# GCN-based Multi-task Representation Learning for Anomaly Detection in
Attributed Networks

Venus Haghighi  School of Computing, Macquarie University1 Thørväld
CircleSydneyNSWAustralia<EMAIL_ADDRESS>,  Behnaz Soltani
School of Computing, Macquarie University1 Thørväld CircleSydneyNSWAustralia
<EMAIL_ADDRESS>,  Adnan Mahmood  School of Computing, Macquarie
University 1 Thørväld CircleSydneyNSWAustralia<EMAIL_ADDRESS>,  Quan
Z. Sheng  School of Computing, Macquarie University 1 Thørväld
CircleSydneyNSWAustralia<EMAIL_ADDRESS>and  Jian Yang  School of
Computing, Macquarie University1 Thørväld CircleSydneyNSWAustralia
<EMAIL_ADDRESS>
(2022)

###### Abstract.

Anomaly detection in attributed networks has received a considerable attention
in recent years due to its applications in a wide range of domains such as
finance, network security, and medicine. Traditional approaches cannot be
adopted on attributed networks’ settings to solve the problem of anomaly
detection. The main limitation of such approaches is that they inherently
ignore the relational information between data features. With a rapid
explosion in deep learning- and graph neural networks-based techniques,
spotting rare objects on attributed networks has significantly stepped forward
owing to the potentials of deep techniques in extracting complex
relationships. In this paper, we propose a new architecture on anomaly
detection. The main goal of designing such an architecture is to utilize
multi-task learning which will enhance the detection performance. Multi-task
learning-based anomaly detection is still in its infancy and only a few
studies in the existing literature have catered to the same. We incorporate
both community detection and multi-view representation learning techniques for
extracting distinct and complementary information from attributed networks and
subsequently fuse the captured information for achieving a better detection
result. The mutual collaboration between two main components employed in this
architecture, i.e., community-specific learning and multi-view representation
learning, exhibits a promising solution to reach more effective results.

Graph convolutional networks, deep neural networks, attributed networks,
anomaly detection

††copyright: acmcopyright††journalyear: 2022††doi:
XXXXXXX.XXXXXXX††conference: Workshop on Mobility in the Evolving Internet
Architecture; 21st Oct, 2022; Sydney, NSW, Australia††price: 15.00††isbn:
978-1-4503-XXXX-X/18/06††ccs: Security and privacy Intrusion/anomaly detection
and malware mitigation††ccs: Computing methodologies Multi-task learning††ccs:
Computing methodologies Neural networks

##  1\. Introduction

Anomalies are defined as abnormal instances which significantly deviate from
the standard or normal patterns (hawkins1980identification, ). Anomaly
detection is a data mining process, which aims to identify those rare and
abnormal objects amongst a swarm of normal objects (aggarwal2017introduction,
). In the area of computer science, the research on anomaly detection dates
back to the 1980s and has a wide range of applications in various domains,
including but not limited to, spam detection in social networks, financial
fraud detection, healthcare abuse monitoring systems, and intrusion detection
in computer networks (chandola2009anomaly, ). As attributed networks have been
widely used for modelling complex and real-world systems, anomaly detection in
attributed networks has gained attention of researchers in both academia and
industry as a vital research challenge. In attributed networks, nodes
represent real-world objects and the edges represent their relationships.
Comparing to plain networks, nodes and/or edges in attributed networks are
associated with a set of attributes. Thus, attributed networks encompass both
structure and attribute information, which is invaluable in the process of
anomaly detection. The main research question is _how to develop an effective
anomaly detection process on attributed networks by taking the advantages of
both structure and attribute information_.

Anomaly detection in attributed networks aims to identify anomalous network
objects (i.e., nodes, edges, or the accumulation of nodes and edges). Many
techniques have investigated for anomaly detection in attributed networks
(akoglu2015graph, ). The first group of approaches rely on statistical models,
which have natural limitations for capturing complex relationships. As a
result, this group of techniques are unable to detect new types of anomalies
and cannot easily scale for large networks (akoglu2010oddball, ;
li2014probabilistic, ). Secondly, traditional machine learning techniques such
as CUR matrix factorization (mahoney2009cur, ) and Support Vector Machines
(SVM) (li2017radar, ) have been proposed for the purpose of anomaly detection
in networks. This group of techniques cannot be easily scaled for large-scale
data efficiently. Furthermore, they suffer from high computational overhead in
both execution time and memory. The aforementioned techniques are also not
capable of capturing the non-linear properties of real-world objects in
attributes networks. Hence, practically, the objects’ representations learned
via them are not rich enough to support the process of anomaly detection. To
address these challenges, recent efforts have been made to utilize the
potential of deep learning techniques for the purpose of detecting anomalous
objects in attributed networks (ma2021comprehensive, ). More recent research
has been conducted for adopting Graph Neural Networks (GNNs) in the process of
anomaly detection in attributed networks. First introduced in (gori2005new, ),
GNNs are powerful tools for capturing the complex interactions of structure
and attributes in networks and have achieved great success amongst existing
approaches. Among all proposed architectures, one of the most outstanding type
is the Graph Convolutional Networks (GCNs) (kipf2016semi, ). The main idea of
GCNs is aggregating local features from local graph neighbourhood to generate
a new representation for a given node. Graph Attention Networks (GATs)
allocate different weights to different nodes in a local neighbourhood
(velivckovic2017graph, ).

Anomalous nodes can be divided into three types: global, structural, and
community anomalies. Global anomalies are nodes that have attributes
significantly different from all other nodes in a network. Structural
anomalies are those nodes that create unusual connections with other nodes
(e.g., nodes forming dense links with other nodes or having connections with
different communities). Community anomalies are considered as nodes that have
different attributes compared to other nodes in the same community. In some
literature, community anomalies are also named as local anomalies
(ma2021comprehensive, ).

In this paper, we investigate the problem of encoding attributed networks
under multiple views to a new shared space for extracting useful information.
As different views usually correspond to different patterns and exhibit their
own unique statistical features, multi-view representations provide distinct
but complementary information for extracting more effective nodes’ embedding
in attributed networks. Figure 1 illustrates different types of views, which
can be utilized to define a Social Internet of Things (SIoT) network such as a
smart city. The first view can encompass basic device information like device
ID, device type, and device brand. Second view could include friendship
expressed in terms of the the number of interactions and the time of
interactions between a specific device and its connected nodes. The third view
may potentially contain co-work relationship between two devices in a SIoT
network delineated the number of successful services when two nodes have in
common in order to deliver to a third node. The service rating is another
feature in the third view which is measured by the nodes receiving a specific
service. The fourth view can consider data shared through out the network
(aljubairy2020siotpredict, ; sagar2022understanding, ). Most of the existing
studies have neglected the inherent multi-view properties of data, and treated
all data features equally by concatenating them in a shared single space. In
this framework, multi-view representation learning is one of the prominent
modules for improving the process of anomaly detection.

We also incorporate community-specific representation learning module in the
proposed framework to reduce the over-smoothing problem of convolutional
operation of GNNs. Over-smoothing can lead to sub-optimal results and make
nodes’ representations more similar, making the recognition of abnormal nodes
less effective (wu2020comprehensive, ).

The rest of the paper is organized as follows. Section 2 briefly introduces
the relevant work in the literature. Section 3 describes our problem and its
related definitions. The new proposed framework is discussed in Section 4, and
finally, Section 5 offers some concluding remarks.

Figure 1. Different types of views for Social Internet of Things networks

##  2\. Related Work

A quick glimpse of literature reveals that anomaly detection has been
primarily addressed in two sorts of networks, i.e., plain networks and
attributed networks. In plain networks, the only available information is of
the network structure such as node degree. Therefore, by utilizing some
structural information, anomalous nodes can be recognized. OddBall
(akoglu2010oddball, ) detects anomalies based on the egonet patterns in plain
networks. In addition, (ding2012intrusion, ) introduces a fundamental concept
of intrusion, i.e., entering a community which one does not belong to, for
detecting malicious network sources. In this method, a community detection
algorithm alongside a recursive search and pruning strategy have been applied
for finding cut-vertices which have the highest probability of being
classified as anomalies. Furthermore, as attributed networks have been
increasingly promoted due to their power in modeling real-world information
systems, many anomaly detection methods have been proposed in this area. CODA
(gao2010community, ) is a probabilistic model to detect community anomalies in
attributed networks. Some other studies adopted residual analysis to spot
anomalous nodes (li2017radar, ; peng2018anomalous, ). Anomalous
(peng2018anomalous, ) combines residual analysis and CUR decomposition
simultaneously for the purpose of anomaly detection in attributed networks.

In recent years, some GNN-based methods have been proposed for spotting
anomalies in attributed networks. DOMINANT (ding2019deep, ) is one of the
first studies in this area, wherein the authors leveraged GCN for nodes
embedding representations by aggregating neighbors’ attributes information for
the learning process. Subsequently, the reconstruction errors of nodes’
representations are utilized for ranking anomalous nodes in attributed
networks. COLA (liu2021anomaly, ) is a contrastive self-supervised learning
framework based on GNN for anomaly detection in attributed networks. This
framework fully exploits the local information by sampling a new type of
contrastive instance pair that ascertains relationships between each node and
its neighbors. Some other related works designed GNN-based models to mitigate
the over-smoothing of convolutional process in GNNs. ResGCN (pei2022resgcn, )
applies the residual-based mechanism and prevents over-smoothing problem
during the process of nodes’ representations. ComGA (luo2022comga, ) is a new
community-aware deep GCN model for avoiding the problem of over-smoothing in
the convolutional process, thereby making anomalous nodes more
distinguishable. ALARM (peng2020deep, ) aims at improving the performance of
anomaly detection process by considering the inherent multi-view property of
data in attribute space. The said architecture supports both self-learning and
user-guided learning modes which enables users to interfere in the process of
anomaly detection based on their needs.

Our proposed framework, taking the advantage of both multi-view representation
learning and community-specific representation learning, aims at achieving
more effective detection results. We describe the proposed framework in detail
in the following sections.

##  3\. Problem Statement

In this section, we introduce some definitions about attributed networks,
multi-view attributed networks, and modularity matrix. Then, the research
problem of this paper will be introduced.

Definition 1 (Attributed Networks).  A static attributed network $G=(V,E,X)$
consists of a node set $V=\\{v_{1},v_{2},…,v_{n}\\}$ where $|V|=n$ and an edge
set $E$ where $|E|=m$. The nodes attributes matrix $X\in R^{n\times d}$, here
the $i-th$ row vector $x_{i}$ is the attributes value for the nodes $v_{i}$.

Definition 2 (Multi-View Attributed Networks). In multi-view attributed
networks, each node $v_{i}$ is associated with a set of $d-dimensional$
features $F={f_{1},f_{2},...,f_{d}}$ which can be represented by $K$ distinct
views or feature spaces.

Definition 3 (Modularity Matrix). Modularity is a metric which represents
arrangement of edges statistically. It quantifies the number of edges falling
within group minus the expected number in as equivalent network with edges
placed at random. The modularity value indicates the possible presence of
community structure. Modularity matrix $B=[b_{ij}]$ of network can be defined
as: $b_{ij}=a_{ij}-k_{i}k_{j}/2m$ where $a_{ij}$ is the probability of
existing edges between nodes $v_{i}$ and $v_{j}$ belonging to the same
community, $k_{i}k_{j}/2m$ is the expected number of edges between nodes
$v_{i}$ and $v_{j}$ which are placed randomly, $k_{i}$ is the degree of node
$v_{i}$, and $m=\frac{1}{2}\sum_{i}k_{i}$ is the total number of
edges(newman2006modularity, ).

Research Problem. Given a multi-view attributed network $G$ represented by
adjacency matrix $A$ and K-view attributes $X=(X^{1},X^{2},...,X^{k})$, where
$X^{i}$ is the attribute vector corresponding to the $i^{th}$ view with the
dimensions of $D_{i}$. the problem aims to detect nodes that differ
significantly from the majority nodes from the perspectives of structure and
attributes.

##  4\. The Proposed Framework

In this section, we illustrate the new proposed multi-task learning
architecture in Figure 2. The entire framework includes four main components.
First, multi-view representation learning component adopts multiple graph
neural networks (GNNs) for the purpose of embedding the given multi-view
attributed network. Second, community-specific representation learning module
aims at capturing community structure of the given attributed network.
Community-specific representation module leverages both autoencoder and graph
neural network (GNN) to encode the structure of the given attributed network.
Third component of the proposed framework is aggregator. Aggregating multi-
task representation learned from the first and second components is handled in
this module in order to reach a unified representation across all tasks. After
the training process, the anomalies are ranked in the last component which is
named anomaly detection module. The ranking process is done based on the
calculated joint reconstruction errors from both perspectives of attributes
and structure. The larger the reconstruction error have, the more likely the
nodes are to be anomalous on the network. In the next sub-sections, each of
the proposed components will be introduced in details.

Figure 2. Multi-task learning framework for anomaly detection on attributed
networks. Nodes marked by red color indicate anomalies in the given network.

###  4.1. Multi-View Representation Module

The multi-view representation learning module consists of multiple independent
GNNs to learn knowledge from each view separately. We adopt deep graph
convolutional networks (GCNs), which is one of the most prominent models in
GNNs. Each view is fed into a separate GCN for the learning process. The core
of GCN updates the feature vector $h_{i}$ which corresponds to each node
$v_{i}$. The updating process is then calculated via aggregating features of
its neighboring nodes $v_{j}$:

(1) $\ h_{i}^{(l)}=f_{relu}\left(\sum_{{v_{j}\in{v_{i}}\cup
N(v_{i})}}a_{ij}W^{(l)}h_{j}^{(l-1)}\right),$

where $h_{i}^{(l)}$ is the learned representation corresponding to node
$v_{i}$ at the $l^{th}$ layer, $W^{(l)}$ is trainable weight matrix at the
$l^{th}$ layer, $f_{relu}(x)=max(0,x)$ is a non-linear activation function,
$a_{ij}$ is the $(i,j)^{th}$ entry of $\hat{A}$ which is calculated by
$(\hat{A}=D^{-\frac{1}{2}}\bar{A}D^{-\frac{1}{2}},\bar{A}=A+I_{n},D_{ii}=\sum_{j}\bar{A_{ij}})$,
and $h_{i}^{(0)}$ is the original attribute vector of node $v_{i}$. The non-
linear activation function $f_{relu}$ can capture the non-linear relationships
between data by considering both attribute information $X$ and graph structure
$A$. As a result of convolution operations, each of these GCNs produces a
learned high-quality embedding representation $U_{i}$ from different views.

###  4.2. Community-Specific Representation Module

We utilize a deep autoencoder architecture to capture the community structure
of graphs by avoiding the problem of linear mapping process of traditional
community detection methods. According to the constructed modularity matrix
$B$ of the graph, the learning process is initiated. In fact, The modularity
matrix represents the division of nodes in different communities. The
autoencoder consists of two main components: the first component is encoder,
and the second one is decoder. The community-specific learned representation
corresponding to $l^{th}$ layer is defined as (luo2022comga, ):

(2) $\ H^{l}=f_{relu}\left(W^{l}H^{l-1}+b^{l}\right),$

where $f_{relu}$ is the activation function, $W^{l}$ and $b^{l}$ represent the
trainable weight matrix and bias of the $l^{th}$ iteration in the encoder,
respectively. The input of encoder $H^{0}$ is the modularity matrix $B$.

In the decoder part, we reconstruct the original data from the learned
representation of the encoder:

(3) $H^{\prime l}=f_{relu}\left(W^{l}H^{\prime l-1}+b^{l}\right)$

The reconstruction loss function of the autoencoder is presented as follows:

(4) $\ L_{res}=\|B-\hat{B}\|_{F}^{2},$

where $\hat{B}$ is the estimated modularity matrix by decoder, and
$\|B-\hat{B}\|_{F}$ is the Frobenius norm.The next step is fusing the learned
modularity matix $\hat{B}$ into a GCN model for encoding the attributed
network based on the learned modularity matrix $\hat{B}$, attributed matrix
$X$, and structure information $A$. Thus, the network representation of the
$l^{th}$ layer in GCN mode, $Z_{l}$, can be learned by the following equation:

(5) $\
Z^{l}=f_{relu}\left(D^{-\frac{1}{2}}\bar{A}D^{-\frac{1}{2}}W^{l-1}Z^{l-1}\right),$

where $\bar{A}=A+I_{n}$, $D_{ii}=\sum_{j}\bar{A_{ij}}$, $I$ is the identity
diagonal matrix of the adjacency matrix $A$, and $W$ is the weight matrix of
graph convolutional network.

Therefore, the community-specific module takes community structure information
(modularity matrix $B$), node attributes ($X$), and network structure ($A$) as
its input, and then extracts more effective node embedding representations by
combining the two learned representations $Z^{l}$ and $H^{l}$ as follows:

(6) $\ K=\left(Z^{l}\|H^{l}\right).$

###  4.3. Aggregation Module

Aggregation module aims at bringing all low-dimensional representations of
both multi-view representations component and community-specific
representations component in a shared space. It is significant to put
emphasize on the fact that each of these learned representations provides us
with distinct and complementary description of data on the given attributed
network.Therefore, taking the advantage of complementary information between
different representations to aggregate multiple representations is more
sensible. In this section, we consider two kinds of aggregation strategies
which are described in the following.

Concatenation: All learned representations of both multi-view representations
module and community-specific representation module are concatenated into a
new shared vector space. This solution is one of the traditional strategies
for combining all of learned representations together.

Weighted Aggregation: In this strategy, different weights are given to the
different learned representations from both modules, and then summing up them.
In fact, each of these learned representations has a distinct proportion in
the final representation. Hence, the final result $Q$ is described as the
following:

(7) $\small\ Q=\left\\{Q|Q=\sum_{i=1}^{k}\alpha_{i}U_{i}+\beta
K,\alpha_{i}\geq 0,\beta\geq 0,\sum_{i=1}^{k}\alpha_{i}+\beta=1\right\\}$

###  4.4. Anomaly Detection Module

The output of aggregation module is a combined encoded representation $Q$ from
multiple perspectives. In this section, we focus on the reconstruction of the
the original attributed network from the combined encoded representation. The
corresponding reconstruction error can be considered as a measure for anomaly
detection. Anomaly detection module consists of two main parts, namely 1)
Structure Decoder, and 2) Attribute Decoder.

Structure Decoder: The structure decoder takes the latent representation $Q$
as input and then decodes it for the purpose of reconstruction of the original
adjacency matrix which is named $\tilde{A}$. Anomalous nodes are determined
from the perspective of structure by the calculation of inner product between
them as follows:

(8) $\ \tilde{A}=sigmoid\left(QQ^{T}\right).$

Structure reconstruction error can be an indicator for detecting anomalous
nodes on the given attributed network. The structure of a specific node can be
well reconstructed through the structure decoder if the node has the low
probability of being anomalous. In other word, anomalous nodes can not be
fully reconstructed because they do not comply with the majority of data.

Attribute Decoder: For determining the anomalous nodes from the perspective of
attributes, we utilize a fully-connected graph convolutional network to take
the learned latent representation $Q$ as input and decode it to generate
reconstructed attribute information as follows:

(9) $\ \tilde{X}=f_{relu}\left(ZW+B\right),$

where $W$ is a trainable weighted matrix, and $B$ is the bias term. The
combined reconstruction error from the both perspectives of structure and
attribute can be defined as follows:

(10) $\ L=L_{s}+L_{a},$

where $L_{s}$ is structure loss function, $L_{a}$ is attribute loss function,
and $L$ is total loss function which can be defined as sum of structure and
attribute loss functions. For measuring the quality of reconstruction
structure and attribute information, Frobenius norm can be used as follows:

(11) $\ L=(1-\lambda)||A-\tilde{A}||_{F}^{2}+\lambda||X-\tilde{X}||_{F}^{2},$

where $\lambda$ is the balance parameter between the structure and attributes
reconstructions. The anomaly detection module aims at minimizing the above
defined joint loss function to measure the score of anomalous nodes on the
given attributed network.

##  5\. Conclusion

In this paper, we propose a novel deep framework that supports multi-task
learning for improving the performance of anomaly detection in attributed
networks. The main idea behind our framework is to utilize multi-task learning
that contains two main components, i.e., multi-view representation learning
and community-specific representation learning. Subsequently, aggregation of
the proposed components contributes to more effective low-dimensional nodes’
representations and reveals more anomalous nodes. Based on the theoretical
results, our model can be regarded as a potential approach for enhancing the
performance of anomaly detection process in attributed networks. In the
future, we will validate our proposed framework via experimental studies using
both synthetic and real-world datasets.

## References

  * [1] Douglas M Hawkins.  Identification of Outliers, volume 11.  Springer, 1980.
  * [2] Charu C Aggarwal.  An Introduction to Outlier Analysis.  In Outlier Analysis, pages 1–34. Springer, 2017.
  * [3] Varun Chandola, Arindam Banerjee, and Vipin Kumar.  Anomaly Detection: A Survey.  ACM Computing Surveys, 41(3):1–58, 2009.
  * [4] Leman Akoglu, Hanghang Tong, and Danai Koutra.  Graph based Anomaly Detection and Description: A Survey.  Data Mining and Knowledge Discovery, 29(3):626–688, 2015.
  * [5] Leman Akoglu, Mary McGlohon, and Christos Faloutsos.  Oddball: Spotting Anomalies in Weighted Graphs.  In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 410–421. Springer, 2010.
  * [6] Nan Li, Huan Sun, Kyle Chipman, Jemin George, and Xifeng Yan.  A Probabilistic Approach to Uncovering Attributed Graph Anomalies.  In Proceedings of the 2014 SIAM International Conference on Data Mining, pages 82–90. SIAM, 2014.
  * [7] Michael W Mahoney and Petros Drineas.  CUR Matrix Decompositions for Improved Data Analysis.  Proceedings of the National Academy of Sciences, 106(3):697–702, 2009.
  * [8] Jundong Li, Harsh Dani, Xia Hu, and Huan Liu.  Radar: Residual Analysis for Anomaly Detection in Attributed Networks.  In IJCAI, pages 2152–2158, 2017.
  * [9] Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu.  A Comprehensive Survey on Graph Anomaly Detection with Deep Learning.  IEEE Transactions on Knowledge and Data Engineering, 2021.
  * [10] Marco Gori, Gabriele Monfardini, and Franco Scarselli.  A New Model for Learning in Graph Domains.  In Proceedings. 2005 IEEE International Joint Conference on Neural Networks, volume 2, pages 729–734, 2005.
  * [11] Thomas N Kipf and Max Welling.  Semi-supervised Classification with Graph Convolutional Networks.  arXiv preprint arXiv:1609.02907, 2016.
  * [12] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio.  Graph Attention Networks.  arXiv preprint arXiv:1710.10903, 2017.
  * [13] Abdulwahab Aljubairy, Wei Emma Zhang, Quan Z Sheng, and Ahoud Alhazmi.  Siotpredict: A Framework for Predicting Relationships in the Social Internet of Things.  In International Conference on Advanced Information Systems Engineering, pages 101–116. Springer, 2020.
  * [14] Subhash Sagar, Adnan Mahmood, Quan Z Sheng, Jitander Kumar Pabani, and Wei Emma Zhang.  Understanding the Trustworthiness Management in the Social Internet of Things: A Survey.  arXiv preprint arXiv:2202.03624, 2022.
  * [15] Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip.  A Comprehensive Survey on Graph Neural Networks.  IEEE Transactions on Neural Networks and Learning Systems, 32(1):4–24, 2020.
  * [16] Qi Ding, Natallia Katenka, Paul Barford, Eric Kolaczyk, and Mark Crovella.  Intrusion as (Anti) Social Communication: Characterization and Detection.  In Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 886–894, 2012.
  * [17] Jing Gao, Feng Liang, Wei Fan, Chi Wang, Yizhou Sun, and Jiawei Han.  On Community Outliers and Their Efficient Detection in Information Networks.  In Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 813–822, 2010.
  * [18] Zhen Peng, Minnan Luo, Jundong Li, Huan Liu, and Qinghua Zheng.  ANOMALOUS: A Joint Modeling Approach for Anomaly Detection on Attributed Networks.  In IJCAI, pages 3513–3519, 2018.
  * [19] Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu.  Deep Anomaly Detection on Attributed Networks.  In Proceedings of the 2019 SIAM International Conference on Data Mining, pages 594–602. SIAM, 2019.
  * [20] Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis.  Anomaly Detection on Attributed Networks via Contrastive Self-Supervised Learning.  IEEE Transactions on Neural Networks and Learning Systems, 2021\.
  * [21] Yulong Pei, Tianjin Huang, Werner van Ipenburg, and Mykola Pechenizkiy.  ResGCN: Attention-based Deep Residual Modeling for Anomaly Detection on Attributed Networks.  Machine Learning, 111(2):519–541, 2022.
  * [22] Xuexiong Luo, Jia Wu, Amin Beheshti, Jian Yang, Xiankun Zhang, Yuan Wang, and Shan Xue.  ComGA: Community-aware Attributed Graph Anomaly Detection.  In Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, pages 657–665, 2022.
  * [23] Zhen Peng, Minnan Luo, Jundong Li, Luguo Xue, and Qinghua Zheng.  A Deep Multi-view Framework for Anomaly Detection on Attributed Networks.  IEEE Transactions on Knowledge and Data Engineering, 2020.
  * [24] Mark EJ Newman.  Modularity and Community Structure in Networks.  Proceedings of the National Academy of Sciences, 103(23):8577–8582, 2006.