DuDi: Dual-Scope Discrepancy-Aware Attributed Network Anomaly Detection

In attributed networks, capturing the correlation between different scopes is crucial to detect anomalies, but few methods focus on modeling the correlation discrepancy of normal and abnormal nodes between different scopes for anomaly detection. Further analysis shows that normal nodes show strong correlation between global and local scopes, while abnormal nodes show weak correlation between the two scopes. Inspired by this perspective, we present aDual-scopeDiscrepancy-aware attributed network anomaly detection method (DuDi), to capture macro normal patterns of nodes while reducing noise perturbations based on graph diffusion convolution, and micro patterns of nodes with local graph sampling strategies, respectively, resulting in weak correlation between macro and micro scopes for abnormal nodes, while strong correlation between the two scopes for normal nodes. Based on the dual-scope correlation discrepancy of normal and abnormal nodes, we design a discrepancy-aware anomaly score with Canonical Correlation Analysis (CCA) for anomaly detection. Comprehensive experiments conducted on four real-world datasets showcase the efficacy of DuDi compared to state-of-the-art methods. The experiments show that DuDi achieves significant performance improvements, with up to 6.14% improvement in AUC and 10.33% improvement in AP over the best baselines across multiple datasets.