The paper introduces Unsupervised Graph Collective Anomaly Detection (UGCAD), a framework that uses a variational graph autoencoder to learn graph representations of IoT network traffic and then enhances clustering to group nodes. UGCAD identifies collective anomalies by aggregating normal clusters and applying anomaly scores to the refined groups. Experiments on CICIoT2023 and ToN-IoT datasets show that UGCAD outperforms traditional and state‑of‑the‑art clustering‑based CAD methods in both clustering quality and anomaly detection accuracy.
By Dalila Khettaf, Djamel Djenouri, Zeinab Rezaeifar, Youcef Djenouri
FoundAna is a GNN‑assisted foundation model designed for graph anomaly detection across diverse datasets. It combines a GNN component with a transformer encoder enhanced by four positional encodings to capture both local and global structure, using reconstruction errors as anomaly scores. Experiments on nine benchmark datasets from financial, social, and citation networks show that FoundAna consistently outperforms state‑of‑the‑art baselines.
By Suprim Nakarmi, Chahana Dahal, Yue Zhao, Junggab Son, Zuobin Xiong
arXiv:2510. 26307v3 Announce Type: replace-cross Abstract: Anomaly detection is a critical task in cybersecurity, where identifying insider threats, access violations, and coordinated attacks is essential for ensuring system resilience.
By Laura Jiang, Reza Ryan, Qian Li, Nasim Ferdosian
arXiv:2511. 22078v2 Announce Type: replace Abstract: Many real-world scenarios involving streaming information can be represented as temporal graphs, where data flows through dynamic changes in edges over time.
By Simone Mungari, Albert Bifet, Giuseppe Manco, Bernhard Pfahringer
arXiv:2606. 00304v1 Announce Type: new Abstract: Graph anomaly detection methods aim to distinguish anomalous nodes.
By Yilin Liu, Hongchao Zhang, Taylor T. Johnson, Ahmad F. Taha, Meiyi Ma
The paper introduces an unsupervised hypergraph neural network designed to detect anomalous hyperedges—higher-order associations that deviate from typical patterns. Unlike conventional graph methods that capture only pairwise relationships, this approach leverages hypergraphs to model associations among any number of entities. Experiments on real-life datasets show the model effectively identifies unusual hyperedges without requiring labeled data.
By Md. Tanvir Alam, Md. Mahmudur Rahman, Md. Fahim Arefin, Chowdhury Farhan Ahmed, Zisan Mahmud, Md. Sadman Sakib, Carson K. Leung
The paper introduces a deep positive‑unlabeled anomaly detection framework that combines positive‑unlabeled learning with deep models such as autoencoders and deep support vector data descriptions. It addresses the issue of contaminated unlabeled data by approximating anomaly scores for normal data using both unlabeled and labeled anomaly samples, allowing training without labeled normal data. The authors provide a theoretical generalization error bound and demonstrate improved detection performance over existing methods on several datasets.
By Hiroshi Takahashi, Tomoharu Iwata, Atsutoshi Kumagai, Yuuki Yamanaka
arXiv:2606. 17109v1 Announce Type: cross Abstract: Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs).
By Jianli Dai, Guangwei Wu, Jiacheng Li, Weiping Wang, An He, Xinjun Xiao
arXiv:2606. 12673v1 Announce Type: cross Abstract: Cross-domain graph anomaly detection (GAD) aims to identify abnormal nodes in unseen target graphs, showing strong potential in real-world applications with heterogeneous graph data.
By Phan Nguyen, Dat Cao, Hien Chu, Khue Hoang
arXiv:2505. 21285v5 Announce Type: replace Abstract: This work proposes a framework LGKDE that learns kernel density estimation for graphs.
By Xudong Wang, Ziheng Sun, Chris Ding, Jicong Fan
arXiv:2602. 20019v2 Announce Type: replace-cross Abstract: Dynamic graph anomaly detection is critical for many real-world applications but remains challenging due to the scarcity of labeled anomalies.
By Yuxing Tian, Yiyan Qi, Fengran Mo, Weixu Zhang, Jian Guo, Jian-Yun Nie
arXiv:2509. 17987v2 Announce Type: replace Abstract: Graph Neural Networks (GNNs) have emerged as powerful models for anomaly detection in sensor networks, particularly when analyzing multivariate time series.
By Sanju Xaviar, Omid Ardakanian