This work introduces a novel foundation model for TAG anomaly detection featuring decoupled topological and textual prototypes and constructs dual prototype banks to independently model structural normality and semantic consistency, effectively isolating anomaly cues that are otherwise diluted during coupled aggregation.
Abstract
Text-Attributed Graphs (TAGs), endowed with abundant textual content along with topological structures, have emerged as a versatile backbone for real-world anomaly detection spanning large language model security, social network moderation, and cyber threat identification. Unlike conventional Graph Anomaly Detection (GAD), which relies primarily on structural irregularities, TAG anomaly detection must jointly leverage both topological patterns and fine-grained textual semantics to capture nuanced anomalous behaviors. The current GNN-based anomaly detectors adopt holistic message-passing schemes that indiscriminately fuse structural proximity and textual semantics during propagation, leading to deep cross-modality coupling. This entanglement acts as a noise amplifier, obscuring subtle anomalous signals and directly giving rise to the Blurred-Anomaly-Boundary (BAB) issue by rendering normal-anomalous decision boundaries poorly separable. This challenge is further amplified for graph foundation models that require robust cross-domain generalization. To bridge this gap, we introduce a novel foundation model for TAG anomaly detection featuring decoupled topological and textual prototypes. Our framework constructs dual prototype banks to independently model structural normality and semantic consistency, effectively isolating anomaly cues that are otherwise diluted during coupled aggregation. Extensive experiments across 14 diverse benchmark datasets demonstrate that our method consistently achieves state-of-the-art performance in cross-domain settings. Notably, the ablation studies further corroborate the prevalence of the BAB issue in conventional coupled TAG anomaly detectors, and show that our decoupled prototype design effectively mitigates this challenge.
BAD is proposed, an unsupervised framework for anomaly detection in continuous-time dynamic graphs that represents nodes with learnable identity embeddings and performs pairwise compatibility modeling via cross-attention between each destination node and the source’s recent neighbors, enabling direct characterization of context-dependent deviations without requiring attributes.
Jia-Chi Luo, Sha-Meng Wen, Ziyan Qiu et al.· 0 citations
Enterprise security demands actionable threat prioritization across heterogeneous environments. To address the limitations of siloed log analysis, we propose a multi-source, graph-based anomaly detection framework. First, our architecture seamlessly fuses network telemetry from Vectra, Security Information and Event Management (SIEM) logs from QRadar, and endpoint data from CrowdStrike into a unified graph. Second, we utilize the Louvain algorithm to segment the network, identifying functional communities and critical bridge nodes indicative of lateral movement. Third, we extract over 50 structural, behavioral, and temporal features to train an XGBoost-based ensemble classifier. Evaluated on a real-world banking dataset with 31 anomaly types, the proposed system achieves 98% precision. Crucially, empirical analysis reveals that local neighborhood connectivity and traffic dynamics significantly outperform traditional global centrality metrics in detecting complex attacks. Finally, to support operational incident response, we implement a dynamic risk-scoring mechanism that translates model predictions into actionable, IP-level severity assessments across sliding time windows. Ultimately, this framework substantially enhances comprehensive threat visibility and analyst efficiency.
Çagatay Ates, Ilgin Safak, Fatih Alagöz et al.· International Conference on...· 0 citations
Graph anomaly detection plays a critical role in identifying irregular patterns in complex networked data arising in domains such as social networks, e-commerce systems, and cybersecurity. Existing approaches, particularly affinity-based methods, have demonstrated promising performance by leveraging local neighbourhood consistency. However, they often rely on a single anomaly indicator and lack an explicit mechanism to model normal behaviour, limiting their ability to detect subtle, heterogeneous anomalies. To address these challenges, this paper proposes a novel framework, prototype-regularised residual affinity maximisation (PRA-TAM), for unsupervised graph anomaly detection. The proposed method extends affinity-based learning by introducing a prototype-guided normality modelling mechanism that captures dominant patterns of normal nodes in the latent space using a compact set of learnable prototypes. In addition, a residual inconsistency calibration strategy is developed to quantify deviations across the feature, embedding, and neighbourhood spaces, enabling a more comprehensive assessment of node abnormality. To further enhance robustness, a lightweight multi-view learning strategy based on fixed graph truncation is employed to capture structural variations without introducing additional computational complexity. Extensive experiments across multiple benchmark datasets, including Facebook, ACM, Amazon, and YelpChi, demonstrate that the proposed method achieves competitive AUROC and AUPRC performance while demonstrating robust performance across multiple benchmark datasets and remains competitive on YelpChi. The results highlight the effectiveness of integrating affinity learning with prototype modelling and residual-based scoring for improved anomaly detection performance. The proposed framework is computationally efficient, scalable, and well-suited to real-world graph anomaly detection applications characterised by complex, heterogeneous data distributions.
Wasim Khan, Sujit R. Wakchaure, G. R. Bombale et al.· International Journal of Dat...· 0 citations
A novel framework, Generate and Filter graph learning for Graph Anomaly Detection (GFGAD), which generates a diverse set of synthetic anomalies with enriched feature and structural information to balance the data distribution and significantly outperforms state-of-the-art baselines.
Mengyu Li, Yonghao Liu, Ximing Li et al.· IEEE Transactions on Pattern...· 0 citations
In knowledge-intensive systems such as cybersecurity and financial risk control, graph data encode business rules, interaction constraints, and risk propagation paths through entities and relations. As a result, supervised graph anomaly detection (GAD) goes beyond conventional attribute outlier identification and becomes a problem of discovering anomalous structural behavior patterns. Under such conditions, the area under the precision–recall curve (AUPRC) better reflects practical risk-control objectives. From a mechanistic perspective, fixed neighborhood aggregation in end-to-end graph neural networks (GNNs) exhibits a low-pass bias in graph signal processing terms. At the same time, joint training tightly couples structural representation learning with a shallow classifier head of limited capacity, making high-curvature nonlinear decision boundaries difficult to learn under extreme imbalance and creating a capacity mismatch. However, upstream feature construction remains constrained by fixed low-pass operators, which creates spectral conflict because a strong classifier receives weak features. More importantly, structural camouflage is often common, whereas feature spectra may shift either left or right, leading to structural-spectral decoupling and spectral divergence. To address spectral conflict and capacity mismatch, we propose TAFH (Task-Aware Frequency Hybrid) for graph anomaly detection. TAFH explicitly decomposes multi-hop neighborhood propagation into low-frequency smooth components and high-frequency residual components, and then constructs an adaptive band-pass response through learnable hop weighting and node-level gated routing. To reduce objective drift under class imbalance, TAFH introduces a lightweight proxy head with a proxy objective, including a focal-loss variant, to inject hard-sample and minority-class preferences into representation learning. On the discrimination side, gradient boosted decision trees (XGBoost) provide high-capacity nonlinear interaction modeling through a decoupled boosting interface. Across five benchmark datasets (Reddit, YelpChi, Amazon, Tolokers, and Questions), TAFH consistently improves AUPRC over the strong baseline built from XGBoost and fixed neighborhood aggregation, with absolute gains from +1.12% to +6.35% and relative gains from 1.88% to 19.75%. These results show that supervised GAD can be cast as a coordinated process of structural knowledge encoding, adaptive frequency enhancement, and discriminative knowledge learning.
Tabular Anomaly Detection (TAD) plays a fundamental role in securing real-world applications. Despite rapid advances in TAD, the prohibitive cost of human-centric label annotation remains a primary bottleneck for large-scale production systems. To alleviate this bottleneck, we propose a novel ''coarse-to-fine'' label annotation pipeline to improve labor efficiency through a coarse-grained label annotation and fine-grained human verification. Specifically, Large Language Models (LLMs), with their strong cross-domain capabilities, serve as a promising solution for the coarse-grained annotation stage. However, effectively generalizing LLMs to coarse-grained annotation remains challenging due to the inability to ground semantic priors in rigorous deduction, as well as the overfitting risks inherent in single-domain fine-tuning. Accordingly, we introduce TaDGeneral, a large-scale cross-domain corpus constructed by fusing deductive reasoning paths from diverse domains. This design bridges the reasoning gap while preventing the memorization of local shortcuts. Building upon this, we develop TaDFM, a foundation model tailored to internalize generalizable deductive logic for effective zero-shot annotation. Extensive experiments on both public and large-scale real-world TAD datasets demonstrate the superiority of TaDFM over representative methods, with its practical value further validated by an industrial case study. Code: https://github.com/cshhzhao/TaDFM.
Haihong Zhao, Aochuan Chen, Miao Peng et al.· Proceedings of the 32nd ACM...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
