Explainable Anomaly Detection in Dynamic Heterogeneous Graphs via Relation Evolution

Abnormal behavior detection is crucial in many fields, such as social networks, financial transactions, and cybersecurity. However, it poses significant challenges due to the intricate structural evolution of heterogeneous graphs and the need for explainable models. To address these issues, we propose a novel method called Explainable anomalous behavior (edge) detection for dynamic heterogeneous Graphs (ExpGraph). ExpGraph captures relation-aware structural evolution to model temporal behavioral patterns and introduces a prototype alignment mechanism to improve both performance and interpretability. Specifically, prototype alignment enhances detection by encouraging discriminative representations of normal behaviors, which facilitates more accurate identification of anomalies. It also improves interpretability by enabling intuitive explanations through measuring how anomalous behaviors differ from learned normal prototypes. We conduct extensive experiments to evaluate ExpGraph against advanced competitors. It demonstrates that ExpGraph is 16.2% more effective than other methods on average. Moreover, it offers a deeper insight into abnormal behaviors in dynamic heterogeneous graphs.