Early Anomaly Detection by Learning and Forecasting Behavior

Graph anomaly detection systems aim at identifying suspicious accounts or behaviors on social networking sites and e-commercial platforms. Detecting anomalous users at an early stage is crucial to minimize financial loss. When a great amount of observed behavior data are available, existing methods perform effectively though it may have been too late to avoid the loss. However, their performance would become unsatisfactory when the observed data are quite limited at the early stage. In this work, we propose Eland, a novel framework that uses behavior data augmentation for early anomaly detection. It has a Seq2Seq-based behavior predictor that predicts (i) whether a user will adopt a new item or an item that has been historically adopted and (ii) which item will be adopted. Eland exploits the mutual enhancement between behavior prediction and graph anomaly detection. The behavior graph is augmented with the predicted behaviors such that the graph-based anomaly detection methods can achieve better performance, and the detection results can support the behavior predictor in return. Experiments show that Eland improves the performance of a variety of graph-based anomaly detection methods. With the augmented methods in Eland, the performance of anomaly detection at an earlier stage is comparable with or better than non-augmented methods on a greater amount of observation.