We define a dynamic graph as a sequence of temporal snapshots G = { G 1 , G 2 , … , G T } . Here, the network snapshot at any arbitrary time t is denoted as G t = ( V , E t , X t , E attr t ) , where V = { v 1 , v 2 , … , v N } represents the set containing N nodes, E t is the set of interaction edges at time t , X t ∈ R N × d n represents the node feature matrix, and E attr t contains the attribute features of all edges.

Considering that multiple types of interaction relations often exist between nodes in real-world networks, we define the set of all possible interaction relation types as R = { r 1 , r 2 , … , r K } . To capture the topological structure under specific relations, the model decomposes the global snapshot into K independent relation view subgraphs, as shown in Equation 1: S t = G 1 t , G 2 t , … , G K t (1)

For the k -th view subgraph G k t = ( V , E k t ) , its node set is shared with the original graph, but the edge set only contains interaction edges belonging to relation type r k . Formally, it is defined as Equation 2: E k t = u , v ∈ E t | ψ e u v = r k (2) where ψ ( ⋅ ) is the relation type mapping function. Specifically, these views are defined by different interaction types. This decomposition strategy enables the model to learn spatial embeddings of nodes specifically for each distinct interaction pattern, avoiding mutual interference between different relational features.

Social network data shows heterogeneous multi-modal properties including unstructured text-based semantic features, structured statistical user attributes, and attribute characteristics of interactive edges; we map both node and edge information into a latent space R d model of identical dimensionality to integrate such heterogeneous information into an integrated deep learning framework.

Original node features comprise two components, semantic and statistical features, to fully capture comprehensive user characteristic profiles. For the semantic feature component, users’ historical behavior logs hold abundant text-based content reflecting personal interest tendencies and latent behavioral intentions. We extract and concatenate core textual content linked to user behavioral activities, specifically article titles and review content. We adopt the pre-trained RoBERTa-base model to encode these text sequences. Input sequences are truncated to a maximum length of 128 tokens. To ensure training efficiency, the parameters of RoBERTa are frozen to serve as a static feature extractor. Finally, we implement mean pooling on the output word vectors of the last hidden layer to yield a 768-dimensional feature vector f sem containing complete deep semantic information.

Regarding statistical features, this work chooses structural metrics representing user impact and activity degrees: social connectivity gauges node connection scope while cumulative interaction count gauges general activity degree. We assemble these quantitative data into a vector, and then conduct log normalization to derive the statistical feature vector f stat .

To fuse these two types of information, the model concatenates them and maps them to the initial hidden state h u ( 0 ) of the node through a learnable linear projection layer, as shown in Equation 3: h u 0 = σ W node f sem ‖ f stat + b node (3) where W node and b node are the weight matrix and bias term respectively, ‖ denotes the concatenation operation, and σ ( ⋅ ) employs the ReLU activation function. At this point, h u ( 0 ) serves as the node feature input to the graph neural network.

Edge features are used to characterize the attributes of interactions. For an edge ( u , v ) , interaction frequency and interaction timestamp are selected as raw features. The normalized frequency value is concatenated with the time feature encoded by a sinusoidal function, and then mapped to an edge embedding r u v of the same dimension as the node feature via a Multi-Layer Perceptron (MLP), as shown in Equation 4: r u v = MLP edge f r e q u v ‖ TimeEnc t i m e u v (4)

To efficiently utilize network topology and edge attribute data during node representation updating, this paper proposes a sparse graph attention mechanism integrated with edge attribute bias; unlike conventional GCNs conducting average aggregation of neighboring nodes, this mechanism employs a multi-head attention mechanism to dynamically allocate weights based on node feature similarity and edge attributes.

Let the input node feature of the ( l − 1 ) -th layer be h ( l − 1 ) . Under a specific relation view G k , for the m -th attention head, the model first maps the source node u and its neighbor v to independent feature subspaces to calculate the query vector and key vectorr, as shown in Equation 5: q u k , m = W Q k , m h u l − 1 , k v k , m = W K k , m h v l − 1 (5) where W Q and W K are learnable linear projection matrices. The model incorporates the obtained edge embedding r u v into the relevance metric. This paper adopts an additive bias strategy, utilizing a nonlinear transformation function ϕ ( m ) ( ⋅ ) to map the high-dimensional edge embedding to a scalar bias, which is applied to the calculation process of the attention score, as shown in Equation 6: e u v k , m = q u k , m T k v k , m d head + ϕ m r u v (6)

In the equation, the first term characterizes the association intensity of nodes in the feature space through a scaled dot product; the second term introduces edge attributes as a bias to correct this association intensity.

To filter out massive redundant connections and invalid information in the network structure, this paper adopts the Sparsemax activation function instead of the traditional Softmax. Sparsemax can truncate the weights of low-relevance neighbors to zero, thereby generating sparse and robust normalized weights, as shown in Equation 7: α u v k , m = Sparsemax v ∈ N u k e u v k , m (7)

Finally, weighted aggregation is performed on the neighbor value vectors based on these sparse weights. To promote gradient propagation and training stability in deep networks, the model introduces multi-head concatenation, residual connections, and layer normalization mechanisms to obtain the updated node representation z u ( k ) under the current view, as shown in Equation 8: z u k = LayerNorm h u l − 1 + W O ‖ m = 1 H ∑ v ∈ N u k α u v k , m W V k , m h v l − 1 (8) where W O is used to fuse the feature information output by multi-head attention.

Since different types of interaction views contribute differently to defining node behavior patterns, simple averaging or concatenation cannot distinguish the importance of views. Therefore, this paper introduces Efficient Channel Attention (ECA) to achieve efficient fusion of multi-view features.

First, we concatenate the node representations { z u ( 1 ) , … , z u ( K ) } under K views to form a multi-channel feature stack H stack ∈ R K × d model . The module treats each view as an independent channel. It first aggregates the global information of each channel through Global Average Pooling (GAP), then captures local interaction information across channels using 1D convolution, and finally generates normalized weights w ∈ R K for each view through a Sigmoid function, as shown in Equation 9: w k = σ C o n v 1 D k G A P H stack (9)

After obtaining the weights, we perform a weighted summation of the representations from different views. To further fuse features and compress redundant information, the weighted features are reduced in dimension through a fully connected layer to obtain the final spatial feature representation z spatial t at time t , as shown in Equation 10: z spatial t = W fuse ∑ k = 1 K w k ⋅ z u k + b fuse (10)

To simultaneously capture topological structure associations and content patterns of interaction behaviors, the decoder reconstructs the link existence probability p ̂ u v t and the edge attribute e ̂ u v t , respectively, as shown in Equation 14: p ̂ u v t = σ u u t T u v t , e ̂ u v t = M L P dec u u t ‖ u v t (14) where σ ( ⋅ ) is the Sigmoid function, and ‖ denotes the concatenation operation.

Model training aims to minimize the joint reconstruction loss. To prevent the model from predicting edges for all node pairs, a negative sampling strategy is introduced in the structure reconstruction task. For each moment t , in addition to focusing on the set of existing positive sample edges, a set of negative sample edges E neg t of comparable size is constructed via random sampling. The structure reconstruction loss L struct adopts the binary cross-entropy loss function, aiming to maximize the likelihood probability of positive samples while minimizing that of negative samples, as shown in Equation 15: L struct = − ∑ u , v ∈ E t log p ̂ u v t − ∑ u , v ′ ∈ E neg t log 1 − p ̂ u v ′ t (15)

For attribute reconstruction, the prediction error is calculated only within the set of real edges E t , adopting mean squared error to quantify the difference between the reconstructed attribute and the real attribute e u v t , as shown in Equation 16: L attr = ∑ u , v ∈ E t ‖ e u v t − e ̂ u v t ‖ 2 2 (16)

The final total optimization objective is defined as the weighted sum of the above two parts, with an L 2 regularization term introduced to prevent overfitting, as shown in Equation 17: L = L struct + β L attr + γ ‖ Θ ‖ 2 2 (17) where β is the hyperparameter balancing structure and attribute losses, Θ represents all learnable parameters of the model, and γ is the regularization weight coefficient.

In the testing phase, the model calculates the anomaly score for each interaction edge ( u , v ) based on the reconstruction difficulty. We perform a weighted fusion of structural anomaly and attribute anomaly, defining the final anomaly score as follows in Equation 18: S c o r e u , v , t = 1 − λ ⋅ − log p ̂ u v t + λ ⋅ ‖ e u v t − e ̂ u v t ‖ 2 (18) where λ is used to adjust the sensitivity of both components. When S c o r e ( u , v , t ) exceeds a preset threshold, the interaction is determined to be an anomalous behavior.

We compare ST-MVAN with the following four baseline methods:

DeepWalk [12]: A typical graph embedding approach that regards random walk sequences as text segments and nodes as vocabulary entries; it adopts the Skip-Gram model to acquire latent node representations by maximizing the co-occurrence probability of nodes.

The experiments were built with the PyTorch framework (Python 3.8). The AdamW optimizer was chosen to boost generalization performance paired with a cosine annealing learning rate scheduler. The initial learning rate was set to 0.003 to enable fast convergence in early training phases and detailed parameter tuning in subsequent stages. Weight decay was set to 5 × 1 0 − 7 and dropout rate to 0.5 to avoid overfitting. The model’s structure includes 2 GCN layers, 4 attention heads and a hidden layer dimension of 64; the model underwent 100 training epochs. The dataset was split in chronological order with the first 50% used as training data and the next 50% as testing data.

Since the datasets lack ground-truth anomalies, we employ an anomaly injection strategy to generate synthetic anomalies exclusively for the testing phase. Specifically, we treat the existing edges in the test set as normal samples. To generate structural anomalies, we randomly sample node pairs ( u , v ) from the node set that have no observed interaction in the original data and assign them random timestamps within the test interval to create non-existent edges, simulating users forming unusual connections. To generate attribute anomalies, we randomly perturb the interaction frequency or timestamp features of existing edges by adding noise to deviate from their normal distribution. These anomalies are injected at ratios of 1%, 5%, and 10% relative to the normal edges. All experiments were repeated 10 times independently. Specifically, for each run, we re-generated the injected anomalies using different random seeds to evaluate the model’s robustness against data variations. Within each specific run, the same set of anomalies was applied to all baseline methods to ensure a fair comparison. We report the mean AUC and standard deviation over these repeated runs to assess result stability.

To conduct quantitative evaluation of the proposed model’s performance we employ the Area Under the Receiver Operating Characteristic Curve (AUC-ROC) as the core assessment index. This index offers a reliable gauge of the model’s distinguishing capability with a higher value indicating stronger capacity to accurately differentiate abnormal interactions from normal ones.

Table 1 presents the quantitative results (Mean ± SD) of diverse models on the Digg and Yelp datasets under varying anomaly injection ratios. The experimental findings show that ST-MVAN attains the best AUC results across all settings, fully confirming the validity of the proposed framework. Moreover, the relatively low standard deviations observed across all settings indicate the high stability and robustness of ST-MVAN against experimental randomness. Taking the Digg dataset with 1% anomaly injection as an instance, ST-MVAN achieves an AUC of 87.89%, surpassing DeepWalk by around 17.09% and outperforming GraphSAGE by roughly 15.39%. This directly illustrates the vital role of capturing temporal dynamics in anomaly detection. Against NetWalk, ST-MVAN maintains a distinct advantage, exceeding it by approximately 12.26% and 8.00% under the 1% setting on the Digg and Yelp datasets respectively. When compared with AddGraph, ST-MVAN outperforms it by 4.48%, 1.84%, and 2.19% under 1%, 5%, and 10% anomaly ratios on the Digg dataset. Similarly, on the Yelp dataset, ST-MVAN delivers performance improvements of 4.06%, 2.28%, and 1.68% respectively. Overall, these findings confirm that the ST-MVAN model exhibits superior detection capability and robustness.

To visually evaluate overall model performance under specific noise levels, Figures 3, 4 show ROC curve comparisons of all models at 5% anomaly injection ratio. All curves present a sharp upward slope attaining high True Positive Rate (TPR) while maintaining low False Positive Rate (FPR) and demonstrating strong anomaly ranking ability. Notably, ST-MVAN’s ROC curve covers the largest area and lies mostly above all baseline models visually highlighting its edge in overall detection performance. Against AddGraph, ST-MVAN shows a notable advantage in the low FPR region with more distinct curvature. This trait enables ST-MVAN to detect more abnormal interactions with fewer false positives in real-world applications thus delivering greater practical utility.

To further confirm the validity of core components in the ST-MVAN model we carried out ablation experiments on the Digg and Yelp datasets with a fixed 5% anomaly injection ratio. Experimental results presented in Table 2 and Figure 5 show that the full ST-MVAN model achieved the best AUC performance on both datasets reaching 86.54% and 82.65% respectively. Comparative analysis indicates that removing the Bi-GRU module causes the most notable performance drop. This result fully proves that capturing long- and short-term dynamic evolution patterns of user behaviors is critical for identifying abnormal behaviors in social networks. Additionally replacing the multi-head attention mechanism with a traditional GCN adopting weighted average aggregation leads to the loss of edge attribute semantic information and the ability to adaptively assign neighbor weights. Also excluding the ECA channel attention prevents the model from adaptively balancing the importance of different relational views, thus undermining the robustness of multi-view feature fusion. Overall, experimental results clearly demonstrate that ST-MVAN’s superior performance originates from the synergistic effect of refined spatial neighborhood feature aggregation, adaptive multi-view subgraph fusion, and bidirectional temporal modeling. This synergy allows the model to efficiently learn spatiotemporal distribution patterns of normal interactions and accurately identify abnormal behaviors deviating from these patterns.

To further assess ST-MVAN’s stability across varying training proportions we carried out sensitivity tests on the Digg dataset with fixed 10% anomaly injection ratio. We steadily decreased training proportion from 60% to 10% and documented AUC values for each timestamp in the testing phase.

From the experimental results in Figure 6, it is evident that as the training set proportion drops from 60 % to 10 % the median and maximum AUC values of the model do not decline with reduced training data instead showing steady upward tendency. This is because the training set consists exclusively of normal samples and the relative quantity of anomalous edge samples in the testing environment increases with the rising testing proportion. This data partitioning shift enables the model to better capture distribution differences between positive and negative samples during inference enhancing discriminability of anomaly scores and lifting detection performance upper limit. Yet when training data is reduced to 10 % , boxplot morphology changes noticeably with expanded vertical span and decreased minimum AUC value indicating that data scarcity increases model training uncertainty and fluctuation impairing detection result stability to some extent. Even so, ST-MVAN maintains highly competitive average AUC level with median exceeding that of high training proportion settings under 10% training data. This fully verifies the proposed framework’s excellent feature capture ability and robustness in label-scarce or weakly supervised scenarios effectively addressing data limitation challenges in dynamic graph anomaly detection.