想要了解如何利用规则增强技术进行关系异常检测的朋友,RAD模型值得一试,它在多个基准测试中表现优异,且易于使用。
关系异常检测通常应用于关系数据库中的数据,但大多数现有方法需要将多个表扁平化为单个特征矩阵,这可能会掩盖实体身份、模式结构和多跳依赖关系。本文提出了一种名为RAD的关系异常检测器,它结合了异构图表示学习和精细的符号规则信号。实验表明,RAD在自然类别不平衡的情况下,在AUROC和AUPRC基准测试中取得了最佳平均排名。代码和数据可在GitHub上获取。
RAD: Rule-Augmented Relational Anomaly Detection
Anomaly detection is often applied to data stored in relational databases, yet most existing methods require flattening multiple tables into a single feature matrix. This flattening can obscure entity identity, schema structure, and multi-hop dependencies, limiting the detection of anomalies that depend on relational context rather than isolated feature values. Beyond preserving relational structure, relational anomaly detection raises an additional challenge: how to incorporate symbolic behavioral evidence into learned relational representations. To address these challenges, we study relational anomaly detection, where the goal is to identify anomalous entities or events in a multi-table database. We propose RAD, a rule-augmented relational anomaly detector that combines heterogeneous graph representation learning with refined symbolic rule signals. RAD derives candidate rules from random-forest paths over flattened summaries of the entities or events being scored, refines them into compact interpretable predicates, injects the resulting rule features into the graph model, and learns anomaly scores using reconstruction-based and pairwise-ranking supervision. To evaluate this setting, we introduce a relational anomaly detection benchmark spanning three settings: LANL cybersecurity event detection and two unexpected user-churn anomaly tasks derived from Amazon and H&M relational databases. Experiments show that RAD improves anomaly ranking over flattened tabular detectors and relational baselines under natural class imbalance, achieving the best average rank on AUROC and AUPRC across the benchmark. Ablations show that direct rule injection and ranking-based supervision are key contributors to performance, while edge reconstruction is not uniformly beneficial. Our code and data are available at: https://github.com/noahd15/RAD_RelationalAnomalyDetection.