What is GeneralDyG
GeneralDyG is a general dynamic graph anomaly detection method proposed by a research team at Nanyang Technological University, addressing anomaly detection problems in dynamic graph data in fields such as social networks, e-commerce, and cybersecurity. Through a temporal ego-graph sampling module, a graph neural network extraction module, and a time-aware Transformer module, it effectively addresses challenges such as diverse data distributions, difficulty in capturing dynamic features, and high computational costs. Experimental results on multiple real-world datasets show that GeneralDyG significantly outperforms various existing mainstream methods, demonstrating excellent generality and detection capability.
Main Features of GeneralDyG
- Adaptation to Diverse Data Distributions: By extracting key information from nodes, edges, and their topological structures, GeneralDyG can adapt to the complex feature distributions of different datasets.
- Dynamic Feature Capture: This method combines global temporal dynamics and local structural changes to deeply model multi-scale dynamic patterns in dynamic graphs.
- Efficient Computing Framework: A lightweight framework is constructed to efficiently capture key dynamic features, significantly improving computational efficiency.
- Temporal Ego-graph Sampling: By constructing compact subgraph structures, it effectively addresses the computational pressure brought by large-scale dynamic graph data.
- Fusion of Structural and Temporal Features: The time-aware Transformer module is used to integrate time series and structural features, ensuring the accuracy of anomaly detection.
Technical Principles of GeneralDyG
- Temporal Ego-graph Sampling Module: This module effectively addresses the computational pressure brought by large-scale dynamic graph data by constructing compact subgraph structures. Based on a central event, it extracts the surrounding interaction history through a k-hop algorithm to form a temporal ego-graph. The k-hop algorithm considers the temporal order and topological relationships among events, ensuring that the sampling process takes into account both temporal dynamics and structural characteristics. The module introduces special markers to separate interaction information at different levels, helping the Transformer module better identify and learn hierarchical dynamics in time series.
- Graph Neural Network Extraction Module: Based on the temporal ego-graph, a new graph neural network (TensGNN) is designed to extract rich structural information. TensGNN achieves feature information propagation and updating by alternately applying node layers and edge layers, thereby building strong associations between node features and edge features. The node layer uses the node adjacency matrix and a specific Laplacian matrix for convolution operations, while combining edge features to update node representations. The edge layer updates edge feature representations based on edge adjacency relationships and node states.
- Time-aware Transformer Module: The module integrates time series and structural features. In the self-attention mechanism, the model encodes the topological structure information of the graph based on Query and Key respectively, while keeping Value as the original event features, ensuring the accuracy of anomaly detection. Through this module, the model can effectively capture global temporal dependencies and local dynamic changes in dynamic graphs, achieving accurate modeling of complex anomaly patterns.
Project Address of GeneralDyG
- Github Repository：https://github.com/YXNTU/GeneralDyG
- arXiv Technical Paper：https://arxiv.org/pdf/2412.16447
Application Scenarios of GeneralDyG
- Social Networks: In social networks, GeneralDyG can be used to detect anomalous behavior, such as spam propagation and fake account identification. By analyzing interactions among users and their changes over time, it can effectively identify anomalous behavior that deviates from normal social patterns.
- E-commerce: In the e-commerce field, GeneralDyG can be used to detect fraudulent transactions. By analyzing users' transaction behavior and the associations between products, it can identify abnormal transaction patterns, helping e-commerce platforms improve the security and reliability of transactions.
- Network Security: In network security, GeneralDyG can be used to detect network intrusions and anomalous traffic. By analyzing data packet transmission in the network and the connection relationships between nodes, it can promptly discover potential security threats and improve the security of network systems.
- Financial Systems: In the financial field, GeneralDyG can be used to detect financial fraud and abnormal transaction behavior. By analyzing the flow of funds and the relationships between accounts in financial transaction networks, it can identify abnormal financial activities and help financial institutions prevent risks.