With the explosive adoption of web-based technology, the amount of graph-structured data has increased dramatically, resulting in a higher demand to find anomalous patterns in different types of online services, such as fraudulent transactions, fake accounts, and coordinated malicious campaigns. The performance of anomaly detection in graphs of web systems is a challenge due to the sparse and camouflaged nature of such anomalies, multi-granular irregularity features, and the instability of the generative models in a real-world web application. To address these constraints, we introduce a new unified generative framework GRAND (Graph Anomaly Detection via Diffusion) suitable for graph data of the web domain. GRAND applies a novel dual-diffusion strategy: continuous Gaussian diffusion for node features and discrete diffusion for edges, combined with a structural-prior-conditioned graph transformer denoiser. Besides this, the framework adds strong anomaly scoring mechanisms with adaptive pooling and normalization schemes to detect the subtle anomaly signals typical of web data. It provides degeneracy detection for inference stability. GRAND has been demonstrated to obtain better results than state-of-the-art methods by extensive evaluations of different benchmark datasets. GRAND demonstrates strong performance in the detection of money laundering, particularly on the Elliptic dataset, a Bitcoin transaction graph typically for financial web applications. © 2026 Owner/Author.

Graph analysis has become increasingly important in numerous applications and services with the widespread usage of social networks, transportation networks, and other graph-driven systems. However, the extensive exploitation of graph data also poses severe risks to users' privacy. Classical differential privacy (DP), while is effective in protecting sensitive information, but still relies on trusted data curators, which may not be accessible in distributed environments. Local differential privacy (LDP) offers a decentralized version by allowing each user to add noise to her own data before sending it to the server, thus eliminating the dependence on a trusted data curator. Despite LDP on graph data has been thoroughly studied, subgraph counting, particularly triangle counting, with LDP still faces crucial challenges, which may lead to large estimation errors. In this paper, we investigate the dense graph problem caused by applying Randomized Response mechanism and propose a mechanism called as locally differentially private triangle counting with edge selection (PTES) mechanism to improve estimation accuracy of triangle counts. PTES introduces a sparsity-related edge selection method to reduce the estimation error caused by the large number of wedges. Furthermore, we present a graph projection method to restrict the noise introduced into the results in the ∊-edge LDP mechanism. Through extensive experiments using two real-world datasets (Twitch and Github) and synthetic dataset, we demonstrate that our algorithm maintains a small estimation error of triangle counting while effectively protecting user’ privacy.

Attributed graph data is powerful to describe relational information in various areas, such as social links through numerous web services and citation/reference relations in the collaboration network. Taking advantage of attributed graph data, service providers can model complex systems and capture diversified interactions to achieve better business performance. However, privacy concern is a huge obstacle to collect and analyze user's attributed graph data. Existing studies on protecting private graph data mainly focus on edge local differential privacy(LDP), which might be insufficient in some highly sensitive scenarios. In this paper, we present a novel privacy notion that is stronger than edge LDP, and investigate approaches to analyze attributed graphs under this notion. To neutralize the effect of excessively introduced noise, we propose PrivAG, a privacy-preserving framework that protects attributed graph data in the local setting while providing representative graph statistics. The effectiveness and efficiency of PrivAG framework is validated through extensive experiments.

In a software defined network (SDN), the control plane needs to frequently collect flow statistics measured at the data plane switches for different applications, such as traffic engineering, flow re-routing, and attack detection. However, existing solutions for flow statistics collection may result in large bandwidth cost in the control channel and long processing delay on switches, which significantly interfere with the basic functions such as packet forwarding and route update. To address this challenge, we propose a Cost-Optimized Flow Statistics Collection (CO-FSC) scheme using wildcard-based requests. We prove that the CO-FSC problem is NP-Hard and present a rounding-based algorithm with an approximation factor f, where f is the maximum number of switches visited by each flow. Moreover, our CO-FSC problem is extended to the general case, in which only a part of flows in a network need to be collected. The extensive simulation results show that the proposed algorithms can reduce the bandwidth overhead by over 41% and switch processing delay by over 45% compared with the existing solutions.

In a software-defined network (SDN), the control plane needs to frequently collect flow statistics measured at the data plane switches for different applications, such as traffic engineering, QoS routing, and attack detection. However, existing solutions for flow statistics collection may result in large bandwidth cost in the control channel and long processing delay on switches, which significantly interfere with the basic functions, such as packet forwarding and route update. To address this challenge, we propose a cost-optimized flow statistics collection (CO-FSC) scheme and a cost-optimized partial flow statistics collection (CO-PFSC) scheme using wildcard-based requests, and prove that both the CO-FSC and CO-PFSC problems are NP-hard. For CO-FSC, we present a rounding-based algorithm with an approximation factor f, where f is the maximum number of switches visited by each flow. For CO-PFSC, we present an approximation algorithm based on randomized rounding for collecting statistics information of a part of flows in a network. Some practical issues are discussed to enhance our algorithms, for example, the applicability of our algorithms. Moreover, we extend CO-FSC to achieve the control link cost optimization FSC problem, and also design an algorithm with an approximation factor f for this problem. We implement our designed flow statistics collection algorithms on the open virtual switch-based SDN platform. The testing and extensive simulation results show that the proposed algorithms can reduce the bandwidth overhead by over 39% and switch processing delay by over 45% compared with the existing solutions.