arXiv:2608. 12441v1 Announce Type: cross Abstract: Deep learning detectors for anomalies in dynamic graphs have reached strong accuracy, yet they remain opaque: when an edge is flagged, the analyst receives a score but no reason.
arXiv:2608. 15559v1 Announce Type: cross Abstract: Anomaly detection in dynamic graphs underpins financial fraud analysis, intrusion detection, and platform integrity, where automated decisions require human-interpretable justifications.
arXiv:2608. 15965v1 Announce Type: new Abstract: Progress in streaming, edge-level graph anomaly detection (GAD) has been marked by increasingly elaborate architectures, from count-min-sketch chi square tests to memory-augmented attention networks.
arXiv:2604. 17616v3 Announce Type: replace Abstract: Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems.
SiST‑GNN introduces a simultaneous spatial‑temporal message‑passing framework for dynamic graph neural networks, fusing per‑node temporal embeddings with spatial aggregation in a single operation. By maintaining a recurrent hidden state per node and treating it as a cross‑time edge, the model jointly reasons over topology and evolution. Experiments on link‑prediction and node‑classification benchmarks show significant improvements over prior methods, achieving up to 158% gains in live‑update link prediction and outperforming discrete‑time baselines by 7–23% in dynamic node classification.
arXiv:2608. 19858v1 Announce Type: new Abstract: Generalizable dynamic graph anomaly detection (DGAD) enables pretrained detectors to identify anomalies in unseen target domains without costly retraining.
TH-GNN is a heterogeneous temporal graph neural network designed to detect shilling attacks generated by large language model (LLM) agents. It combines a two‑layer Heterogeneous Graph Transformer with per‑type and per‑relation attention, learnable sinusoidal temporal encodings, cross‑modal attention that fuses user embeddings with frozen RoBERTa representations of reviews and item descriptions, and a GRU that models log inter‑arrival times. Across five attack families and four benchmark datasets, TH‑GNN achieves a grand‑mean F1 score of 0.870, surpassing the best text‑only baseline on Agent4SR attacks by 10.9 percentage points and 11.5 percentage points at the lowest injection rate.
Generalizable dynamic graph anomaly detection (DGAD) enables pretrained detectors to identify anomalies in unseen target domains without costly retraining. However, existing methods often fail for two reasons.
arXiv:2610.01168v1 Announce Type: cross Abstract: Time Series Anomaly Detection has received increasing attention, driven by the growing availability of complex time series data. This surge has led t...
arXiv:2606. 05756v1 Announce Type: new Abstract: Graph Neural Networks (GNNs) have demonstrated remarkable performance across a range of applications involving graph-structured data, particularly in high-stakes domains.
FoundAna is a GNN‑assisted foundation model designed for graph anomaly detection across diverse datasets. It combines a GNN component with a transformer encoder enhanced by four positional encodings to capture both local and global structure, using reconstruction errors as anomaly scores. Experiments on nine benchmark datasets from financial, social, and citation networks show that FoundAna consistently outperforms state‑of‑the‑art baselines.
WAND is an unsupervised tabular anomaly detector that scores each point by how far its projection on unit‑sphere directions deviates from a sub‑Gaussian baseline. The directions that flag a point serve as its explanation, providing per‑feature attribution at no extra cost and recoverable via gradients. On 47 ADBench datasets, WAND matches or exceeds 16 baselines in ROC‑AUC while delivering more accurate, faithful explanations than post‑hoc SHAP, LIME, or ECOD, all with linear scoring time and a probe‑efficiency guarantee.
DIFFINT is a reconstruction‑based anomaly detector that uses a differentiable autoencoder with a latent bottleneck composed of soft, axis‑aligned interval memberships. Each latent unit represents a human‑readable hyper‑rectangle in feature space, allowing the model to encode how strongly an instance falls inside each interval and to compute reconstruction error as the anomaly score. The method provides a certified lower bound on reconstruction error for points outside all active intervals, a suppression mechanism for sparse abnormalities, and a closed‑form, label‑free importance ranking for each (unit, feature) pair, achieving top performance on 48 ADBench benchmarks against 22 baselines.