Normalized Cut and Subgraph-Aware Multi-head Attention Based Node-Level Anomaly Detection

Abnormal node detection in a dynamic network environment is an important task to ensure the security and stability of the system, and it is even more challenging under the condition of limited computing resources. In recent years, many node-level detection methods based on statistics or machine learning have been proposed. However, how to effectively integrate structural information and temporal features while ensuring computational efficiency is still an urgent problem to be solved in graph neural networks. To this end, this paper proposes a node-level anomaly detection framework that integrates spectral partitioning and attention mechanism, named NC-GAT. This method first uses Normalized Cut (NC) to partition the original graph structure to obtain local subgraphs with consistent structural semantics. Then, a multi-head graph attention network (Multi-Head GAT) is used to learn node representations with time perception. At the same time, this paper introduces subgraph-level statistical features and integrates them with node dynamic representations to enhance context modeling capabilities, and designs an adaptive threshold strategy to effectively improve the detection robustness of the system under traffic fluctuations. Experimental results on multiple benchmark datasets show that this method is superior to existing mainstream methods in terms of detection accuracy and has high computational efficiency, which is suitable for actual resource-constrained deployment scenarios.