Pith. sign in

REVIEW 5 major objections 6 minor 84 references

A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection

T0 review · 5 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This survey claims that the scattered field of HGNN-based cybersecurity anomaly detection can be organized by anomaly type (node, edge, subgraph) and by graph dynamics (static vs. temporal), and that the field's main bottleneck is the absen

desk verdict Useful prose orientation, but the core comparative tables are missing — as a reference it currently doesn't work. read the letter →

arxiv 2510.26307 v3 pith:T5ERGP2P submitted 2025-10-30 cs.CR cs.LG

Laura Jiang , Reza Ryan , Qian Li , Nasim Ferdosian This is my paper · ORCID
classification cs.CRcs.LG
keywords heterogeneousgraphneuralnetworksanomalydetectioncybersecuritytaxonomyinsiderthreatnetworkintrusiontemporalgraphsbenchmarkdatasets
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to bring order to a fragmented research area: using heterogeneous graph neural networks (HGNNs) to detect cyber anomalies. Its central proposal is a taxonomy that classifies methods by the type of graph element they flag as anomalous—node, edge, or subgraph—and by whether they operate on static or dynamic graphs. It then maps representative models to four cybersecurity settings (insider threats, network intrusion, access-log fraud, advanced persistent threats) and reviews the benchmark datasets and metrics the field uses. The payoff the authors intend is a structured foundation: a reader can see what approaches exist, where they fit, what they are evaluated on, and where the gaps are. The survey's value stands on whether its chosen set of 89 representative papers and its categories actually cover the field.

What carries the argument

The load-bearing object is the taxonomy itself: a two-axis classification (anomaly granularity × graph dynamics) with sub-groupings by learning strategy, presented through comparative tables that map each representative model to its supervision type, temporal capability, and architectural mechanism. The taxonomy does the argument's work by converting a scattered set of papers into comparable slots, which is also what lets the authors locate gaps such as the lack of unified static-temporal-semantic reasoning and the scarcity of realistic temporal benchmarks. The second supporting piece is the benchmark/metrics summary (AUROC, AUPRC, Precision@K, Recall@K, NDCG@K, F1), which grounds the claim

What would settle it

A systematic literature search of security and graph-learning venues from 2019 to 2025 that finds a substantial share of HGNN-based cyber anomaly detection papers fitting none of the three anomaly-granularity classes, or requiring category boundaries to be redrawn, would refute the survey's completeness claim. Likewise, checking a model placed in the 'temporal' family and finding it handles no timestamp information would refute the taxonomy's accuracy.

Watch

Extended reading notes

Core claim

On its own terms, the survey claims that the diverse HGNN-based anomaly detection literature can be organized along two axes—the granularity of the anomaly target (node, edge, or subgraph) and the presence of temporal dynamics (static vs. dynamic). Under this framing it groups node-level methods into reconstruction-based, attention/inconsistency-aware, contrastive, semi-supervised, and temporal families; edge-level methods into reconstruction, temporal, hierarchical, and adversarial/generative families; and subgraph-level methods into metapath/metagraph, structural-invariance/motif, temporal, one-class, knowledge-distillation, and hybrid families. It then shows how representative models such

Load-bearing premise

The survey assumes that its hand-selected set of 89 representative papers and its node/edge/subgraph categories faithfully and completely cover the field of HGNN-based cyber anomaly detection; if that sample is unrepresentative, the taxonomy and the derived gap analysis lose validity.

Editorial extensions

If this is right

  • If the taxonomy is right, new HGNN anomaly detection papers can be positioned in one of the categories, making cross-method comparison easier.
  • The claimed gaps imply that unified frameworks jointly modeling structure, semantics, and time are the field's open frontier.
  • The evaluation review implies that reported results on Cora, Amazon, CICIDS2017, and similar datasets are not directly comparable; adopting standardized benchmarks would change which models look best.
  • The application mapping implies that models from other domains (e.g., rumor detection) transfer to insider threat and APT detection, an insight available to subsequent research.
  • The survey's open-challenges section implies that scalability, interpretability, and streaming deployment should be part of future evaluation, not just detection accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A reader can use the node/edge/subgraph axis as a selection guide, but the taxonomy may be underdetermined: many real anomalies span levels (an anomalous node inside a clique), so a strictly categorical assignment may obscure the multi-resolution nature of attacks.
  • The survey's identification of 'static benchmarks' as a bottleneck suggests a concrete testable prediction: a dynamically annotated, heterogeneous benchmark suite would reshuffle current performance rankings of models like DOMINANT versus temporal HGNNs.
  • The absence of a systematic search protocol opens the door to extending this survey into a full systematic review; doing so would either validate or revise the claimed 89-paper coverage.
  • Practitioners could operationalize the gap analysis: a deployable system should prioritize handling temporal drift and partial observability, which the survey repeatedly singles out as missing from current evaluations.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper is a survey of heterogeneous graph neural network (HGNN) methods for anomaly detection in cybersecurity. It proposes a taxonomy organized by anomaly granularity (node-level, edge-level, subgraph-level) and graph dynamics (static versus dynamic), discusses representative models in Section 3, maps them to four cybersecurity application domains in Section 4, reviews evaluation metrics and benchmark datasets in Section 5, and lists open challenges in Section 6. The stated contribution is to provide a structured, comparative reference for a fragmented literature, with Tables 1–6 as the vehicle for that comparison.

Significance. A reliable survey of HGNN-based anomaly detection for cybersecurity would fill a genuine gap: the field is fragmented, lacks standardized benchmarks, and is difficult to navigate. The paper's prose identifies relevant organizing dimensions—structural versus semantic versus temporal anomaly evidence, label scarcity, class imbalance, and evaluation inconsistency—and the high-level taxonomy is sensible. It does not offer new models, proofs, or code; its value is entirely organizational. That value is currently unrealized because the tables and accurate method-to-reference mappings are not present, so readers cannot verify the survey's central claims.

major comments (5)
  1. [§3 and §5, Tables 1–6] Tables 1–6 are captions only; no table body appears. The text repeatedly refers to these tables as the location of the proposed taxonomy and the comparative analyses (e.g., §3: 'Table 1 presents the proposed taxonomy...' and 'Table 2 presents this taxonomy...'; §5: 'Table 5 summarizes the core evaluation metrics' and 'Table 6 summarizes the key characteristics of each benchmark dataset'). Without the table bodies, readers cannot inspect which models are assigned to which category, what supervision/temporal/architecture features are compared, or how datasets are characterized. This is not a presentational issue; it is the paper's central deliverable, and it is missing.
  2. [§7 and References] The conclusion states 'We reviewed over 100+ studies and cited 89 representative papers.' The bibliography contains 86 numbered references, and at least two are duplicates: [10] and [68] are both Hu et al., 'Heterogeneous Graph Transformer,' and [23] and [73] are both Moustafa & Slay, 'UNSW-NB15.' The unique cited count is therefore ≤84. No systematic search or inclusion criteria are reported, so the 'comprehensive' claim is unverifiable and the 89/100+ statement is internally inconsistent.
  3. [§4.1, §5.2.2, References] Several dataset citations are wrong. In §4.1, 'CERT [72]' points to Brown et al., 'Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection,' not to the CERT insider-threat dataset; CERT appears correctly as [71] (and [22]). In §5.2.2, CTU-13 is cited as [76], but [76] is the DARPA/Unicorn paper; CTU-13 is [75]. These mismatches make the dataset-to-model mappings unreliable.
  4. [§3.1–§3.3] Several model descriptions are not supported by the cited references. SemiGNN is introduced in §3.1 as a fraud-detection model with hierarchical attention over metapath subgraphs, but [39] is 'SemiGNN-PPI,' a protein–protein interaction prediction paper. Bi-GCN in §3.2 is described as a bidirectional message-passing rumor-detection model, but [53] is 'Bi-GCN: Binary Graph Convolutional Network' for image classification. AANE in §3.2 is said to be an adversarial autoencoder, but [55] is 'Accelerated Attributed Network Embedding.' HON-GAT in §3.3 is described as a motif-based subgraph anomaly detector, but [61] is 'HONGAT: Graph Attention Networks in the Presence of High-Order Neighbors' for node classification. These are not citation typos; they misassign methods within the taxonomy that is the survey's main contribution.
  5. [§4.4] The 'CAIDA APT simulation dataset [77]' is cited to 'APT datasets and attack modeling for automated detection methods: A review' (Stojanović et al.), which is a survey, not a dataset. The sentence 'OCAN has been evaluated on the CERT Insider Threat Dataset [71]' attributes an evaluation to OCAN that the cited OCAN paper (one-class adversarial nets) does not report; CERT is not among that paper's benchmarks. These errors further reduce confidence in the application mapping in Section 4.
minor comments (6)
  1. [§2.1.2, §2.1.3] The same sentences are repeated verbatim, and an incomplete placeholder 'such as ....' appears in §2.1.2. The schema example in §2.1.3 is also stated twice.
  2. [§4.1] 'the released by Los Alamos National Laboratory' is a grammatical fragment with a missing dataset name.
  3. [References] Duplicates [10]=[68] and [23]=[73] should be merged. Several references have incomplete metadata, e.g., [41], [60], and [86].
  4. [§3.3] The text uses 'HON-GAT' while reference [61] is 'HONGAT'; use one consistent acronym.
  5. [§5.2.2] 'eBay transaction graph [85]' cites the eBay product dataset, which is not a transaction graph with fraud labels; the actual dataset should be identified or the sentence revised.
  6. [Abstract, §1, §2.4] The abstract and contributions list call the taxonomy 'novel,' but §2.4 explicitly says the graph-centric taxonomy is adopted from prior surveys [6,7,17]. Please soften or justify the novelty claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the survey's taxonomy and method summaries are externally attributed, and no derivation reduces to its own inputs.

full rationale

This is a survey paper, not a derivation or experimental study. Its central artifacts are a taxonomy, method categorizations, and tables of datasets/metrics. The taxonomy is explicitly inherited from external prior work: 'Following recent surveys [6,7,17], this paper instead adopts a graph-centric taxonomy' — an attribution to independent sources, not a self-referential justification. The metric equations (2)-(6) are standard definitions, not fitted parameters renamed as predictions. Model descriptions are summaries of cited external papers, and the authors do not cite their own prior work as load-bearing evidence. The only serious defect is completeness/verifiability: Tables 1-6 appear only as captions with no bodies, and the 'reviewed over 100+ studies and cited 89 representative papers' claim is not auditable from the 86 references (with apparent duplicates such as [10]/[68] and [23]/[73]). These are correctness and reproducibility concerns, not circularity. No claim in the manuscript reduces by construction to its own assumptions, so the circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new entities, parameters, or mathematical axioms; the listed assumptions are literature-coverage and framing assumptions inherent to the survey method.

assumptions (3)
  • domain assumption The manually selected set of papers is representative of HGNN-based anomaly detection research
    The survey claims comprehensiveness but provides no systematic selection methodology; representativeness is assumed (Section 1, Section 7).
  • domain assumption The node/edge/subgraph anomaly taxonomy from [6,7,17] is an appropriate organizing frame
    The survey explicitly follows prior surveys in Section 2.4; the suitability for cybersecurity HGNNs is assumed, not demonstrated.
  • domain assumption Heterogeneous graph representation is a valid and useful abstraction for cybersecurity data
    The premise of the entire survey; no evidence is provided in the paper beyond citations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection." pith.science (2026). https://pith.science/paper/T5ERGP2P

@misc{pith2026251026307,
  author       = {Pith},
  title        = {Pith review of: A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T5ERGP2P}},
  note         = {Machine review of arXiv:2510.26307}
}
read the original abstract

Anomaly detection is a critical task in cybersecurity, where identifying insider threats, access violations, and coordinated attacks is essential for ensuring system resilience. Graph-based approaches have become increasingly important for modeling entity interactions, yet most rely on homogeneous and static structures, which limits their ability to capture the heterogeneity and temporal evolution of real-world environments. Heterogeneous Graph Neural Networks (HGNNs) have emerged as a promising paradigm for anomaly detection by incorporating type-aware transformations and relation-sensitive aggregation, enabling more expressive modeling of complex cyber data. However, current research on HGNN-based anomaly detection remains fragmented, with diverse modeling strategies, limited comparative evaluation, and an absence of standardized benchmarks. To address this gap, we provide a comprehensive survey of HGNN-based anomaly detection methods in cybersecurity. We introduce a taxonomy that classifies approaches by anomaly type and graph dynamics, analyze representative models, and map them to key cybersecurity applications. We also review commonly used benchmark datasets and evaluation metrics, highlighting their strengths and limitations. Finally, we identify key open challenges related to modeling, data, and deployment, and outline promising directions for future research. This survey aims to establish a structured foundation for advancing HGNN-based anomaly detection toward scalable, interpretable, and practically deployable solutions.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

84 extracted references

  1. [76]

    Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

    Han X, Pasquier T, Bates A, et al. Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats. Proceedings 2020 Network and Distributed System Security Symposium. Reston, VA: Internet Society; 2020

    2020

  2. [75]

    An empirical comparison of botnet detection methods

    García S, Grill M, Stiborek J, et al. An empirical comparison of botnet detection methods. Comput Secur. 2014; 45:100–123

    2014

  3. [72]

    Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

    Brown A, Tuor A, Hutchinson B, et al. Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection. Proceedings of the First Workshop on Machine Learning for Computing Systems. New York, NY, USA: ACM; 2018. p. 1–8

    2018

  4. [71]

    CERT Insider Threat Dataset [Internet]

    Lindauer B. CERT Insider Threat Dataset [Internet]. Carnegie Mellon University; 2020 [cited 2025 Jun 12]. Available from: https://kilthub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247/1

    arXiv 2020

  5. [10]

    Heterogeneous graph attention network

    Wang X, Ji H, Cui P, et al. Heterogeneous graph attention network. The Web Conference 2019 - Proceedings of the World Wide Web Conference, WWW 2019. 2019

    2019

  6. [68]

    Heterogeneous Graph Transformer

    Hu Z, Dong Y, Wang K, et al. Heterogeneous Graph Transformer. Proceedings of The Web Conference 2020. New York, NY, USA: ACM; 2020. p. 2704–2710

    2020

  7. [73]

    UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)

    Moustafa N, Slay J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). 2015 Military Communications and Information Systems Conference (MilCIS). IEEE; 2015. p. 1–6

    2015

  8. [22]

    Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data

    Glasser J, Lindauer B. Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data. 2013 IEEE Security and Privacy Workshops. IEEE; 2013. p. 98–104

    2013

  9. [39]

    SemiGNN-PPI: Self-Ensembling Multi-Graph Neural Network for Efficient and Generalizable Protein–Protein Interaction Prediction

    Zhao Z, Qian P, Yang X, et al. SemiGNN-PPI: Self-Ensembling Multi-Graph Neural Network for Efficient and Generalizable Protein–Protein Interaction Prediction. Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence. California: International Joint Conferences on Artificial Intelligence Organization; 2023. p. 4984–4992

    2023

  10. [53]

    Bi-GCN: Binary Graph Convolutional Network

    Wang J, Wang Y, Yang Z, et al. Bi-GCN: Binary Graph Convolutional Network. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE

    2021

  11. [55]

    Accelerated Attributed Network Embedding

    Huang X, Li J, Hu X. Accelerated Attributed Network Embedding. Proceedings of the 2017 SIAM International Conference on Data Mining. Philadelphia, PA: Society for Industrial and Applied Mathematics; 2017. p. 633–641

    2017

  12. [61]

    HONGAT: Graph Attention Networks in the Presence of High-Order Neighbors

    Zhang H-K, Zhang Y-G, Zhou Z, et al. HONGAT: Graph Attention Networks in the Presence of High-Order Neighbors. Proceedings of the AAAI Conference on Artificial Intelligence. 2024; 38(15):16750–16758

    2024

  13. [77]

    APT datasets and attack modeling for automated detection methods: A review

    Stojanović B, Hofer-Schmitz K, Kleb U. APT datasets and attack modeling for automated detection methods: A review. Comput Secur. 2020; 92:101734

    2020

Show all 84 references
  1. [1]

    Anomaly Detection in Dynamic Graphs via Transformer

    Liu Y, Pan S, Wang YG, et al. Anomaly Detection in Dynamic Graphs via Transformer. IEEE Trans Knowl Data Eng. 2023; 35(12):12081–12094

    2023

  2. [2]

    Cybersecurity knowledge graphs

    Sikos LF. Cybersecurity knowledge graphs. Knowl Inf Syst. 2023;65(9)

    2023

  3. [3]

    The graph neural network model

    Scarselli F, Gori M, Tsoi AC, et al. The graph neural network model. IEEE Trans Neural Netw. 2009; 20(1):61–80

    2009

  4. [4]

    Heterogeneous graph neural network

    Zhang C, Song D, Huang C, et al. Heterogeneous graph neural network. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Association for Computing Machinery; 2019. p. 793–803

    2019

  5. [5]

    Survey of Graph Neural Network

    Wang J, Kong L, Huang Z, et al. Survey of Graph Neural Network. Jisuanji Gongcheng/Computer Engineering. 2021; 47(4)

    2021

  6. [6]

    Anomaly Detection in Graph Structured Data: A Survey

    Lamichhane PB, Eberle W. Anomaly Detection in Graph Structured Data: A Survey. 2024

    2024

  7. [7]

    A Comprehensive Survey on Graph Anomaly Detection With Deep Learning

    Ma X, Wu J, Xue S, et al. A Comprehensive Survey on Graph Anomaly Detection With Deep Learning. IEEE Trans Knowl Data Eng. 2023; 35(12)

    2023

  8. [8]

    A Comprehensive Survey on Graph Neural Networks

    Wu Z, Pan S, Chen F, et al. A Comprehensive Survey on Graph Neural Networks. IEEE Trans Neural Netw Learn Syst. 2021; 32(1)

    2021

  9. [9]

    Semi‐supervised classification of fundus images combined with CNN and GCN

    Duan S, Huang P, Chen M, et al. Semi‐supervised classification of fundus images combined with CNN and GCN. J Appl Clin Med Phys. 2022; 23(12)

    2022

  10. [12]

    SchemaWalk: Schema Aware Random Walks for Heterogeneous Graph Embedding

    Samy AE, Giaretta L, Kefato ZT, et al. SchemaWalk: Schema Aware Random Walks for Heterogeneous Graph Embedding. Companion Proceedings of the Web Conference 2022. New York, NY, USA: ACM; 2022. p. 1157–1166

    2022

  11. [13]

    Temporal Graph Networks for Deep Learning on Dynamic Graphs

    Rossi E, Chamberlain B, Frasca F, et al. Temporal Graph Networks for Deep Learning on Dynamic Graphs. 2020

    2020

  12. [14]

    Learning under Concept Drift: A Review

    Lu J, Liu A, Dong F, et al. Learning under Concept Drift: A Review. IEEE Trans Knowl Data Eng. 2019

    2019

  13. [15]

    Interactive Anomaly Detection on Attributed Networks

    Ding K, Li J, Liu H. Interactive Anomaly Detection on Attributed Networks. Proceedings of the Twelfth ACM International Conference on Web Search and Data Mining. New York, NY, USA: ACM; 2019. p. 357–365

    2019

  14. [16]

    One-Class Intrusion Detection with Dynamic Graphs

    Liuliakov A, Schulz A, Hermes L, et al. One-Class Intrusion Detection with Dynamic Graphs. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). 2023

    2023

  15. [17]

    Deep anomaly detection on attributed networks

    Ding K, Li J, Bhanushali R, et al. Deep anomaly detection on attributed networks. SIAM International Conference on Data Mining, SDM 2019. 2019

    2019

  16. [18]

    MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning

    Jia Z, Xiong Y, Nan Y, et al. MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning. 2023

    2023

  17. [19]

    Detection of Thin Boundaries between Different Types of Anomalies in Outlier Detection Using Enhanced Neural Networks

    Kiani R, Keshavarzi A, Bohlouli M. Detection of Thin Boundaries between Different Types of Anomalies in Outlier Detection Using Enhanced Neural Networks. Applied Artificial Intelligence. 2020; 34(5)

    2020

  18. [20]

    Contextual anomaly detection framework for big sensor data

    Hayes MA, Capretz MA. Contextual anomaly detection framework for big sensor data. J Big Data. 2015; 2(1)

    2015

  19. [21]

    Fast flux discriminant for large-scale sparse nonlinear classification

    Chen W, Chen Y, Weinberger KQ. Fast flux discriminant for large-scale sparse nonlinear classification. Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining. New York, NY, USA: ACM; 2014. p. 621–630

    2014

  20. [24]

    Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs

    Cai L, Chen Z, Luo C, et al. Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs. International Conference on Information and Knowledge Management, Proceedings. 2021

    2021

  21. [25]

    Modeling Relational Data with Graph Convolutional Networks

    Schlichtkrull M, Kipf TN, Bloem P, et al. Modeling Relational Data with Graph Convolutional Networks. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). 2018

    2018

  22. [26]

    Unsupervised Deep Subgraph Anomaly Detection

    Zhang Z, Zhao L. Unsupervised Deep Subgraph Anomaly Detection. Proceedings - IEEE International Conference on Data Mining, ICDM. 2022

    2022

  23. [27]

    SubAnom: Efficient Subgraph Anomaly Detection Framework over Dynamic Graphs

    Zhang C, Xiang W, Guo X, et al. SubAnom: Efficient Subgraph Anomaly Detection Framework over Dynamic Graphs. 2023 IEEE International Conference on Data Mining Workshops (ICDMW). IEEE; 2023. p. 1178–1185

    2023

  24. [28]

    Structural-Temporal Coupling Anomaly Detection with Dynamic Graph Transformer

    Zong C, Zhuang Y, Shao J, et al. Structural-Temporal Coupling Anomaly Detection with Dynamic Graph Transformer. 2025

    2025

  25. [29]

    Temporal subgraph contrastive learning for anomaly detection on dynamic attributed graphs

    Yu Y, Li X, Shao M, et al. Temporal subgraph contrastive learning for anomaly detection on dynamic attributed graphs. Applied Intelligence. 2025; 55(7):667

    2025

  26. [30]

    Higher-order Structure Based Anomaly Detection on Attributed Networks

    Yuan X, Zhou N, Yu S, et al. Higher-order Structure Based Anomaly Detection on Attributed Networks. Proceedings - 2021 IEEE International Conference on Big Data, Big Data 2021. 2021

    2021

  27. [31]

    Hypergraph neural networks

    Feng Y, You H, Zhang Z, et al. Hypergraph neural networks. 33rd AAAI Conference on Artificial Intelligence, AAAI 2019, 31st Innovative Applications of Artificial Intelligence Conference, IAAI 2019 and the 9th AAAI Symposium on Educational Advances in Artificial Intelligence, E...

    2019

  28. [32]

    PREM: A Simple Yet Effective Approach for Node-Level Graph Anomaly Detection

    Pan J, Liu Y, Zheng Y, et al. PREM: A Simple Yet Effective Approach for Node-Level Graph Anomaly Detection. 2023

    2023

  29. [33]

    Li Y, Huang X, Li J, et al. SpecAE. Proceedings of the 28th ACM International Conference on Information and Knowledge Management. New York, NY, USA: ACM

  30. [34]

    A Deep Multi-View Framework for Anomaly Detection on Attributed Networks (Extended Abstract)

    Peng Z, Luo M, Li J, et al. A Deep Multi-View Framework for Anomaly Detection on Attributed Networks (Extended Abstract). 2023 IEEE 39th International Conference on Data Engineering (ICDE). IEEE; 2023. p. 3799–3800

    2023

  31. [35]

    Semi-supervised classification with graph convolutional networks

    Kipf TN, Welling M. Semi-supervised classification with graph convolutional networks. 5th International Conference on Learning Representations, ICLR 2017 - Conference Track Proceedings. 2017

    2017

  32. [36]

    Alleviating the Inconsistency Problem of Applying Graph Neural Network to Fraud Detection

    Liu Z, Dou Y, Yu PS, et al. Alleviating the Inconsistency Problem of Applying Graph Neural Network to Fraud Detection. Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval. New York, NY, USA: ACM; 2020. p. 1569–1572

    2020

  33. [37]

    Graph Contrastive Learning for Anomaly Detection

    Chen B, Zhang J, Zhang X, et al. Graph Contrastive Learning for Anomaly Detection. 2021

    2021

  34. [38]

    Self-supervised Heterogeneous Graph Neural Network with Co-contrastive Learning

    Wang X, Liu N, Han H, et al. Self-supervised Heterogeneous Graph Neural Network with Co-contrastive Learning. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2021

    2021

  35. [40]

    Multiple Rumor Source Detection with Graph Convolutional Networks

    Dong M, Zheng B, Quoc Viet Hung N, et al. Multiple Rumor Source Detection with Graph Convolutional Networks. Proceedings of the 28th ACM International Conference on Information and Knowledge Management. New York, NY, USA: ACM; 2019. p. 569– 578

    2019

  36. [41]

    Graph Neural Network-Based Anomaly Detection in Multivariate Time Series [Internet]

    Deng A, Hooi B. Graph Neural Network-Based Anomaly Detection in Multivariate Time Series [Internet]. 2021. Available from: www.aaai.org

    2021

  37. [42]

    One-Class Adversarial Nets for Fraud Detection

    Zheng P, Yuan S, Wu X, et al. One-Class Adversarial Nets for Fraud Detection. Proceedings of the AAAI Conference on Artificial Intelligence. 2019; 33(01):1286–1293

    2019

  38. [43]

    GCAN: Graph-aware Co-Attention Networks for Explainable Fake News Detection on Social Media

    Lu Y-J, Li C-T. GCAN: Graph-aware Co-Attention Networks for Explainable Fake News Detection on Social Media. Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Stroudsburg, PA, USA: Association for Computational Linguistics; 2020. p. 505–514

    2020

  39. [44]

    HRGCN: Heterogeneous Graph-level Anomaly Detection with Hierarchical Relation-augmented Graph Neural Networks

    Li J, Pang G, Chen L, et al. HRGCN: Heterogeneous Graph-level Anomaly Detection with Hierarchical Relation-augmented Graph Neural Networks. 2023 IEEE 10th International Conference on Data Science and Advanced Analytics (DSAA). IEEE; 2023. p. 1–10

    2023

  40. [45]

    XG-NID: Dual-modality network intrusion detection using a heterogeneous graph neural network and large language model

    Farrukh YA, Wali S, Khan I, et al. XG-NID: Dual-modality network intrusion detection using a heterogeneous graph neural network and large language model. Expert Syst Appl. 2025; 287:128089

    2025

  41. [46]

    SpotLight: Detecting anomalies in streaming graphs

    Eswaran D, Faloutsos C, Guha S, et al. SpotLight: Detecting anomalies in streaming graphs. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2018

    2018

  42. [47]

    EdgeCentric: Anomaly Detection in Edge-Attributed Networks

    Shah N, Beutel A, Hooi B, et al. EdgeCentric: Anomaly Detection in Edge-Attributed Networks. IEEE International Conference on Data Mining Workshops, ICDMW. 2016

    2016

  43. [48]

    xFraud: Explainable Fraud Transaction Detection

    Rao SX, Zhang S, Han Z, et al. xFraud: Explainable Fraud Transaction Detection. Proceedings of the VLDB Endowment. 2021

    2021

  44. [49]

    Anonymous Edge Representation for Inductive Anomaly Detection in Dynamic Bipartite Graph

    Fang L, Feng K, Gui J, et al. Anonymous Edge Representation for Inductive Anomaly Detection in Dynamic Bipartite Graph. Proceedings of the VLDB Endowment. 2023; 16(5):1154–1167

    2023

  45. [50]

    eFraudCom: An E-commerce Fraud Detection System via Competitive Graph Neural Networks

    Zhang G, Li Z, Huang J, et al. eFraudCom: An E-commerce Fraud Detection System via Competitive Graph Neural Networks. ACM Trans Inf Syst. 2022; 40(3):1–29

    2022

  46. [51]

    AddGraph: Anomaly Detection in Dynamic Graph Using Attention-based Temporal GCN

    Zheng L, Li Z, Li J, et al. AddGraph: Anomaly Detection in Dynamic Graph Using Attention-based Temporal GCN. 2019

    2019

  47. [52]

    A Flexible Attentive Temporal Graph Networks for Anomaly Detection in Dynamic Networks

    Zhu D, Ma Y, Liu Y. A Flexible Attentive Temporal Graph Networks for Anomaly Detection in Dynamic Networks. 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE; 2020. p. 870–875

    2020

  48. [54]

    Hierarchical Graph Convolutional Networks for Semi- supervised Node Classification

    Hu F, Zhu Y, Wu S, et al. Hierarchical Graph Convolutional Networks for Semi- supervised Node Classification. 2019

    2019

  49. [56]

    CatchSync: Catching synchronized behavior in large directed graphs

    Jiang M, Cui P, Beutel A, et al. CatchSync: Catching synchronized behavior in large directed graphs. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2014

    2014

  50. [57]

    FRAUDAR: Bounding graph fraud in the face of camouflage

    Hooi B, Song HA, Beutel A, et al. FRAUDAR: Bounding graph fraud in the face of camouflage. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2016

    2016

  51. [58]

    Anomaly Subgraph Detection through High-Order Sampling Contrastive Learning

    Sun Y, Wang W, Wu N, et al. Anomaly Subgraph Detection through High-Order Sampling Contrastive Learning. Proceedings of the Thirty-ThirdInternational Joint Conference on Artificial Intelligence. California: International Joint Conferences on Artificial Intelligence Organizatio...

    2024

  52. [59]

    MHGNN: Multi-view fusion based Heterogeneous Graph Neural Network

    Li C, Zhu X, Yan Y, et al. MHGNN: Multi-view fusion based Heterogeneous Graph Neural Network. Applied Intelligence. 2024; 54(17–18):8073–8091

    2024

  53. [60]

    Heterogeneous Graph Matching Networks for Unknown Malware Detection [Internet]

    Wang S, Chen Z, Yu X, et al. Heterogeneous Graph Matching Networks for Unknown Malware Detection [Internet]. 2019. Available from: www.symantec.com/security- center/threat-report

    2019

  54. [62]

    Human-related anomalous event detection via spatial-temporal graph convolutional autoencoder with embedded long short-term memory network

    Li N, Chang F, Liu C. Human-related anomalous event detection via spatial-temporal graph convolutional autoencoder with embedded long short-term memory network. Neurocomputing. 2022; 490:482–494

    2022

  55. [63]

    Improving Cyberbullying Detection with User Interaction

    Ge S, Cheng L, Liu H. Improving Cyberbullying Detection with User Interaction. Proceedings of the Web Conference 2021. New York, NY, USA: ACM; 2021. p. 496– 506

    2021

  56. [64]

    OCGATL: One-Class Graph Attention Networks with Transformation Learning for Anomaly Detection for Argo Data

    Jiang Y, Liu H, Wang J, et al. OCGATL: One-Class Graph Attention Networks with Transformation Learning for Anomaly Detection for Argo Data. 2024. p. 152–173

    2024

  57. [65]

    OCGNN: One-class Classification with Graph Neural Networks

    Wang X, Du Y, Cui P, et al. OCGNN: One-class Classification with Graph Neural Networks

  58. [66]

    Deep Graph-level Anomaly Detection by Glocal Knowledge Distillation

    Ma R, Pang G, Chen L, et al. Deep Graph-level Anomaly Detection by Glocal Knowledge Distillation. Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining. New York, NY, USA: ACM; 2022. p. 704–714

    2022

  59. [67]

    GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection

    Zhang S, Yin H, Chen T, et al. GCN-Based User Representation Learning for Unifying Robust Recommendation and Fraudster Detection. SIGIR 2020 - Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval. Association for Compu...

    2020

  60. [69]

    HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows

    Milajerdi SM, Gjomemo R, Eshete B, et al. HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows. 2019 IEEE Symposium on Security and Privacy (SP). IEEE; 2019. p. 1137–1152

    2019

  61. [70]

    Generative adversarial networks

    Goodfellow I, Pouget-Abadie J, Mirza M, et al. Generative adversarial networks. Commun ACM. 2020; 63(11)

    2020

  62. [74]

    A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems

    Panigrahi R, Borah S. A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems. International Journal of Engineering and Technology(UAE). 2018; 7(3.24 Special Issue 24)

    2018

  63. [78]

    Receiver Operating Characteristic (ROC) Curves: The Basics and Beyond

    Chang PW, Newman TB. Receiver Operating Characteristic (ROC) Curves: The Basics and Beyond. Hosp Pediatr. 2024; 14(7):e330–e334

    2024

  64. [79]

    CHAD: Charlotte Anomaly Dataset

    Danesh Pazho A, Alinezhad Noghre G, Rahimi Ardabili B, et al. CHAD: Charlotte Anomaly Dataset. 2023. p. 50–66

    2023

  65. [80]

    Collective Classification in Network Data

    Sen P, Namata G, Bilgic M, et al. Collective Classification in Network Data. AI Mag. 2008; 29(3):93–106

    2008

  66. [81]

    Graph Convolutional Matrix Completion [Internet]

    Van Den Berg R, Kipf TN, Welling M. Graph Convolutional Matrix Completion [Internet]. 2018. Available from: https://github.com/riannevdberg/gc-mc

    2018

  67. [82]

    2023 [cited 2025 Jun 12]

    Yelp Dataset [Internet]. 2023 [cited 2025 Jun 12]. Available from: https://www.yelp.com/dataset

    2023

  68. [83]

    Authoritative sources in a hyperlinked environment

    Kleinberg JM. Authoritative sources in a hyperlinked environment. Journal of the ACM. 1999; 46(5):604–632

    1999

  69. [84]

    SedanSpot: Detecting Anomalies in Edge Streams

    Eswaran D, Faloutsos C. SedanSpot: Detecting Anomalies in Edge Streams. 2018 IEEE International Conference on Data Mining (ICDM). IEEE; 2018. p. 953–958

    2018

  70. [85]

    2021 [cited 2025 Jun 12]

    Ebay Product Dataset [Internet]. 2021 [cited 2025 Jun 12]. Available from: https://www.kaggle.com/datasets/promptcloud/ebay-product-dataset

    2021

  71. [86]

    Open Graph Benchmark: Datasets for Machine Learning on Graphs Steering Committee [Internet]

    Hu W, Fey M, Zitnik M, et al. Open Graph Benchmark: Datasets for Machine Learning on Graphs Steering Committee [Internet]. Available from: https://ogb.stanford.edu

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.