Dynamic graph model improves anomaly detection with explicit time evolution
Differentiable Koopman Operator for Contrastive Learning on Dynamic Graphs
Machine Learning
Summary
Many real-world networks, like social or communication networks, change over time as connections appear and disappear. Most current methods try to learn these changes indirectly, which can fail when the network behaves unpredictably. The authors designed a new method that directly models how node relationships evolve over time, making it easier to spot unusual changes. Their approach also uses two different views of the network to better understand its structure and behavior. Tested on multiple benchmarks, this method outperformed others in finding anomalies and did well in identifying node types without extra help.
What this means in practice
- •For network security teams: Detect anomalies in evolving network traffic or communication patterns using a model that explicitly tracks node interaction changes over time.
- •For social media platform engineers: Identify unusual or suspicious user behavior by analyzing temporal changes in social graph connections with an approach that models these dynamics directly.
Authors
Md Abrar Jahin, Taufikur Rahman Fuad, Md Rizwan Parvez
Abstract
Real-world interaction networks are inherently dynamic: edges form and dissolve as node behavior shifts over time. Most snapshot-based contrastive methods encode temporal dependencies implicitly in encoder weights, without an explicit model of how node representations evolve, making them brittle under distribution shifts. We propose KAIROS (Koopman-Aligned Invariant Representations for Open Dynamic Systems), a self-supervised framework that embeds a differentiable Koopman operator within a dynamic graph contrastive learning loop to linearize temporal evolution in the learned embedding space. A dual-view encoder pairs raw node features with a graph-diffused structural view and is optimized with multi-granularity contrastive objectives across temporal windows. For anomaly detection, KAIROS uses the Koopman prediction residual together with temporal inconsistency and local neighborhood deviation to separate irregular behavior from predictable graph evolution. Evaluated on nine dynamic graph benchmarks, KAIROS achieves state-of-the-art anomaly detection results on all nine datasets, with gains of up to 23.15 ROC-AUC points over prior work, while remaining competitive for unsupervised node classification. These results show that explicit dynamics modeling provides a scalable and effective inductive bias for temporal graph representation learning.