Collective cognitive anomalies: a survey of techniques for detection and assessment

Cognitive security is recognized as an emerging direction in cyberspace security, with collective cognitive security identified as its academic frontier. To systematically summarize and analyze the main methods, collective cognitive security was divided into two subtasks group detection and group anomaly detection. The former primarily utilizes community detection techniques, while the latter mainly relies on graph anomaly detection methods. Community detection was categorized into local community detection and global community detection, whereas graph anomalies were classified into node/edge-level anomalies and subgraph/graph-level anomalies. Main concepts, fundamental theories, and representative methods were systematically reviewed, with comparative analyses conducted to evaluate the strengths and limitations of existing approaches. Future research directions were also prospected.