Learning Discriminative and Generalizable Anomaly Detector for Dynamic Graph with Limited Supervision

Dynamic graph anomaly detection is critical for many real-world applications but remains challenging due to the scarcity of labeled anomalies. Existing methods are either unsupervised or semi-supervised: unsupervised methods avoid the need for labeled anomalies but often produce ambiguous boundary, whereas semi-supervised methods can overfit to the limited labeled anomalies and generalize poorly to unseen anomalies. To address this gap, we consider a largely underexplored problem: learning a discriminative boundary from normal/unlabeled data, while leveraging limited labeled anomalies \textbf{when available} without sacrificing generalization to unseen anomalies. In this paper, we propose an effective, generalizable, and model-agnostic framework with three main components: (i) residual representation encoding that capture deviations between current interactions and their historical context, providing anomaly-relevant signals; (ii) a restriction loss that constrain the normal representations within an interval bounded by two co-centered hyperspheres, ensuring consistent scales while keeping anomalies separable; (iii) a bi-boundary optimization strategy that learns a discriminative and robust boundary using the log-likelihood distribution modeled by a normalizing flow. Extensive experiments demonstrate the superiority of our framework across diverse evaluation settings.

Many real-world systems can be viewed as networks that change over time, such as financial transactions, online interactions, or device communications. Detecting unusual behavior in these networks is important for finding fraud, security risks, and other rare events, but confirmed examples of such behavior are often scarce. Existing methods usually face a trade-off. Methods that do not use confirmed unusual examples may have unclear decision rules, while methods that use a few such examples may fail to detect new types of unusual behavior. This paper proposes a new framework that mainly learns from normal and unlabeled data, while also using confirmed unusual examples when available. It compares current interactions with past behavior, keeps normal behavior in a stable range, and learns a reliable rule for separating normal and unusual cases. Experiments show that the framework performs well across different settings, including cases where unusual behavior differs from what was seen during training.