k} \widetilde{{\mathit{X}}_{v_i}^{\mathit{k}}})$$

(1)

or

$${\widehat{\mathit{x}}}_{v_i}= [{\mathit{X}}_i, MeanPooling({{\mathit{D}}_{V_{v_i}^k}}^{-1}{\mathit{A}}_{V_{v_i}^k} \widetilde{{\mathit{X}}_{v_i}^{\mathit{k}}})]$$

(2)

where [·] denotes concatenation. The embedding-enhanced attribute matrix is then denoted as $\widehat{\mathit{X}}$.

Multi-view learning on graphs is an effective technique designed to incorporate multiple aspects of information and improve training while keeping GCN models shallow to prevent over-smoothing problems [42]. Methods commonly used to create additional views in GNN-based models involve constructing the diffusion matrix [43] and computing the node feature similarity matrix [44]. Assuming that anomalies—whether structural or contextual—tend to exhibit attribute patterns that differ significantly from their neighboring nodes, the model incorporates an additional node–subgraph similarity view as supplementary information for representation learning. This view aims to amplify the contrast by comparing node attributes with the mean attributes of their local subgraphs. While this operation is similar to the embedding enhancement process, it is computed using un-centralized subgraph features, capturing complementary information from the original attribute space.

For each subgraph G^k ($v_i$) within the subgraph attribute matrix ${\mathit{X}}_{v_i}^k$, subgraph adjacency matrix ${\mathit{A}}_{V_{v_i}^k}$, and degree matrix ${\mathit{D}}_{V_{v_i}^k}$, the updated mean subgraph feature for node $v_i$ is computed as follows:

$${\mathit{x}}_{v_i}^{\prime }={MeanPooling({\mathit{D}}_{V_{v_i}^k}}^{-1}{\mathit{A}}_{V_{v_i}^k} {\mathit{X}}_{v_i}^k)$$

(3)

The mean subgraph feature matrix is then denoted as ${\mathbf{X}}^{\prime }$. Next, the cosine similarity between X and ${\mathbf{X}}^{\prime }$ is measured to generate the node–subgraph similarity matrix:

$${\mathit{S}}^{sim}=\mathrm{CosineSim}\left(\mathit{X},{\mathit{X}}^{\prime }\right)$$

(4)

3.4. Attributed Network Encoding Stage

Due to the limitation of accessing ground-truth labels for graph anomaly detection in real-world datasets, graph autoencoders (GAEs) and their variants, Graph Variational Autoencoders (VGAEs) [11], have been widely applied as powerful methods to learn meaningful graph embeddings. Graph autoencoders employ a two-layer GCN-based encoder to map the input features into a low-dimensional latent space. In the decoder part, the decoder reconstructs the network topology by computing the inner product between latent variables. The training task is set to minimize the reconstruction error between the reconstructed adjacency matrix and the original graph topology. Ref. [24] first exploited the use of graph autoencoders for the graph anomaly detection task and achieved notable performance improvements. The proposed model DOMINANT leverages a multi-layer GCN-based encoder to embed the input features to a low-dimensional latent space. It then reconstructs the graph structure through one layer of a GCN followed by an inner product operation. Moreover, the model introduces an inverse version of the GCN-based encoder as the attribute decoder. The objective function is then formulated as follows:

$$\mathcal{L}=\left(1-\alpha \right){\mathcal{R}}_S+\alpha {\mathcal{R}}_A$$

(5)

where ${\mathcal{R}}_S$ and ${\mathcal{R}}_A$ are the structure and attribute reconstruction errors, respectively, and $\alpha$ is the parameter that balances between the two losses. For a certain node in the graph, a higher reconstruction error indicates a higher probability of being anomalous. Since DOMINANT, several variants have been proposed, and have demonstrated constructive improvements in anomaly detection tasks. AnomalyDAE [13] employs two separate autoencoders to learn the attribute and structure representations jointly. The structure encoder employs non-linear transformation to embed node attributes to the latent space, and then utilizes the attention mechanism to aggregate neighboring node information and generate the final structure embeddings. Finally, the adjacency matrix is reconstructed through an inner product between the final structure embeddings. The attribute encoder also embeds the observed attribute to the latent space through several non-linear transformation layers, and then takes the inner product of the encoded attribute embedding and the final structure embedding to decode node features. To better detect the structural anomalies in the graphs, the ComGA framework [1] incorporates an extra community detection module with the addition of an extra neural network to encode and decode the modularity matrix of the input graph. The learned community latent representation is then combined with the learned attribute latent representation to reconstruct both the graph topology and the node attributes.

The framework design in this work consists of two separate GCN-based encoders to learn specific representations from two different views. With the enhanced node embeddings $\widehat{\mathit{X}}$, the adjacency matrix A, and the node–subgraph similarity matrix ${\mathit{S}}^{sim}$, let I be the identity matrix. Matrices $\widehat{\mathit{A}}=\mathit{A}+\mathit{I}$ and $\tilde{\mathit{A}}={\tilde{\mathit{D}}}^{-{\displaystyle \frac{1}{2}}}\widehat{\mathit{A}}{\tilde{\mathit{D}}}^{-{\displaystyle \frac{1}{2}}}$ are then defined, where $\tilde{\mathit{D}}$ is the degree matrix of $\widehat{\mathit{A}}$. The encoding stage is designed as follows:

$${\mathit{Z}}_{feat}=\sigma \left(\tilde{\mathit{A}} \sigma \left(\tilde{\mathit{A}}\widehat{\mathit{X}}{\mathit{W}}_0+{\mathit{b}}_0\right){\mathit{W}}_1+{\mathit{b}}_1\right)$$

(6)

$${\mathit{Z}}_{sim}=\sigma \left({\mathit{S}}^{sim} \sigma \left({\mathit{S}}^{sim }\widehat{\mathit{X}}{\mathit{W}}_2{+\mathit{b}}_2\right){\mathit{W}}_3+{\mathit{b}}_3\right)$$

(7)

Here, $\sigma (\cdot )$ represents the activation function; ${\mathit{W}}_0,{\mathit{W}}_1,{\mathit{W}}_2$, and ${\mathit{W}}_3$ are the weights; and ${\mathit{b}}_0$, ${\mathit{b}}_1$, ${\mathit{b}}_2$, and ${\mathit{b}}_3$ are the biases to be learned. In the implementation, PReLU is used as the activation function for optimal performance, defined as follows:

$$PReLU\left(x\right)=max(0,x)+a\ast min(0,x)$$

(8)

To obtain the final latent representation, the learned latent embeddings from both views are concatenated and an additional linear layer is applied to combine the information and generate the final latent representation:

$${\mathit{Z}}_{final}=\sigma \left({[\mathit{Z}}_{feat}, {\mathit{Z}}_{sim}\right]{\mathit{W}}^{\prime }+{\mathit{b}}^{\prime })$$

(9)

Here, [·] denotes the concatenation operation, $\sigma (\cdot )$ is the activation function, and ${\mathit{W}}^{\prime }$ and ${\mathit{b}}^{\prime }$ are the weight and bias to be learned.

3.5. Attribute and Structure Decoding Stage

In the attribute decoder, a reversed version of the two-layered GCN-based encoder is employed to approximate the node attribute information based on the learned final latent representation ${\mathit{Z}}_{final}$. The attribute decoding process is formulated below:

$${\mathit{X}}^{rec}=\sigma \left(\tilde{\mathit{A}} \sigma \left(\tilde{\mathit{A}}{\mathit{Z}}_{final }{\mathit{W}}_4+{\mathit{b}}_4\right){\mathit{W}}_5+{\mathit{b}}_5\right)$$

(10)

Here, $\sigma (\cdot )$ denotes the activation function, ${\mathit{W}}_4$ and ${\mathit{W}}_5$ are the learnable weights, ${\mathit{b}}_4$ and ${\mathit{b}}_5$ are the learnable biases, and ${\mathit{X}}^{rec}$ represents the reconstructed node embeddings through the attribute decoder. The attribute reconstruction error is then computed as ${\mathcal{R}}_A={||\widehat{\mathit{X}}-{\mathit{X}}^{rec}\left|\right|}_{\mathit{F}}$.

To extract latent connections between nodes based on the final latent representation ${\mathit{Z}}_{final}$, the structure reconstruction decoder utilizes a neural-based graph structure learning approach to unveil the relationships among nodes in the data and reconstruct the adjacency matrix. The proposed graph learning layer is illustrated as follows:

$$M_1=Relu\left({\mathit{Z}}_{final}{\mathit{W}}_{gl1}+{\mathit{b}}_{gl1}\right)$$

(11)

$$M_2=Relu\left({\mathit{Z}}_{final} {\mathit{W}}_{gl2}+{\mathit{b}}_{gl2}\right)$$

(12)

$${\mathit{A}}^r=sigmoid\left(M_1{M}_2^T\right)$$

(13)

$${\mathit{A}}^{rec}=({\mathit{A}}^r+{{(\mathit{A}}^r)}^T)/2$$

(14)

Here, ${\mathit{W}}_{gl1}$ and ${\mathit{W}}_{gl2}$ are learnable weights of the same dimension (where ‘gl’ denotes graph learning), used for embedding the final latent representation ${\mathit{Z}}_{final}$, while ${\mathit{b}}_{gl1}$ and ${\mathit{b}}_{gl2}$ are learnable biases. Equation (14) is introduced to ensure the reconstructed adjacency matrix is bi-directional. The structure reconstruction error is then computed as ${\mathcal{R}}_S={\left|\right|\mathit{A}-{\mathit{A}}^{rec}\left|\right|}_{\mathit{F}}^2$. The objective function of the proposed autoencoder model is formulated in the same way as (5):

$$\mathcal{L}=\left(1-\alpha \right){\mathcal{R}}_S+\alpha {\mathcal{R}}_A$$

(15)

with $\alpha$ as the balancing parameter.

3.6. Anomaly Scoring

By minimizing objective function (15), the proposed framework can iteratively improve its ability to approximate the input attributed network better as the training converges. Instead of using objective function (15) as the indicator for anomaly scores, as seen in other graph autoencoder-based models, additional steps are introduced into the proposed model. For each node $v_i$, its node degree in the original adjacency matrix is first obtained, denoted as $D_i$. The next step takes the top-$D_i$ values in the i-th row of the reconstructed ${\mathit{A}}^{rec}$ and sets these values to 1, while the remaining values in row i are set to 0. The updated reconstructed adjacency matrix is denoted as ${\tilde{\mathit{A}}}^{rec}$, and the anomaly score for node $v_i$ is determined according to the following formula:

$$score(v_i)=(1-\alpha )||A_i-{\tilde{A}}_i^{rec}{||}_2^2+\alpha ||{\widehat{\mathit{X}}}_i-{\mathit{X}}_i^{rec}{\left|\right|}_2^2$$

(16)

Entities are ranked based on their anomaly scores, with a higher anomaly score indicating a greater likelihood of being considered anomalous.

4. Experiments

In this study, the effectiveness of the proposed model was verified empirically through experiments over several real-world attributed network datasets.

4.1. Datasets

To evaluate the proposed method, this study employed six of the most widely used real-world attributed networks in prior research: Cora [45], CiteSeer [45], Pubmed [45], BlogCatalog [46], Flickr [46], and ACM [47]. Cora, CiteSeer, Pubmed, and ACM are four publicly available citation graphs consisting of literature publications. In these networks, nodes represent published papers and edges indicate the citation relationships among them. The titles and abstracts of papers are used to create attributes for nodes. BlogCatalog is a social blog sharing network in which nodes represent users and links represent follower–followee connections between users. Flickr is an online image sharing and hosting network with a network structure similar to that of BolgCatalog. In both BlogCatalog and Flickr, a list of tags that describe users are used to generate their node attributes. Since these datasets contain no ground-truth anomalies, synthetic attribute anomalies and structural anomalies are injected into the datasets according to the commonly applied perturbation scheme described in [24,26]. To inject structure anomalies into the attributed network, small cliques consisting of initially unconnected nodes in the graph are constructed. To form each clique, $m$ nodes are selected at random from the set of nodes V and structured in a fully connected manner. This procedure is iteratively executed n times, thereby generating m × n structure anomalies in the graph. For all six datasets—Cora, CiteSeer, Pubmed, BlogCatalog, Flickr, and ACM—the clique size m is set to 15, while the number of cliques n varies as 5, 5, 20, 10, 15, and 20, respectively. An equivalent number of m × n nodes are randomly chosen and perturbed as attribute anomalies within the attributed network. For each selected target node $v_i$, k additional nodes are randomly selected as candidate nodes. These candidate nodes are evaluated based on their Euclidean distance to the candidate node $v_i$. The node $v_j$ that exhibits maximum deviation from $v_i$ in terms of the Euclidean distance among the candidate nodes is chosen. The attribute of node $v_j$ then becomes the perturbed attribute for node $v_i$. This process is consistently applied across all six datasets with k set to 50. Detailed statistics of these six datasets are shown in

Table 2. Summary of datasets.

Datasets	Cora	CiteSeer	Pubmed	BlogCatalog	Flickr	ACM
#Nodes	2708	3327	19,717	5196	7575	16,484
#Edges	5429	4732	44,338	171,743	239,738	71,980
#Attributes	1433	3703	500	8189	12,074	8337
#Anomalies	150	150	600	300	450	600

.

4.2. Baselines

The performance of the proposed model is compared with that of the following popular graph anomaly detection models:

-

DOMINANT [24]: This is an unsupervised anomaly detection framework that relies on graph autoencoders to learn representations and seamlessly reconstruct node attributes and graph topology. The model evaluates anomalies through the sum of both attribute reconstruction error and structure reconstruction error.

-

CoLA [26]: This model extracts node–subgraph pairs to train a GNN-based contrastive learning model for the purposes of representation learning and anomaly detection.

-

ComGA [1]: This is a graph autoencoder-based anomaly detector that incorporates an additional deep neural network to learn the modularity matrix and capture community structures within graphs.

-

ANEMONE [27]: This multi-scale contrastive learning model captures anomalies through patch-level and context-level contrast aspects.

-

GCAD [36]: This model introduces a subgraph centralization operation to transform and embed subgraphs around nodes in the graph, and utilizes the Isolation Distributional Kernel [48] as the anomaly detector.

4.3. Experimental Settings and Evaluation Metrics

Evaluation Metrics: In line with prior research [1,21,22,24,26,36,49], the AUC score and the F1 score are adopted as the evaluation metrics. AUC stands for “Area under the ROC Curve”, which is a curve that plots the true positive rate against the false positive rate. A higher AUC value (closer to 1) indicates a superior anomaly detection performance. The F1 score can be defined as the harmonic mean of the precision and recall. The score ranges from 0 to 1, with higher values reflecting more effective anomaly detection capability.

In the implementation, the subgraph embedding enhancement method (1) was employed to embed the ACM and BlogCatalog datasets for optimal performance. Concersely, for Cora, CiteSeer, Pubmed, and Flickr, the embedding enhancement method (2) yielded better performance. The embedding dimension was set to 64 for all datasets. The Adam algorithm [50] was applied for loss function optimization with the learning rate set to (0.0003, 0.0004, 0.003, 0.005, 0.002, 0.005), and balance parameter α was set to (0.6, 0.6, 0.99, 0.95, 0.95, 0.99) for Cora, CiteSeer, Pubmed, BlogCatalog, Flickr, and ACM, respectively. For each model and dataset, we report the average and standard deviation of scores over five independent runs to ensure a fair comparison.

The proposed framework was implemented using Pytorch 2.0.1 and Python 3.9.10. All experiments were conducted in the same Windows environment with an RTX 3080 Ti (12 GB memory) GPU, an AMD Ryzen 9 5950X CPU, and 128 GB of RAM. Baseline models were tested under the specific Python version and library version mentioned in their provided documentation files. The hyperparameter settings for the baseline models followed the descriptions provided in the original paper and repository. If certain settings were not specified, grid search was used for hyperparameter tuning, consistent with the approach described above for our proposed framework.

4.4. Result Analysis

The AUC scores and F1 scores across six benchmark datasets are reported in

Table 3. Comparison of AUC scores over six datasets.

	Dataset	Cora	CiteSeer	Pubmed	BlogCatalog	Flickr	ACM
Model
DOMINANT		0.893 ± 0.004	0.879 ± 0.005	0.872 ± 0.011	0.781 ± 0.001	0.751 ± 0.001	0.778 ± 0.006
CoLA		0.903 ± 0.008	0.828 ± 0.006	0.929 ± 0.014	0.754 ± 0.003	0.735 ± 0.002	0.833 ± 0.010
ComGA		0.889 ± 0.004	0.911 ± 0.010	0.921 ± 0.001	0.812 ± 0.003	0.792 ± 0.005	0.850 ± 0.004
ANEMONE		0.917 ± 0.011	0.925 ± 0.004	0.952 ± 0.001	0.808 ± 0.002	0.762 ± 0.001	0.859 ± 0.005
GCAD		0.906 ± 0.003	0.929 ± 0.004	0.920 ± 0.002	0.761 ± 0.005	0.747 ± 0.003	0.846 ± 0.002
Our Model		0.942 ± 0.003	0.979 ± 0.001	0.950 ± 0.001	0.828 ± 0.001	0.806 ± 0.001	0.924 ± 0.001

and

Table 4. Comparison of F1 scores over six datasets.

	Dataset	Cora	CiteSeer	Pubmed	BlogCatalog	Flickr	ACM
Model
DOMINANT		0.692 ± 0.002	0.684 ± 0.010	0.614 ± 0.015	0.624 ± 0.005	0.709 ± 0.002	0.699 ± 0.001
CoLA		0.694 ± 0.013	0.627 ± 0.011	0.630 ± 0.008	0.589 ± 0.010	0.690 ± 0.009	0.667 ± 0.003
ComGA		0.775 ± 0.005	0.802 ± 0.006	0.635 ± 0.002	0.620 ± 0.005	0.700 ± 0.004	0.680 ± 0.005
ANEMONE		0.779 ± 0.011	0.812 ± 0.002	0.622 ± 0.008	0.613 ± 0.002	0.681 ± 0.002	0.650 ± 0.004
GCAD		0.796 ± 0.009	0.795 ± 0.004	0.650 ± 0.006	0.630 ± 0.006	0.635 ± 0.004	0.629 ± 0.010
Our Model		0.831 ± 0.002	0.833 ± 0.006	0.693 ± 0.002	0.644 ± 0.000	0.726 ± 0.001	0.747 ± 0.001

below, respectively. The highest values for each dataset are highlighted in bold, while the second-highest scores are underscored. The experimental results clearly validate the effectiveness of the proposed model, which achieves the best performance on five of the six datasets and delivers comparable results on the Pubmed dataset. Compared to other graph autoencoder-based methods (ComGA and DOMINANT), the proposed model consistently demonstrates notable improvements on all datasets, with an average AUC gain of up to 5.52% and up to 8.71% in F1 scores, confirming the effectiveness of the subgraph preprocessing stage in generating more informative node representations as input for the graph autoencoders. When evaluated against contrastive learning-based methods that also incorporate subgraph information for learning, the proposed model maintains strong performance, achieving an average AUC improvement of 3.53% and an F1 improvement of 5.18%, outperforming both baselines on five out of six datasets on average. The only exception occurs on the Pubmed dataset, where the model yields a slightly lower AUC than ANEMONE. These findings emphasize the efficiency of the proposed model in capturing local topological information through the subgraph information aggregation process and the additional extra node–subgraph view.

4.5. Parameter Sensitivity

In this subsection, the influence of three parameter settings crucial to the anomaly detection capability of the framework are investigated, namely the balancing parameter $\alpha$, the pooling method used, and the embedding dimension size.

4.5.1. Effect of Balancing Parameter $\alpha$

We vary the value of parameter $\alpha$ from 0 to 1 using the set {0, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.95, 0.99, 1} to explore its impact on model performance. Specifically, $\alpha$ = 0 corresponds to using only structure reconstruction error, while $\alpha$ = 1 indicates exclusive reliance on attribute reconstruction error. As illustrated in Figure 2, across all datasets, relying solely on structure reconstruction error results in nearly the lowest AUC and F1 scores, whereas emphasizing attribute reconstruction error only yields better results. For the Cora and CiteSeer datasets, the model achieves peak performance when the $\alpha$ value is around 0.6, suggesting a more balanced contribution of both errors. For the BlogCatalog, Flickr, Pubmed, and ACM datasets, the highest scores are attained when $\alpha$ is in the 0.95 to 0.99 range. The results show that optimal detection performance is achieved when both reconstruction errors are taken into consideration. Moreover, based on the observation, the attribute reconstruction errors appear to carry more weight than the structural reconstruction errors in our proposed model, since the subgraph embedding stage already injects structural information into the enhanced node attributes.

4.5.2. Effect of the Pooling Method Used

In the subgraph preprocessing stage, we utilize the mean pooling method to update node embeddings from aggregated subgraph attributes. This subsection investigates how the detection capability varies with respect to the use of other pooling options, namely min pooling and max pooling. Figure 3 illustrates the comparison results. The mean pooling function consistently produces the highest detection results when compared to other pooling methods while the max pooling function performs the worst across all six datasets.

4.5.3. Effect of Embedding Dimension

To assess the model’s sensitivity to varying embedding dimensions, additional experiments were conducted using dimensions ranging from 8 to 256. The corresponding results are presented in Figure 4. In five out of six datasets, we can observe an increase in AUC and F1 scores as the embedding dimension expands from 8 to 64. However, performance begins to decline when the embedding dimension exceeds 64. For the ACM and BlogCatalog datasets, only minor fluctuations are observed across the entire range of dimensions, with the highest values occurring around a dimension size of 128. Consequently, an embedding size of 64 is set as the default value for hidden embeddings in the proposed model, as this size has been demonstrated to provide sufficient information for the learning process.

4.6. Ablation Study

To understand the individual contributions of each core component to the detection performance, a further comparative analysis was conducted for the proposed model and its variants. These variants included one without the subgraph preprocessing stage, with two versions: (1) without embedding enhancement (denoted as ‘w/o e.e.’), and (2) without embedding enhancement and extra node–subgraph view (denoted as ‘w/o e.e and e.v.’). Another variant excluded the graph structure learning decoder and adopted the GCN-based decoder instead (denoted as ‘w/o gsl’), and the final variant eliminated the neighborhood selection process (denoted as ‘w/o n.s.’) in the anomaly scoring stage. As shown in

Table 5. Performance comparison with different variants.

	Dataset	Cora	CiteSeer	Pubmed	BlogCatalog	Flickr	ACM
Variant
w/o e.e.		0.933 ± 0.003	0.954 ± 0.001	0.943 ± 0.002	0.806 ± 0.003	0.797 ± 0.001	0.818 ± 0.004
w/o e.e. and e.v.		0.931 ± 0.002	0.950 ± 0.001	0.943 ± 0.001	0.807 ± 0.001	0.798 ± 0.001	0.797 ± 0.010
w/o gsl		0.937 ± 0.002	0.977 ± 0.000	0.947 ± 0.001	0.826 ± 0.001	0.805 ± 0.001	0.923 ± 0.003
w/o n.s.		0.934 ± 0.001	0.961 ± 0.001	0.941 ± 0.001	0.827 ± 0.000	0.802 ± 0.001	0.923 ± 0.000
Our Model		0.942 ± 0.003	0.979 ± 0.001	0.950 ± 0.001	0.828 ± 0.001	0.806 ± 0.001	0.924 ± 0.001

, all components in the model contribute to the identification performance, and notably, the subgraph preprocessing stage emerges as the most critical component, as its removal from the model results in the sharpest decline in AUC scores. In addition, as illustrated in the table, the version without both the embedding enhancement and the extra view exhibits a further drop in performance compared to the version with only the embedding enhancement stage removed. This result highlights the effectiveness of the introduced node–subgraph view in learning informative structural relations. Additionally, the neighborhood selection module consistently enhances the AUC scores across nearly all datasets. This suggests that aligning the reconstructed graph structure with the original graph structure in terms of node degrees for final anomaly scoring after training can indeed provide more informative information for anomaly detection. The graph structure learning technique applied in the structure reconstruction decoder yields a slight improvement in AUC scores across nearly all datasets. This result underscores the importance of focusing more attention on learning structural relationships between nodes to improve anomaly detection performance. One noticeable finding is that for the ACM dataset, the subgraph preprocessing stage provides the most contribution to the detection performance as there is only slight fluctuation observed when the graph structure module or neighbor selection module is removed.

5. Conclusions

This paper introduces an enhanced autoencoder-based framework for graph anomaly detection, leveraging the subgraph information to improve the detection performance. In the subgraph preprocessing stage, the model extracts k-hop subgraphs around each node in the graph, aggregating local topological information to generate enhanced node representations. Additionally, the extracted local topological information is leveraged to provide an extra node–subgraph perspective, strengthening the model’s understanding of the graph structure. In the decoding stage, a graph structure learning method is employed to strengthen the structure reconstruction capability. Furthermore, a neighborhood selection step is incorporated into the anomaly scoring step to improve anomaly detection results after training. Experimental evaluations validated the superiority of the proposed method in terms of detection accuracy compared to state-of-the-art baselines. The proposed method outperformed the baseline models across five out of six datasets overall. When compared with other graph autoencoder-based methods, the proposed model achieved an average improvement of 4.09% in the AUC score over all six datasets. In comparison to graph contrastive learning-based frameworks, the proposed model shows an improvement of 5.11% in AUC scores across five datasets and falls behind in only one dataset, by a small margin. Through further ablation studies, the effectiveness of each component within the proposed framework in contributing to the model’s detection performance was also verified and highlighted. While the proposed model demonstrates significant advancements in graph anomaly detection tasks, several directions remain unexplored for future research. The current design of the framework primarily addresses static graphs for local subgraph information extraction and aggregation. Future work could investigate the extension of the subgraph preprocessing stage to dynamic graphs or evolving networks, where the graph structure undergoes changes over time. Exploiting the possibility of incorporating temporal information into the subgraph preprocessing process remains to be studied. Moreover, real world graphs can be heterogeneous, implying that nodes in the graph can be connected through various relation types. Exploring how a graph-autoencoder-based model can effectively learn interrelations between different connection types to generate latent embeddings and perform heterogeneous graph anomaly detection poses a challenging, yet promising direction for future work.