An Exhaustive Review on State-of-the-art Techniques for Anomaly Detection on Attributed Networks

: Social Network sites are one of the most prominent websites used in almost every facet of life. A social network reflects relationships among social entities, including acquaintances, co-workers, or co-authors. With the extreme success of Social networks, the misuse has also been escalated and unlocked the way for various illegal behavior and security threats. Social Network anomaly detection has become a critical topic to be explored by researchers. The nature of the input data is a significant aspect of an anomaly detection technique. In the field of anomaly detection in the social network, input networks can be classified as static or dynamic, Attributed or unattributed. The number of nodes and the connections between the nodes in static networks would not change with time. Attribute networks are pervasive in various domains and constitute a vital element of modern technological architecture, where node attributes support the topological structure in data exploration. While social networks build up over time, evaluating them as if they had been static is very beneficial. Numerous studies have been done for Anomaly detection, but to the best of our knowledge, research in static attributed anomaly detection has been very limited. This review tries to portray earlier research on detecting anomalies for social static attributed networks and thoroughly discusses state-of-the-art embedding approaches


Introduction
In the last decade, Social networking sites have generated growing interest proliferation due to rapid internet development.The social platforms encourage users to connect with others quickly irrespective of geographical positions and therefore got enormous coverage.It helps members remain in contact with family and friends, connect with older friends, and build a strong relationship with others based on mutual characteristics (Bindu & Thilagam, 2016) (Anand et al., 2017).A significant percentage of the population is currently accessing online social media such as Twitter, LinkedIn, Facebook, etc., and this has a considerable effect on almost all areas (Elghanuni et al., 2019).In comparison, its growing success and unrestricted use have resulted in the widespread abuse of social networks and becoming a primary target for attackers (Kaur & Singh, 2016).When a user's behavior fits standard trends, we define its use, as usual, else unusual (Hassanzadeh et al., 2012).Unexpected and irregular behavior in social media shows different practices from those in the same network.Various researchers have defined this terminology differently as an anomaly, an exception, or an outlier.Identifying anomalies or outliers is the central issue in data mining and has been described as an abnormal pattern detection task from the dataset.Although various anomaly detection methods are available for different problems, this sector is too young and fast expanding.
Two approaches are mainly used for social network anomaly detection: Behavior-based and Graph-based.Behavior-based methods deal with nodes' behavioral features such as the quantity and intensity of texts, the nature of exchanged information, the comments and likes on an article, and interaction span.The task of detecting anomalies on datasets that are depicted as graphs is Graph-based anomaly detection.It is possible to represent an online social network as a graph whereby the nodes represent individuals.The edges reflect the connections between nodes using various ties such as friendship, association, family, etc. (Hassanzadeh et al., 2012) There are two social network classification forms based on input data type: Static vs. Dynamic and Attributed vs. Unattributed (Wasim et al., 2021).A static social network can be represented as just one snapshot of the data at any moment because the number of nodes and links among the nodes are not modified in static networks across time.Dynamic networks experience distinct transformation, e.g., node or edge addition or removal and node or edge attribute change.Users' characteristics or communication, like information about the communication type, users' date of birth, or communication period, are not used to identify anomalies in unattributed networks.In Attributed networks, features are associated with users or links among them and considered to identify anomalies, including the network structure [Figure 1].
Graphs not only act as organized data repositories but are indeed crucial in the advanced machine learning task.Graph-based identification of anomalies on social platforms is a new study area with a solid foundation in standard graph theory and communication patterns between users and groups.Many detailed survey studies have been carried out on Anomaly detection techniques and Graph-based anomaly detection techniques (Bindu & Thilagam, 2016) (Anand et al., 2017) (Kaur & Singh, 2016).In this paper, we present a thorough and extensive review of the research work conducted in the field of Graph-based Anomaly detection, primarily focusing on the embedding-based methods for the attributed static social network.

Motivation
This review will be the first review of network embedding techniques for anomaly detection on attributed social networks to the best of our knowledge.Usually, nodes' abnormal behavior on attributed networks is not limited to the shared interactions with network structure only.Still, their node features (i.e., attributes) are also evaluated, and there is a growing intense trend in finding anomalies on these networks.Existing methods are hard to be implemented directly on attributed networks due to the heterogeneous nature and volume of real-world data.Current Anomaly detection techniques generally target either topological structure or nodal attributes alone (Liu et al., 2017).Also, Attribute networks typically include high-voluminous data instances and high-dimensional functionality.Raising concerns in identifying anomalies on attributed networks compelled us to propose this review work, analyzing different factors with state-of-the-art alternatives to offer users an overview of the various published studies in network embedding-based anomaly detection.It allows us to learn these strategies in solving future Anomaly detection problems and explore options in the days ahead.

Review contribution
So far, numerous review works have been published on various aspects of Social Network Anomaly detection.Our paper's contribution is as follows.

•
Identifying the key aspects associated with the problem of anomaly detection in attributed static social networks.
• Providing a comprehensive review of state-of-the-art for anomaly detection in the static attributed social network.
• A couple of datasets and evaluation parameters have been explored for anomaly detection on the static attributed social network.
• Exploring the research challenges and open problems in the area of anomaly detection in static attributed social networks.
The rest of this paper is organized as follows.In Section 2, we provide the details of Network embedding.This section briefly describes the details of the embedding approach and its relation to anomaly detection.In Section 3, we identified the classification for different anomaly detection methods on static attributed networks.Section 4 discusses benchmarked datasets for anomaly detection on attributed networks.Evaluation parameters used for measuring the performance of anomaly detection approaches are presented in section 5. Section 6 discusses stateof-the-art approaches for anomaly detection in static attributed social networks.Finally, Section 7 discusses the challenges and the conclusion is presented in Section 8.

Network Embedding
The emergence of improved computational capability combined with both the widespread availability and high vitality of graph-structured datasets has led to a rise in network embedding research.Transformation of a graph to a low dimensional space in which its structural details and attributes are retained to the fullest extent is the main reason behind this pattern (Lerique et al., 2019).The objective is to identify unnoticed or complicated network properties either explicitly or through passing the learned representations to a downstream deduction network.Recent studies aimed to create embedded architectures that evaluate node representations through the methods of deep learning.For example, DeepWalk calculates metrics on node occurrences with a disjointed, random path by analyzing the input graph (Perozzi, Al-Rfou, et al., 2014).It endorses the SkipGram method to increase the likelihood of node neighborhood detection provided its embedding.
In recent years, several methods have been proposed that learn the representations which encode spatial graph features.These methods use the concept of learning the mapping of nodes embedding or whole graph embedding into the Low-dimensional vector points in embedding space Rd.This mapping is used effectively so that structural connections in this learned space represent the original graph structure.After that, the learned embeddings are utilized as input features for deep learning or machine learning tasks.
There are two major activities to learn graph representation.Initially, an encoder is used to every node in the graph is mapped to a node embedding that is a low-dimensional vector in latent space.The next step is to use a decoder to rebuild information from each node's neighborhood in the actual graph.The encoder is formally a process of mapping nodes v ϵ V to vector embeddings Zv ϵ R d .As an input, the encoder uses node I.D.s to create the embedding of nodes.

ENCD: V → R d
In other words, Z ϵ R |V| x d is embedding vectors matrix for all nodes, and Z[v] implies the row of Z that matches to node v.The decoder's role is to recreate graphical details from the node embedding produced by the encoder.For instance, provided the embedding zu of a node u, the decoder would try to anticipate the neighbors set N(u) of node u [Figure 2].PROBLEM: Attributed network anomaly detection: Suppose numbers of nodes are N, G is an attributed network, A is the adjacency matrix, and X is a matrix for attribute information for n nodes.The objective is to evaluate all the nodes by their level of abnormality in such a way as to place the nodes in high-ranking positions, which vary spectacularly from the majority of reference nodes (Ding et al., 2019).

Methods Classification
Several methods for anomaly detection have been published recently in the literature (Pei et al., 2020).Many anomaly detection algorithms pursue an unsupervised manner because the costs for collecting training data become exorbitant.They can be divided into four categories: Community analysis, residual analysis, subspace selection, and deep learning methodologies [Figure 3].While the algorithms mentioned above had their fair proportion of performance, these approaches are either subject to excessive overhead computing related to subspace selection and shallow learning processes or overlook the casual relationship between nodes and attributes through learning only node representations.But to catch attribute and structure anomalies, the interaction between these two separate modality inputs is essential for the anomaly detection task.Deep learning approaches are currently used to resolve the mentioned issues.These approaches employ deep neural models to explore network nonlinearity and unsupervised or supervised identification of anomalies.Deep learning embedding-based methods encapsulate the interactions between the node attribute and the network structure for decent quality embeddings.

Attributed Datasets
This section discusses benchmarked datasets for anomaly detection on attributed networks.The statistics of datasets are shown in Table 1.

•
BlogCatalog: It is a forum for blog sharing where bloggers will follow one another to create a social network.Users are assigned several tags that portray them and their articles; these tags are known as node attributes (J.• Flickr: Flickr is a website that allows uploading photos.Similarly, BlogCatalog has allowed users to follow each other and form a social network.Users are allowed to follow each other, thus creating a social network.Their tagged interests specify node attributes on users (J.Li et al., 2015).
• ACM: This is also an attributed network from the academic sector.It is indeed a citation network, so each article is considered a node, and links are the citation ties between the various papers.Each article's attributes are centered on the article's abstract (Fan et al., 2020) (Huang et al., 2018).
• Disney and Books: These are datasets from co-purchase networks that are obtained from Amazon.These contain attributes describing online products' characteristics, such as reviews, cost, or even more (Muller et al., 2013).
• Enron: Enron is an email network with edges that represent the email transfer between individuals.Each node includes several attributes that describe the message's metadata, such as the length of the text, average number of receivers, etc.This dataset has been widely used as a spam detection benchmark (Metsis et al., 2006).
• PolBlog: It is an online blog citation network.The words that emerged in each blog using a predefined word dictionary are used as attributes of each node (Perozzi, Akoglu, et al., 2014).
• Twitter, Facebook, and Google+: Each comprises an ego network set that includes ground-truth social groups.Facebook's edges reflect undirected connection, whereas Google+ and Twitter indicate directed "follower" connection.Google+ and Facebook attributes include user profile data, including employer information, position, and university information.The Twitter attributes are taken from each user's usernames and hashtags (Perozzi & Akoglu, 2018).

Evaluation Parameters
This section highlights the various evaluation metrics to measure the performance of anomaly detection techniques on attributed networks.

•
The ROC curve, a commonly used anomaly detection metric, is a plot of a true-positive result (Anomalous node is identified as an anomaly) against a false-positive result (Normal node is recognized as an anomaly), based on the facts and findings.
• The AUC value represents the area under the Receiver Operating Characteristic (ROC) curve, in which a randomly selected irregular node will be ranked higher than that of a normal node.As the AUC is higher, the more the model distinguishes between normal and abnormal nodes.
• While each anomaly detection technique produces an anomaly ranking list, Precision@K is used to calculate the percentage of true anomalies identified in its highest-ranking K nodes by a particular detection procedure.
• Recall@K measure evaluates the percentage of true anomalies found in the total number of ground truth anomalies by a unique detection technique.

Existing Key Methods
Several papers related to the embedding approach for Anomaly detection in static attributed networks have been published during the last decade.The objective of this section is to provide a detailed overview of some of the baseline approaches.Graph differentiation layers (GDN) are used to develop an autoencoder network at the first stage to learn the representations of attributed network nodes.The second step targets the generative adversarial system by using the established node representations of anomalies, reliably representing regular data distribution.The framework AEGIS exceeds all the critical approaches to all three real-world datasets.The experiment on datasets also indicates that although this technique is usually built for inductive identification of anomalies, it can also obtain better efficiency in the transductive environment (Ding et al., 2020).
Considering the dynamic interactions between the topological structure and node attributes, Haoyi Fan et al. proposed a deep combined representation learning method to detect anomalies through a dual autoencoder.Complex interactions between the structure of a network and the node's attribute are observed, and both structural and attribute observations assess anomalies.It learns the embedding for both nodes and attributes together in a spatial domain.The Attention mechanism is also used in the structure encoder to understand the significance between a node and its peers to effectively access structure patterns that are essential for detecting anomalies.Eventually, irregularities could be observed by evaluating node regeneration errors from the structure and attribute viewpoints both.Experiments were performed on real-world datasets.Blog-Catalog, Flickr, and ACM.Experiment results indicate that the proposed approach, AnomalyDAE vastly outweighs all benchmarks and works best on several datasets than existing state-of-the-art approaches (Fan et al., 2020).
A novel combined embedding method, DeepAD, was proposed by Dali Zhu et al. to exploit the high non-linear behavior in both attributes and network structure and find irregularities based on reconstruction errors.GCN imposes local neighborhood links inherently on every layer of encoding as routes to add neighborhood embeddings.First-order proximity can be considered the controlled information to limit the node pairs' proximity in latent representations.Motivated by the concept of Laplacian eigenmaps, a penalty function is added to limit the local vicinity when nodes close to one another are traced away from each other.The higher-order proximity relates to the correlation between the neighborhood details of two nodes.The higher order of neighborhood data is embedded with the convolutions iteration.Cross-model proximity is maintained by enhancing their estimated probability of communication (Zhu et al., 2020).Kaize Ding et al. emphasized resolving the issues associated with existing approaches like the Non-linear nature of Data, Network sparsity, and non-ability of handling complicated relationships.They used a graph convolution network (GCN) to smoothly form the network structure and attributes for mapping node embedding, followed by a deep autoencoder utilizing this embedding to recreate the actual data.The cohesion between GCN and autoencoder helps to detect abnormalities by calculating node regeneration errors.Substantial experiments on datasets proved their proposed method's usefulness (Ding et al., 2019).
Yuening Li et al. in proposed a Spectral autoencoder-based anomaly detection framework for attributed networks to tackle the problem created due to the homophily hypothesis and over-smoothing.They tried to explore local anomalies (Community anomalies) and global anomalies both for the attributed networks.They used a Spectral autoencoder to embed topological relation and node attributes into an embedded space together.They selected an autoencoder to learn both embedding and reconstruction errors on all nodal attributes to identify global anomalies.They introduced a novel graph convolution encoder and decoder networks to learn the node's local representations depending on each node's neighborhood.After calculating the reconstruction errors, each node's suspect level is measured by evaluating the energy of its embedding representation in the Gaussian mixture model.Experimental tests on real-world datasets with five standard methods assessed the proposed model's efficiency and concluded that SpecAE retains exceptional results (Y.Li et al., 2019).
Leonardo Gutierrez-Gomez et al. suggested a novel MADAN approach (Multiscale Anomaly Detection in Attributed Networks) that offers a good rating and analysis process anomalous nodes at all levels in a network within their context.A highly concentrated node implies a node that is quite distinct in its features from its peers with the help of the proposed gaussian weighting function.Finally, a rating is given to classify potential anomalies using the concentration to measure the extent of divergence of a particular node at a specified point in time and relation to its context.Experiments performed on synthetic and real-world datasets demonstrate that the proposed approach helps identify ground truth anomalies and recognize new anomalies, including their contexts (Gutiérrez-Gómez et al., 2019).
Zhen Peng et al. developed ANOMALOUS, a joint modeling method to detect anomalies on attributed networks by streamlining the anomaly detection and attribute selection.Instead of considering both as two distinct steps, utilize them as a whole.It involves extracting specific instances from the representation features deeply connected to the CUR decomposition-based topological structure.Finally, it tests each instance's normality using the residual analysis approach.The success of the proposed method is demonstrated by observations on both synthetic and real-world data sets (Peng et al., 2018).
Residual analysis-based Anomaly detection was introduced by Jundong Liy et al.Residual analysis is used to differentiate the original data from the predicted data by calculating the residuals and identifying anomalies.Instances containing high residual error are much prone to being anomalies, as their patterns would not match with many other references.This algorithm gives a useful way to identify anomalies globally and relies not on peculiar characteristics of anomalies.The AUC values yielded with this method prove that the RADAR is markedly good than other baseline approaches (J.Li et al., 2017).
Most current approaches cannot be tailored to users' specific needs since they do not regard the user preferences eccentricity.Therefore, Peng et al. proposed a novel framework, ALARM, that integrates user interests in identifying anomalies and addressing heterogeneous attribute features simultaneously using multiple graph encoders and a well-designed, self-learning, and user-friendly aggregator.Synthetic dataset experiments reveal that although the dataset includes no natural multi-view attributes, the proposed method still delivers the desired outcomes by dividing the attribute set arbitrarily (Peng et al., 2020).
FocusCO is an approach of seeking focused communities and anomalies in massive attributed datasets.The proposed approach first cuts off clusters of identical, strongly connected nodes and shows cohesiveness in focus attributes, which subsets.Then focused anomalous nodes are detected adhering to a topological structure-based focused cluster but indicate absolute deviations from focus attributes.An effective algorithm is offered, incorporating the user's focus attributes and simultaneously extracting focused clusters and anomalies (Perozzi, Akoglu, et al., 2014).
For graphs containing many numeric attributes, Sanchez et al. proposed ConOut, a new local outlier ranking model that specifies each object's subgraph and its statistically significant attribute subset locally.This filtering of the context makes a high distinction between an outlier and standard objects.They measure the outliers rating by integrating both the topological structure and attribute value variation from this context.The context selection enables local anomalies detection that is not possible provided the global partition or the whole graph.Unlike subspace selection approaches, the running time of ConOut is much smaller (Sánchez et al., 2014).
GoutRank is a method for scoring the nodes according to their level of variance in both topological structure and attributes.The approach aims to detect complicated outliers that diverge concerning a strongly connected subgraph.While the specific outlier in the subgraph is practically identical to other nodes, but It strongly differs from a subset of relevant attributes called subspaces.This approach uses the technique of subspace analysis and graph clustering for preprocessing to produce the ranking of outliers.In attributed networks, Outlier scoring functions can find better quality outliers (Muller et al., 2013).Gao et al. pioneered community anomalies and created a standardized system for anomaly detection and community exploration.They presented a community outlier detection algorithm (CODA), a deterministic formulation that incorporates both community and anomaly detection based on Hidden Markov Random Fields (HMRF).The topological data is encoded employing the HMRF model as structural restrictions on the hidden states.In contrast, the node data is configured as a combination of multinomial or Gaussian distributions.Extensive experiments indicate that the proposed CODA approach continually exceeds the reference algorithms on synthetic data.It also detects significant community anomalies from the DBLP dataset (Gaot et al., 2010).

•
First of all, an autoencoder is used to learn the anomaly aware representations of the node.After that, it trains a generative adversarial network to facilitate the generalizability of recently added data.

•
The generator seeks to produce probable descriptive anomalies, whereas the discriminator attempts to discover a boundary of decisions that differentiates possible anomalies from standard data.The generator helps enhance the discriminator's ability to distinguish standard data by collecting probable descriptive anomalies.

•
This approach can be used in both inductive and transductive environments to implement anomaly detection.

•
The

•
It learns the embedding for both nodes and attributes together in a spatial domain.

•
The Attention mechanism is also used in the structure encoder to understand the significance between a node and its peers to access structure patterns that are essential for detecting anomalies effectively.

•
Eventually, irregularities could be observed by evaluating node regeneration errors from the structure and attribute viewpoints both.

•
The

•
Then Laplacian sharpening is employed to intensify the deviations between anomaly representations.

•
Finally, the density evaluation model is coupled with the observed representations and reconstruction errors to find the anomalies.

•
The proposed approach addresses constraints of the homophily hypothesis and oversmoothing of node representation issues.

•
The proposed approach is reliable and scalable for complex systems due to the exponential Chebychev measurements of the Laplacian graph.

•
It also offers a smoother community identification technique using a continuous-time Markov stability system as an additional advantage.

•
The proposed method ensures that contrary to choosing attributes or instances alone, the compilation from both instance and attribute can enhance efficiency because they select indicative instances and attributes jointly to identify anomalies that can ease the adverse impact of irrelevant or redundant attributes.

•
After conducting tests on various real-world datasets, it is finally concluded that the suggested methodology is quite resilient for growing dimensions and an increasing number of insignificant attributes.

•
The primary reason seems to be that it will flush away noisy data and concurrently choose instances and representative attributes to detect anomalies.

•
Networks with interconnected instances, associations among instances often make the residual process model complex.The integration of attributed information modeling and network modeling must be combined to achieve consistency between them.

•
They • After calculating the normality metric that analyses and measures the neighborhoods' quality, an optimization method is used to derive weight vectors of attributes in a specific neighborhood dynamically, aiming to define a subspace that maximizes the normality of the neighborhood.

•
Their normality levels then sort Neighborhoods, while those with the least numbers are considered abnormal.

•
Proposed metric normality is peculiar to its notion of "acquittal" of the boundary's edges, that hardly any of the current metrics demonstrated.Instead, they overlooked the boundary.

•
Initially, provided attributed network is encoded by using several GNNs to address multi-view attributes.

•
After that, the hidden embeddings obtained from these multi-view attributes are filtered with an adequately designed aggregator to create coherent representations and then decoded from the aspects of attributes and structure both.

•
After encoding and decoding processes, measured reconstruction errors are finally used for anomaly detection.

•
This approach revisited the issue of multiview anomaly detection and dealt effectively with the separation and affiliation of many views.

•
The

•
Finally, the outliers are detected based on the high distinction between the outliers and their local context.

•
The proposed approach may find contextual anomalies that other anomaly detection models neglect.

•
Overall, this approach measures the anomaly rating of excellent quality correlated well with the number of attributes.

•
It matches the value with performance when linking graph structure to the attribute data.

•
Then objects are scored in these various subspace clusters using scoring functions.

•
Finally, Outliers are detected after examining their participation in either large, high dimensional, or densely connected subgraphs.

•
The proposed approach deals with two issues: Difficulty with selecting subgraphs with corresponding subspaces and the node scoring problem in multiple such subspaces.

•
GOutRank utilizes the inherent strength of graph clustering and also its connectedness to the subspace analysis.

•
This approach has been developed for complicated outliers, which differ significantly from a subclass of relevant attributes, mostly concerning a localized subgraph.So, it addresses the problem of finding hidden anomalies also.

•
CODA is the very first research in which community anomalies are detected by concurrently examining data and links.

•
Although the algorithm's computing cost is constant throughout the number of nodes, a proper initial setup of the clusters is vital to the proposed method's success.

Challenges for Anomaly Detection on Attributed Networks
Some of the challenges that are found after the review of state-of-the-art approaches are as follows:

•
Attributed networks are generally non-linear and sparse, and it is a primary challenge for anomaly detection on these networks due to network sparsity and data nonlinearity (Ding et al., 2019).

•
When using subspace selection methods, a challenging issue is choosing congruent subspaces to model the relationship between attribute values and topological structure (Sánchez et al., 2013).

•
Standard anomaly detection approaches rely on spatial information or graph models, but many of today's databases contain multi-dimensional quantitative data and entity relationships in attributed graphs.The main challenge is how to work with these various types of data in a unified way (Gutiérrez-Gómez et al., 2019).

•
Anomalous nodes are often context-dependent, so identifying anomalies is naturally related to community detection.Still, there is a severe challenge to perform multiscale community detection where edge weights attach the associated nodes (Gutiérrez-Gómez et al., 2019).

•
The attributed networks in the real world often include high-dimensional features and massive data instances.With the substantial data scales and heterogeneous attributed networks, current anomaly detection approaches cannot be implemented directly (Liu et al., 2017).

•
Despite the methodological success of the homophily hypothesis, specific unpopulated attributes may exist that do not fulfill the theory of homophily, and the presence of these Structurally insignificant attributes may cause harmful effects on the detection of anomalies (Peng et al., 2018).

•
Until now, in attributed networks, limited attention is being paid to inductive anomaly detection (Ding et al., 2020).

•
In attributed networks, various types of anomalies frequently blend, all of which are impossible to classify if we do not have previous data awareness (J.Li et al., 2017).

•
The smoothing methods generally applied to attributed networks do not fit with the anomaly detection process.The node representations could be over smoothed and render abnormal nodes less distinctive than the remaining nodes within the same community (Y.Li et al., 2019).

Conclusion
The large size of the attributed networks and their complex nature render anomaly detection in the static attributed network an arduous and computationally intensive process.It has recently been increasingly crucial for anomalous nodes to be detected within attributed networks, with widespread deployments in different high-impact fields, such as social networks, cybersecurity, and healthcare.The review paper assembles and arranges the stateof-the-art techniques into various categories and describes the complementary approaches for detecting anomalies in Static social attributed networks.Since it was tough to cover every method in this paper, the best attempts have been devoted to cover most.We also explored the different challenges for future studies in this area.Despite considerable efforts in anomaly detection, several shortcomings exist that could be resolved and addressed in the future.This more in-depth review offers a better understanding of the critical approaches designed for anomaly detection in Static social attributed networks.

Figure 2 .
Figure 2. Node Embedding2.1.Network embedding and anomaly detectionDue to network architecture's sparsity on the attributed networks and nonlinearity of node structure and attributes, node embedding methods based on deep learning for Anomaly detection are popular these days.Deep learning-based node embedding methods for Social network anomaly detection, generally, first of all, transforms the attributed network to the embedding representations as an encoding method.Then node attributes and topological structure are rebuilt with the use of respective decoding methods.After encoder and decoder processes using deep learning, nodes' reconstruction errors are then exploited to detect anomalous nodes on attributed networks.

•
Cora, Citeseer, and Pubmed: These three datasets are citation networks where node represents publication and the edges represent the citations among them.Each publication includes several keywords and these keywords are considered as attributes (Liang et al., 2018)(Yang et al., 2016).

"
kernel used for filtration helps us leverage the Markov stability connection to locate the network's outlier node background.

Table 1 .
Statistics of Attributed Datasets.
Table 2 summarizes various state-of-the-art approaches.Kaize Ding et al. introduced a novel framework, AEGIS, that can detect anomalies on recently identified nodes without extra training and attain better analytical results.The proposed framework comprises two stages of learning.

Table 2 .
Summary of the State-of-the-art approaches.