RAD: Rule-Augmented Relational Anomaly Detection

• URL: http://arxiv.org/abs/2608.23468v1
• Date: Mon, 24 Aug 2026 16:36:17 GMT
• Title: RAD: Rule-Augmented Relational Anomaly Detection
• Abstract summary: Anomaly detection is often applied to data stored in relational databases.<n>Most existing methods require flattening multiple tables into a single feature matrix.<n>We propose RAD, a rule-augmented relational anomaly detector.
• Score: 11.251069238986483
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Anomaly detection is often applied to data stored in relational databases, yet most existing methods require flattening multiple tables into a single feature matrix. This flattening can obscure entity identity, schema structure, and multi-hop dependencies, limiting the detection of anomalies that depend on relational context rather than isolated feature values. Beyond preserving relational structure, relational anomaly detection raises an additional challenge: how to incorporate symbolic behavioral evidence into learned relational representations. To address these challenges, we study relational anomaly detection, where the goal is to identify anomalous entities or events in a multi-table database. We propose RAD, a rule-augmented relational anomaly detector that combines heterogeneous graph representation learning with refined symbolic rule signals. RAD derives candidate rules from random-forest paths over flattened summaries of the entities or events being scored, refines them into compact interpretable predicates, injects the resulting rule features into the graph model, and learns anomaly scores using reconstruction-based and pairwise-ranking supervision. To evaluate this setting, we introduce a relational anomaly detection benchmark spanning three settings: LANL cybersecurity event detection and two unexpected user-churn anomaly tasks derived from Amazon and H&M relational databases. Experiments show that RAD improves anomaly ranking over flattened tabular detectors and relational baselines under natural class imbalance, achieving the best average rank on AUROC and AUPRC across the benchmark. Ablations show that direct rule injection and ranking-based supervision are key contributors to performance, while edge reconstruction is not uniformly beneficial. Our code and data are available at: https://github.com/noahd15/RAD_RelationalAnomalyDetection.

Related papers

• CORE: In-Context Reconstruction for Unified Tabular Anomaly Detection [50.334454857423395]
  An emerging trend towards unified anomaly detection (TAD) seeks to detect anomalies across different datasets using a single generalizable model.<n>We propose an in-COntext REconstruction approach for unified TAD (CORE for short)<n>CORE formulates unified TAD as an in-context reconstruction problem, eliminating the need for labeled or synthesized anomalies.
  arXiv  Detail & Related papers  (2026-07-30T03:08:49Z)
• Towards Anomaly Detection on Relational Data [51.473064583839296]
  We propose a reconstruction-based framework that captures anomalies from both attribute and relational edge reconstruction.<n>RelAD consistently outperforms other baselines while achieving competitive efficiency.
  arXiv  Detail & Related papers  (2026-06-17T02:36:32Z)
• Towards One-for-All Anomaly Detection for Tabular Data [87.63505963517512]
  Tabular anomaly detection (TAD) is critical in many real-world applications.<n>We propose OFA-TAD, a framework that only requires one-time training on multiple source datasets.<n>Experiments on 34 datasets from 14 domains demonstrate that OFA-TAD achieves superior anomaly detection performance.
  arXiv  Detail & Related papers  (2026-03-15T14:42:05Z)
• Hierarchical Reference Sets for Robust Unsupervised Detection of Scattered and Clustered Outliers [8.21087649188741]
  Clustered outliers can be easily mistaken for normal behavior because of their relatively high local density.<n>We propose a novel outlier detection paradigm that leverages the natural neighboring relationships using graph structures.<n>Our approach enables the effective recognition of scattered outliers without interference from clustered anomalies.
  arXiv  Detail & Related papers  (2026-03-13T09:48:20Z)
• Multi-Agent Debate: A Unified Agentic Framework for Tabular Anomaly Detection [7.807411603618987]
  Multi-Agent Debating framework (MAD) treats disagreement as a first-class signal.<n> MAD produces a normalized anomaly score, confidence, and structured evidence, augmented by a large language model (LLM)-based critic.<n>We show how conformal calibration can wrap the debated score to control false positives under exchangeability.
  arXiv  Detail & Related papers  (2026-02-15T17:44:32Z)
• RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection [0.8373057326694192]
  This paper presents a neuro-symbolic anomaly detection framework that combines a Graph Autoencoder with rare pattern mining.<n>Anomaly candidates are identified through deviations between observed and reconstructed graph structure.<n>We evaluate the proposed method on the DARPA Transparent Computing datasets and show that rare-pattern boosting yields substantial gains in anomaly ranking quality.
  arXiv  Detail & Related papers  (2026-02-03T00:02:37Z)
• ARC: A Generalist Graph Anomaly Detector with In-Context Learning [62.202323209244]
  ARC is a generalist GAD approach that enables a one-for-all'' GAD model to detect anomalies across various graph datasets on-the-fly.<n> equipped with in-context learning, ARC can directly extract dataset-specific patterns from the target dataset.<n>Extensive experiments on multiple benchmark datasets from various domains demonstrate the superior anomaly detection performance, efficiency, and generalizability of ARC.
  arXiv  Detail & Related papers  (2024-05-27T02:42:33Z)
• ARISE: Graph Anomaly Detection on Attributed Networks via Substructure Awareness [70.60721571429784]
  We propose a new graph anomaly detection framework on attributed networks via substructure awareness (ARISE) ARISE focuses on the substructures in the graph to discern abnormalities. Experiments show that ARISE greatly improves detection performance compared to state-of-the-art attributed networks anomaly detection (ANAD) algorithms.
  arXiv  Detail & Related papers  (2022-11-28T12:17:40Z)
• TadGAN: Time Series Anomaly Detection Using Generative Adversarial Networks [73.01104041298031]
  TadGAN is an unsupervised anomaly detection approach built on Generative Adversarial Networks (GANs) To capture the temporal correlations of time series, we use LSTM Recurrent Neural Networks as base models for Generators and Critics. To demonstrate the performance and generalizability of our approach, we test several anomaly scoring techniques and report the best-suited one.
  arXiv  Detail & Related papers  (2020-09-16T15:52:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.