A multitude of toxic online behaviors, ranging from network attacks to anonymous traffic and spam, have severely disrupted the smooth operation of networks. Due to the inherent sender-receiver nature of network behaviors, graph-based frameworks are commonly used for detecting anomalous behaviors. However, in real-world scenarios, the boundary between normal and anomalous behaviors tends to be ambiguous. The local heterophily of graphs interferes with the detection, and existing methods based on nodes or edges introduce unwanted noise into representation results, thereby impacting the effectiveness of detection. To address these issues, we propose PhoGAD, a graph-based anomaly detection framework. PhoGAD leverages persistent homology optimization to clarify behavioral boundaries. Building upon this, the weights of adjacent edges are designed to mitigate the effects of local heterophily. Subsequently, to tackle the noise problem, we conduct a formal analysis and propose a disentangled representation-based explicit embedding method, ultimately achieving anomaly behavior detection. Experiments on intrusion, traffic, and spam datasets verify that PhoGAD has surpassed the performance of state-of-the-art (SOTA) frameworks in detection efficacy. Notably, PhoGAD demonstrates robust detection even with diminished anomaly proportions, highlighting its applicability to real-world scenarios. The analysis of persistent homology demonstrates its effectiveness in capturing the topological structure formed by normal edge features. Additionally, ablation experiments validate the effectiveness of the innovative mechanisms integrated within PhoGAD.

翻译：摘要：从网络攻击到匿名流量和垃圾邮件，大量恶意在线行为严重干扰了网络的平稳运行。由于网络行为固有地涉及发送方与接收方，基于图的框架常被用于检测异常行为。然而，在真实场景中，正常行为与异常行为之间的界限往往模糊不清。图的局部异质性干扰了检测过程，且现有基于节点或边的方法在表征结果中引入了不必要的噪声，从而影响了检测效果。为解决这些问题，我们提出了一种基于图的异常检测框架PhoGAD。该框架利用持久同调优化来明确行为边界。在此基础上，通过设计相邻边的权重来减轻局部异质性的影响。随后，针对噪声问题，我们进行了形式化分析，并提出了一种基于解耦表征的显式嵌入方法，最终实现了异常行为检测。在入侵、流量和垃圾邮件数据集上的实验证明，PhoGAD在检测效能上已超越现有最优框架的性能。值得注意的是，即使在异常比例降低的情况下，PhoGAD仍展现出稳健的检测能力，凸显了其在真实场景中的适用性。对持久同调的分析表明，该方法能有效捕获正常边特征所形成的拓扑结构。此外，消融实验验证了PhoGAD内部创新机制的有效性。