PROJECT TITLE :

A Deep Multi-View Framework for Anomaly Detection on Attributed Networks

ABSTRACT:

Research on anomaly detection in such networks, which can be applied in a variety of high-impact domains, has been given a boost as a result of the explosion in the modeling of complex systems using attributed networks. However, the vast majority of existing attempts do not make an honest effort to address the multi-view property that is inherently present in attribute space. Instead, they concatenate multiple views into a single feature vector, which invariably ignores the incompatibility that exists between heterogeneous views due to the statistical properties that are unique to each view. In point of fact, the multi-view data brings with it information that is distinct but complementary, which promises the possibility of more effective anomaly detection than the efforts that are only based on single-view data. In addition, the abnormal patterns will naturally behave differently depending on the perspective that is taken, which coincides with the fact that people have a strong desire to discover specific abnormalities based on the preferences that they have regarding perspectives (attributes). Because they don't take into account the idiosyncrasies of user preferences, most of the methods that are currently available aren't able to be adapted to the needs of different people. As a result, we propose a multi-view framework called Alarm for the purpose of incorporating user preferences into anomaly detection and simultaneously tackling heterogeneous attribute characteristics. This is accomplished through the use of multiple graph encoders and a well-designed aggregator that supports both self-learning and user-guided learning. Experiments on synthetic and real-world datasets, such as Disney, Books, and Enron, corroborate the improvement of Alarm in detection accuracy as evaluated by the AUC metric and its effectiveness in supporting user-oriented anomaly detection. Specifically, the experiments corroborate the improvement of Alarm's ability to identify anomalies in the data that are relevant to the user.