Dynamic graph anomaly detection with adaptive agent control under delayed feedback
DynGraphAgentBench: A Benchmark for Agentic Lifecycle Control in Dynamic Graph Anomaly Detection
Machine Learning
Summary
Detecting unusual patterns in networks can be tricky when the network changes over time and labels come late. The authors created DynGraphAgentBench, a test setup where decision agents pick detection methods as new data arrives and know only past information. This setup checks how well agents adapt through multiple time steps, deciding which technique to use before seeing current results. By running with various datasets and controllers, the authors show different ways agents succeed or fail to handle delayed feedback when spotting anomalies.
What this means in practice
- •For network security teams: Test and improve adaptive anomaly detectors that must decide which models to use in dynamic networks with delayed alerts.
- •For it operations teams: Evaluate and compare anomaly detection strategies that respond to evolving system behaviors over time with restricted feedback.
Authors
Yuwei Han, Lingwei Wei, Wooseong Yang, Liangjie Huang, Liancheng Fang, Huanhuan Ma, Philip S. Yu
Abstract
Dynamic graph anomaly detection requires repeated decisions as graph structure and class prevalence drift, yet detector benchmarks usually score a fixed pipeline after current labels are known. We introduce DynGraphAgentBench, an executable benchmark for agentic lifecycle control under delayed feedback. It comprises seven temporal graph datasets with node- and edge-level anomaly tasks, eleven selectable detectors, and eight chronological deployment windows per dataset. In each window, a controller sees only time-causal aggregate context, registered model cards, and its own matured history. It must choose a detector before current-window training or candidate scores exist. A sandboxed executor trains the chosen architecture on mature data, scores a hidden deployment window, and releases the outcome after a one-window delay. A deterministic verifier checks decision timing, leakage guards, legal actions, training scope, and persisted artifacts. We measure detection utility with average precision and capture at fixed review depth, and characterize adaptation through model switches and compute. Complete eight-window trajectories from two primary controllers and a no-memory reference on four datasets, together with three additional controllers on three datasets, expose useful, costly, and ineffective reactions to delayed evidence without granting an exhaustive current-window oracle.