Graph neural network model improves anomaly detection across datasets
FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection
Machine LearningCryptography and Security
Summary
Detecting unusual patterns in graphs helps catch things like fraud and spam. Existing methods usually work well only on one specific dataset and struggle to handle different types of graphs. The authors designed FoundAna, a new model that combines graph neural networks and transformers to spot anomalies better across many kinds of graphs. FoundAna learns to represent nodes with extra information about their position, then finds anomalies by seeing how well it can reconstruct graph details. Tests show FoundAna works better than previous methods on diverse types of networks.
What this means in practice
- •For financial fraud analysts: Detect unusual transaction patterns across different financial networks more reliably with a single adaptable model.
- •For network security teams: Identify network intrusions by spotting anomalous structures in diverse communication graphs using a transferable detection method.
Authors
Suprim Nakarmi, Chahana Dahal, Yue Zhao, Junggab Son, Zuobin Xiong
Abstract
Graph anomaly detection aims to identify graph structures (e.g., nodes, edges, or subgraphs) that deviate significantly from expected patterns, which supports critical applications in fraud detection, spam identification, network intrusion, etc. Despite the growing methods in the field, existing approaches follow a one-model-per-dataset paradigm, limiting their transferability across diverse real-world scenarios due to task heterogeneity, label scarcity, and domain variability. In this work, we introduce FoundAna, a GNN-assisted Foundation Model for Graph Anomaly Detection - the first foundation model framework designated for generalizable, cross-graph anomaly detection by combining GNNs and transformers. FoundAna integrates an anomaly detection-specific GNN component with a standard transformer encoder augmented by four complementary positional encodings, which enable the model to capture both local and global structural information. Specifically, the positional encoding enriched node representations are passed through attribute and adjacency decoders, and the reconstruction errors serve as the anomaly score. Extensive experiments on nine benchmark datasets spanning financial, social, and citation network domains demonstrate that FoundAna consistently outperforms state-of-the-art baselines. The code implementation and Supplementary materials are here: https://github.com/FoundAna331/FoundAna.