Anomaly detection is the task of identifying abnormal behavior of a system. Anomaly detection in computational workflows is of special interest because of its wide implications in various domains such as cybersecurity, finance, and social networks. However, anomaly detection in computational workflows~(often modeled as graphs) is a relatively unexplored problem and poses distinct challenges. For instance, when anomaly detection is performed on graph data, the complex interdependency of nodes and edges, the heterogeneity of node attributes, and edge types must be accounted for. Although the use of graph neural networks can help capture complex inter-dependencies, the scarcity of labeled anomalous examples from workflow executions is still a significant challenge. To address this problem, we introduce an autoencoder-driven self-supervised learning~(SSL) approach that learns a summary statistic from unlabeled workflow data and estimates the normal behavior of the computational workflow in the latent space. In this approach, we combine generative and contrastive learning objectives to detect outliers in the summary statistics. We demonstrate that by estimating the distribution of normal behavior in the latent space, we can outperform state-of-the-art anomaly detection methods on our benchmark datasets.

翻译：异常检测是识别系统异常行为的任务。计算工作流中的异常检测因其在网络安全、金融和社交网络等多个领域的广泛应用而备受关注。然而，计算工作流（通常建模为图结构）中的异常检测是一个相对未被充分探索的问题，并面临独特挑战。例如，当对图数据进行异常检测时，必须考虑节点与边的复杂相互依赖关系、节点属性的异质性以及边类型的多样性。尽管图神经网络有助于捕获复杂的相互依赖关系，但工作流执行过程中标注异常样本的稀缺性仍是一个重大挑战。为解决此问题，我们提出一种基于自编码器的自监督学习（SSL）方法，该方法从未标注的工作流数据中学习汇总统计量，并在潜在空间中估计计算工作流的正常行为。在此方法中，我们结合生成式与对比式学习目标，以检测汇总统计量中的异常值。实验证明，通过估计潜在空间中正常行为的分布，我们在基准数据集上能够超越最先进的异常检测方法。