HRGCN: Heterogeneous Graph-level Anomaly Detection with Hierarchical
  Relation-augmented Graph Neural Networks
This work considers the problem of heterogeneous graph-level anomaly
detection. Heterogeneous graphs are commonly used to represent behaviours
between different types of entities in complex industrial systems for capturing
as much information about the system operations as possible. Detecting
anomalous heterogeneous graphs from a large set of system behaviour graphs is
crucial for many real-world applications like online web/mobile service and
cloud access control. To address the problem, we propose HRGCN, an unsupervised
deep heterogeneous graph neural network, to model complex heterogeneous
relations between different entities in the system for effectively identifying
these anomalous behaviour graphs. HRGCN trains a hierarchical
relation-augmented Heterogeneous Graph Neural Network (HetGNN), which learns
better graph representations by modelling the interactions among all the system
entities and considering both source-to-destination entity (node) types and
their relation (edge) types. Extensive evaluation on two real-world application
datasets shows that HRGCN outperforms state-of-the-art competing anomaly
detection approaches. We further present a real-world industrial case study to
justify the effectiveness of HRGCN in detecting anomalous (e.g., congested)
network devices in a mobile communication service. HRGCN is available at
https://github.com/jiaxililearn/HRGCN.
Jiaxi Li, Guansong Pang, Ling Chen, Mohammad-Reza Namazi-Rad
HRGCN: Heterogeneous Graph-level Anomaly Detection with Hierarchical Relation-augmented Graph Neural Networks

###### Abstract

This work considers the problem of heterogeneous graph-level anomaly detection. Heterogeneous graphs are commonly used to represent behaviours between different types of entities in complex industrial systems for capturing as much information about the system operations as possible. Detecting anomalous heterogeneous graphs from a large set of system behaviour graphs is crucial for many real-world applications like online web/mobile service and cloud access control. To address the problem, we propose HRGCN, an unsupervised deep heterogeneous graph neural network, to model complex heterogeneous relations between different entities in the system for effectively identifying these anomalous behaviour graphs. HRGCN trains a hierarchical relation-augmented Heterogeneous Graph Neural Network (HetGNN), which learns better graph representations by modelling the interactions among all the system entities and considering both source-to-destination entity (node) types and their relation (edge) types. Extensive evaluation on two real-world application datasets shows that HRGCN outperforms state-of-the-art competing anomaly detection approaches. We further present a real-world industrial case study to justify the effectiveness of HRGCN in detecting anomalous (e.g., congested) network devices in a mobile communication service. HRGCN is available at [https://github.com/jiaxilliearn/HRGCN](https://github.com/jiaxilliearn/HRGCN).

 GNN, Heterogeneous Graph, Anomaly Detection, Industrial Application

## I Introduction

Anomaly detection is an important area of data analytics and machine learning which involves the development of algorithms and techniques to identify deviations from normal behaviours. By distinguishing between normal and abnormal patterns, anomaly detection empowers organisations to proactively address emerging issues, prevent system failures, and enhance reliability [1]. In the realm of large and complex systems, such as cloud platforms and mobile/IoT networks, anomaly detection has garnered increasing attention in recent years [2]. These systems are characterised by their extensive data volumes, diverse services and their relations, presenting formidable challenges in detecting anomalous patterns, such as system performance degradation, unauthorised access, or malicious activities. Addressing these challenges requires comprehensive evaluations of behaviours involving diverse entities in the system. In this context, behaviour data is typically represented by graphs to capture the entity interactions. Figure 1 illustrates an example of normal and abnormal devices based on heterogeneous mobile networks/graphs involving two types of entities (users and devices) and multiple types of interactions among the entities. Although the users may occasionally encounter intermittent "bad" events, it does not necessarily imply that the entire graph exhibits abnormal behaviours. Therefore, a nuanced understanding of the complex inter-dependencies and interactions among the heterogeneous entities within the system is crucial for accurately detecting the anomalies.

There are three main streams of related anomaly detection approaches on graphs, including homogeneous-graph-based approaches [3, 4, 5], heterogeneous-graph-based approaches [6, 7, 8], and hybrid approaches considering both graph and non-graph data (e.g., system logs) [9]. Their common objective is to identify graph-level anomalies, i.e., exceptional graphs that deviate significantly from the other graphs. Compared with homogeneous-graph-based approaches that focus on dealing with graphs consisting of a single type of nodes

Fig. 1: Example mobile network events with heterogeneous entities and relations. Regular (green) vs. irregular (red) events and devices.