{"id":"https://openalex.org/W3208881055","doi":"https://doi.org/10.1145/3459637.3481955","title":"Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs","display_name":"Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs","publication_year":2021,"publication_date":"2021-10-26","ids":{"openalex":"https://openalex.org/W3208881055","doi":"https://doi.org/10.1145/3459637.3481955","mag":"3208881055"},"language":"en","primary_location":{"id":"doi:10.1145/3459637.3481955","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3459637.3481955","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 30th ACM International Conference on Information & Knowledge Management","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081396646","display_name":"Lei Cai","orcid":"https://orcid.org/0000-0003-4811-5854"},"institutions":[{"id":"https://openalex.org/I72951846","display_name":"Washington State University","ror":"https://ror.org/05dk0ce17","country_code":"US","type":"education","lineage":["https://openalex.org/I72951846"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Lei Cai","raw_affiliation_strings":["Washington State University, Pullman, WA, USA"],"affiliations":[{"raw_affiliation_string":"Washington State University, Pullman, WA, USA","institution_ids":["https://openalex.org/I72951846"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075127080","display_name":"Zhengzhang Chen","orcid":"https://orcid.org/0000-0002-6803-0535"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhengzhang Chen","raw_affiliation_strings":["NEC Laboratories America, Inc., Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Inc., Princeton, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101798370","display_name":"Chen Luo","orcid":"https://orcid.org/0000-0002-9736-0533"},"institutions":[{"id":"https://openalex.org/I1311688040","display_name":"Amazon (United States)","ror":"https://ror.org/04mv4n011","country_code":"US","type":"company","lineage":["https://openalex.org/I1311688040"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chen Luo","raw_affiliation_strings":["Amazon, Inc., Palo Alto, CA, USA"],"affiliations":[{"raw_affiliation_string":"Amazon, Inc., Palo Alto, CA, USA","institution_ids":["https://openalex.org/I1311688040"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002240947","display_name":"Jiaping Gui","orcid":"https://orcid.org/0009-0001-4272-9604"},"institutions":[{"id":"https://openalex.org/I4210119420","display_name":"Stellar Solutions (United States)","ror":"https://ror.org/03h3tdh87","country_code":"US","type":"company","lineage":["https://openalex.org/I4210119420"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiaping Gui","raw_affiliation_strings":["Stellar Cyber, Inc., Santa Clara, CA, USA"],"affiliations":[{"raw_affiliation_string":"Stellar Cyber, Inc., Santa Clara, CA, USA","institution_ids":["https://openalex.org/I4210119420"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043236347","display_name":"Jingchao Ni","orcid":"https://orcid.org/0000-0002-2986-6612"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jingchao Ni","raw_affiliation_strings":["NEC Laboratories America, Inc., Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Inc., Princeton, NJ, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006126332","display_name":"Li Ding","orcid":"https://orcid.org/0000-0003-1855-8574"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ding Li","raw_affiliation_strings":["Peking University, Beijing, China"],"affiliations":[{"raw_affiliation_string":"Peking University, Beijing, China","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100456776","display_name":"Haifeng Chen","orcid":"https://orcid.org/0000-0002-1318-6583"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haifeng Chen","raw_affiliation_strings":["NEC Laboratories America, Inc., Princeton, NJ, USA"],"affiliations":[{"raw_affiliation_string":"NEC Laboratories America, Inc., Princeton, NJ, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5081396646"],"corresponding_institution_ids":["https://openalex.org/I72951846"],"apc_list":null,"apc_paid":null,"fwci":9.9374,"has_fulltext":false,"cited_by_count":116,"citation_normalized_percentile":{"value":0.984831,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"3747","last_page":"3756"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9968000054359436,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8046404719352722},{"id":"https://openalex.org/keywords/timestamp","display_name":"Timestamp","score":0.6412279605865479},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5851293802261353},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5082990527153015},{"id":"https://openalex.org/keywords/snapshot","display_name":"Snapshot (computer storage)","score":0.504449725151062},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.45864608883857727},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.42855310440063477},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.39727187156677246},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3463199734687805},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.15405136346817017}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8046404719352722},{"id":"https://openalex.org/C113954288","wikidata":"https://www.wikidata.org/wiki/Q186885","display_name":"Timestamp","level":2,"score":0.6412279605865479},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5851293802261353},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5082990527153015},{"id":"https://openalex.org/C55282118","wikidata":"https://www.wikidata.org/wiki/Q252683","display_name":"Snapshot (computer storage)","level":2,"score":0.504449725151062},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.45864608883857727},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42855310440063477},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.39727187156677246},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3463199734687805},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.15405136346817017},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3459637.3481955","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3459637.3481955","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 30th ACM International Conference on Information & Knowledge Management","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1888005072","https://openalex.org/W1970088130","https://openalex.org/W1971477462","https://openalex.org/W1999507172","https://openalex.org/W2009439582","https://openalex.org/W2026493302","https://openalex.org/W2052104835","https://openalex.org/W2059659103","https://openalex.org/W2089554624","https://openalex.org/W2093168265","https://openalex.org/W2105497548","https://openalex.org/W2109026675","https://openalex.org/W2121914937","https://openalex.org/W2122646361","https://openalex.org/W2132914434","https://openalex.org/W2140273660","https://openalex.org/W2153843773","https://openalex.org/W2154851992","https://openalex.org/W2163557584","https://openalex.org/W2165840237","https://openalex.org/W2383005638","https://openalex.org/W2510664603","https://openalex.org/W2518012597","https://openalex.org/W2585835859","https://openalex.org/W2767206826","https://openalex.org/W2783466287","https://openalex.org/W2787927827","https://openalex.org/W2788919350","https://openalex.org/W2808771744","https://openalex.org/W2809401017","https://openalex.org/W2896742542","https://openalex.org/W2950133940","https://openalex.org/W2962756421","https://openalex.org/W2964325548","https://openalex.org/W2965563623","https://openalex.org/W2980013009","https://openalex.org/W2982648802","https://openalex.org/W2998704965","https://openalex.org/W3104097132","https://openalex.org/W3105705953","https://openalex.org/W3108642152","https://openalex.org/W3169066865","https://openalex.org/W4254182148"],"related_works":["https://openalex.org/W2060561905","https://openalex.org/W1417711376","https://openalex.org/W1986883493","https://openalex.org/W2469862403","https://openalex.org/W2166378262","https://openalex.org/W4379524643","https://openalex.org/W2035891203","https://openalex.org/W2367807705","https://openalex.org/W2134444677","https://openalex.org/W3161658874"],"abstract_inverted_index":{"Detecting":[0],"anomalies":[1],"in":[2,13,47,70,100],"dynamic":[3,71],"graphs":[4],"is":[5],"a":[6,48,89,148],"vital":[7],"task,":[8],"with":[9],"numerous":[10],"practical":[11],"applications":[12],"areas":[14],"such":[15],"as":[16],"security,":[17],"finance,":[18],"and":[19,87,110,144,153,160],"social":[20],"media.":[21],"Existing":[22],"network":[23],"embedding":[24],"based":[25],"methods":[26],"have":[27],"mostly":[28],"focused":[29],"on":[30,83,122,167],"learning":[31],"good":[32],"node":[33,90,99],"representations,":[34],"whereas":[35],"largely":[36],"ignoring":[37],"the":[38,44,78,84,95,101,106,115,123,128,134,162,173],"subgraph":[39,81],"structural":[40,60],"changes":[41],"related":[42],"to":[43,93,113,132],"target":[45,85],"nodes":[46],"given":[49],"time":[50],"window.":[51],"In":[52,73],"this":[53],"paper,":[54],"we":[55,75,104,126],"propose":[56,88],"StrGNN,":[57],"an":[58],"end-to-end":[59],"temporal":[61,135],"Graph":[62],"Neural":[63],"Network":[64],"model":[65],"for":[66,137],"detecting":[67],"anomalous":[68],"edges":[69],"graphs.":[72],"particular,":[74],"first":[76],"extract":[77,114],"h-hop":[79],"enclosing":[80],"centered":[82],"edge":[86],"labeling":[91],"function":[92],"identify":[94],"role":[96],"of":[97,175],"each":[98,119],"subgraph.":[102],"Then,":[103],"leverage":[105],"graph":[107],"convolution":[108],"operation":[109],"Sortpooling":[111],"layer":[112],"fixed-size":[116],"feature":[117],"from":[118],"snapshot/timestamp.":[120],"Based":[121],"extracted":[124],"features,":[125],"utilize":[127],"Gated":[129],"Recurrent":[130],"Units":[131],"capture":[133],"information":[136],"anomaly":[138],"detection.":[139],"We":[140],"fully":[141],"implement":[142],"StrGNN":[143],"deploy":[145],"it":[146,154],"into":[147],"real":[149],"enterprise":[150],"security":[151],"system,":[152],"greatly":[155],"helps":[156],"detect":[157],"advanced":[158],"threats":[159],"optimize":[161],"incident":[163],"response.":[164],"Extensive":[165],"experiments":[166],"six":[168],"benchmark":[169],"datasets":[170],"also":[171],"demonstrate":[172],"effectiveness":[174],"StrGNN.":[176]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":40},{"year":2024,"cited_by_count":31},{"year":2023,"cited_by_count":24},{"year":2022,"cited_by_count":14},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":1}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-10-10T00:00:00"}