Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs

TLDR

Detecting anomalies in dynamic graphs is vital for security, finance, and social media, yet existing embedding methods largely ignore subgraph structural changes around target nodes. This paper proposes StrGNN, an end‑to‑end structural temporal graph neural network for detecting anomalous edges in dynamic graphs. StrGNN extracts h‑hop enclosing subgraphs around target edges, labels nodes to capture roles, applies graph convolution and Sortpooling to produce fixed‑size features per snapshot, and feeds these into GRUs to model temporal dynamics for anomaly detection. StrGNN was fully implemented and deployed in an enterprise security system, effectively detecting advanced threats and improving incident response, and experiments on six benchmark datasets confirm its effectiveness.

Abstract

Detecting anomalies in dynamic graphs is a vital task, with numerous practical applications in areas such as security, finance, and social media. Existing network embedding based methods have mostly focused on learning good node representations, whereas largely ignoring the subgraph structural changes related to the target nodes in a given time window. In this paper, we propose StrGNN, an end-to-end structural temporal Graph Neural Network model for detecting anomalous edges in dynamic graphs. In particular, we first extract the h-hop enclosing subgraph centered on the target edge and propose a node labeling function to identify the role of each node in the subgraph. Then, we leverage the graph convolution operation and Sortpooling layer to extract the fixed-size feature from each snapshot/timestamp. Based on the extracted features, we utilize the Gated Recurrent Units to capture the temporal information for anomaly detection. We fully implement StrGNN and deploy it into a real enterprise security system, and it greatly helps detect advanced threats and optimize the incident response. Extensive experiments on six benchmark datasets also demonstrate the effectiveness of StrGNN.