  Network anomaly detection aims to find network elements (e.g., nodes, edges,
subgraphs) with significantly different behaviors from the vast majority. It
has a profound impact in a variety of applications ranging from finance,
healthcare to social network analysis. Due to the unbearable labeling cost,
existing methods are predominately developed in an unsupervised manner.
Nonetheless, the anomalies they identify may turn out to be data noises or
uninteresting data instances due to the lack of prior knowledge on the
anomalies of interest. Hence, it is critical to investigate and develop
few-shot learning for network anomaly detection. In real-world scenarios, few
labeled anomalies are also easy to be accessed on similar networks from the
same domain as of the target network, while most of the existing works omit to
leverage them and merely focus on a single network. Taking advantage of this
potential, in this work, we tackle the problem of few-shot network anomaly
detection by (1) proposing a new family of graph neural networks -- Graph
Deviation Networks (GDN) that can leverage a small number of labeled anomalies
for enforcing statistically significant deviations between abnormal and normal
nodes on a network; and (2) equipping the proposed GDN with a new cross-network
meta-learning algorithm to realize few-shot network anomaly detection by
transferring meta-knowledge from multiple auxiliary networks. Extensive
evaluations demonstrate the efficacy of the proposed approach on few-shot or
even one-shot network anomaly detection.
