# Enhanced Graph Autoencoder for Graph Anomaly Detection Using Subgraph Information
## 2 Backgrounds
### Graph Anomaly Detection  
Anomaly detection is a data mining task that aims to identify rare and unusual observations, such as data points and events that differ significantly from the standard, expected, and typical majorities in the dataset. Although infrequent in real-world situations, these objects carry critical information that is worth noticing to prevent adverse effects and main tain the safety and stability of the system. Examples of real-world anomalies may include fraudsters in financial transactions [12], fake news over the internet [13], unreliable reviews on websites [14], social bots [15], and network intruders [16]. Conventional approaches for anomaly detection focus on transforming real-world objects into feature vectors and then identifying the anomalous data points as deviating outliers using techniques based on clustering [17; 18], classification [19], nearest neighbor [20], and more. However, in addition to their attribute information, real-world objects usually contain rich relational information about each other that can provide valuable insights for anomaly detection. For example, in a social network, users have rich profile information and are connected with each other through various types of relationships. Hence, attributed networks have been widely utilized to study a more complex anomaly detection problem in non-Euclidean space, known as graph anomaly detection; an attributed network is a powerful tool that can encode a set of attributes for each node alongside a graph topology representing the relationships among the nodes. This field of research aims to detect abnormal entities within the graph from both structure and attribute perspectives. Structure anomalies are abnormal entities characterized by their links to uncorrelated neighbors, while attribute anomalies refer to entities that exhibit mismatched attributes with all their neighbors.  
In recent years, with their rapid growth and outstanding capability in learning over graph-structured data, a wide range of GNN-based graph anomaly detection frameworks have been proposed, demonstrating notable achievements. Due to the prohibitive cost of accessing ground-truth anomaly labels in real-world applications, existing graph anomaly detection models are mostly unsupervised learning-based or semi-supervised learning-based. ANOMALOUS [21], Radar [22], and ResGCN [23] employ residual analysis to measure pattern deviation in nodes, used as the indicator for the level of anomaly. DOMINANT [24] and AnomalyDAE [25] employ GCN-based autoencoders to learn node representations through neighboring nodes' representation aggregation and to reconstruct both the attribute and structure information simultaneously. Then, node abnormality is ranked according to their reconstruction errors. The ComGA model [1] extends DOMINANT [24] with extra graph community information to achieve better structural anomaly detection performance. CoLA [26] and ANEMONE [27] utilize a contrastive self-supervised design by generating positive and negative random-walk subgraphs around target nodes to detect anomalies effectively. Finally, OCGNN [28] and AAGNN [29] combine a GCN with hyper-sphere learning to encode normal instances within a hypersphere while keeping anomalies outside the hypersphere.