## 5 Conclusions  
In this paper, we are interested in detecting anomalies that deviate from their communities in contrast to normal users that commonly share many properties with their fellow  
Figure 10: Variations in runtime according to the different number of nodes for each of the tested models.  
Figure 9: Variations in AUC according to the different number of nodes for each of the tested models.  
community members. Therefore, in this model, we defined an anomaly ranking score that integrates the deviation in the network structure and the attributes' values. Instead of considering all the attributes, we use the most relevant attributes. Our model has two steps: detecting communities in the network and ranking the network's nodes based on their anomalies. The anomaly score combines the community-structure-based score that measures node importance and connectivity and the attribute-based score that compares the node distance to other nodes in its community with the community mean distance. The final anomaly score represents the node anomaly degree, where anomalous nodes have the highest scores.  
Due to the integration of both structure information and attribute information in our ranking score, our model easily identified complex anomalies, which deviated in either their structure, the values of their attributes, or both. The integration of these properties of the anomaly presents a new challenge of unifying the information from both parts to ensure complex anomaly detection. Thus, we balance quality with efficiency by joining the graph structure with the attribute information. In our approach, we did not include all the network attributes, as the existence of irrelevant attributes is inevitable in the networks. Instead, we selected the context which is a subset of the relevant attributes to brighten up any deviation in such values. Experiments on both real-world and synthetic datasets illustrate that our model achieves good performance, as it outperforms the existing models and can detect anomalies that other models miss. An extension of our proposed approach could be carried out in many different ways. In our approach to anomaly detection, we focus on numerical node attributes; however, node attributes in real-world networks consist of different attribute types. Therefore, a mixture of attribute types such as binary, categorical, and continuous values could be considered for inclusion into future models.  
Conceptualization, H.Z. and W.K.; Funding acquisition, H.K.; Investigation, H.Z. and R.M.; Methodology, H.Z. and N.S.A.; Project administration, W.K.; Supervision, H.K. and N.S.A.; Writing--original draft, H.Z. and W.K.; Writing-- review & editing, H.Z. and H.K. All authors have read and agreed to the published version of the manuscript. This research project was funded by the Deanship of Scientific Research, Princess Nourah bint Abdulrahman University, through the Program of Research Project Funding After Publication, grant No. (43-PRFA-P-9).  
Not applicable.  
The datasets generated during and/or analysed during the current study are publicly available. The dataset and code is available from the corresponding author on reasonable request.  
Deanship of Scientific Research, Princess Nourah bint Abdulrahman University, through the Program of Research Project Funding After Publication, grant No. (43-PRFA-P-9).  
The authors declare no conflict of interest.  
References