NMFAD: Neighbor-Aware Mask-Filling Attributed Network Anomaly Detection

Abstract

As a widely adopted protocol for anomaly detection in attributed networks, reconstruction error prioritizes comprehensive feature extraction to detect anomalies over interrogating the differential representation between normal and abnormal nodes. Intuitively, in attributed networks, normal nodes and their neighbors often exhibit similarities, whereas abnormal nodes demonstrate behaviors distinct from their neighbors. Hence, normal nodes can be accurately represented through their neighbors and effectively reconstructed. As opposed to normal nodes, abnormal nodes represented by their neighbors may be erroneously reconstructed as normal, resulting in increased reconstruction error. Leveraging from this observation, we propose a novel anomaly detection protocol called Neighbor-aware Mask-Filling Anomaly Detection (NMFAD) for attributed networks, aiming to maximize the variability between original and reconstructed features of abnormal nodes filled with information from their neighbors. Specifically, we utilize random-mask on nodes and integrate them into the backbone Graph Neural Networks (GNNs) to map nodes into a latent space. Subsequently, we fill the masked nodes with embeddings from their neighbors and smooth the abnormal nodes closer to the distribution of normal nodes. This optimization improves the likelihood of the decoder to reconstructing abnormal nodes as normal, thereby maximizing the reconstruction error of abnormal nodes. Experimental results demonstrate that, compared to the existing models, NMFAD exhibits superior performance.in attributed networks.