{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2608-23468","title":"RAD: Rule-Augmented Relational Anomaly Detection","arxiv_id":"2608.23468","date":"2026-08-24","proceeding":null,"authors":["Noah Dahle","Anne Tumlin","Ngoc Tran","Xenofon Koutsoukos","Tyler Derr"],"abstract":"Anomaly detection is often applied to data stored in relational databases, yet most existing methods require flattening multiple tables into a single feature matrix. This flattening can obscure entity identity, schema structure, and multi-hop dependencies, limiting the detection of anomalies that depend on relational context rather than isolated feature values. Beyond preserving relational structure, relational anomaly detection raises an additional challenge: how to incorporate symbolic behavioral evidence into learned relational representations. To address these challenges, we study relational anomaly detection, where the goal is to identify anomalous entities or events in a multi-table database. We propose RAD, a rule-augmented relational anomaly detector that combines heterogeneous graph representation learning with refined symbolic rule signals. RAD derives candidate rules from random-forest paths over flattened summaries of the entities or events being scored, refines them into compact interpretable predicates, injects the resulting rule features into the graph model, and learns anomaly scores using reconstruction-based and pairwise-ranking supervision. To evaluate this setting, we introduce a relational anomaly detection benchmark spanning three settings: LANL cybersecurity event detection and two unexpected user-churn anomaly tasks derived from Amazon and H&M relational databases. Experiments show that RAD improves anomaly ranking over flattened tabular detectors and relational baselines under natural class imbalance, achieving the best average rank on AUROC and AUPRC across the benchmark. Ablations show that direct rule injection and ranking-based supervision are key contributors to performance, while edge reconstruction is not uniformly beneficial. Our code and data are available at: https://github.com/noahd15/RAD_RelationalAnomalyDetection.","url_abs":"https://arxiv.org/abs/2608.23468","url_pdf":"https://arxiv.org/pdf/2608.23468","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2608.23468","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2608.23468"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection","reach":null}],"summary":{"ran":14,"unverified":1},"by_repo_kind":{"found_in_text":{"samples":15,"ran":14,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":15,"samples":[{"code_sha256_prefix":"2982966f2eefb9b1","entry":"F1Performance","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/utils.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2982966f2eefb9b1"}},{"code_sha256_prefix":"38cb4b48aa10c520","entry":"aucPerformance","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/utils.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"38cb4b48aa10c520"}},{"code_sha256_prefix":"22b0f12c0a098ce2","entry":"available_datasets","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/run_job.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/run_job.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"22b0f12c0a098ce2"}},{"code_sha256_prefix":"725d47c8f9657a0f","entry":"build_causal_edge_index_dict","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/rdl_lanl.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/rdl_lanl.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"725d47c8f9657a0f"}},{"code_sha256_prefix":"a84a262ed98ead31","entry":"dataLoading","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/utils.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a84a262ed98ead31"}},{"code_sha256_prefix":"7411ecbefbeea8c3","entry":"eval_metrics","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/run_lanl_tabular_baselines.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/run_lanl_tabular_baselines.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7411ecbefbeea8c3"}},{"code_sha256_prefix":"5b0e6f71a58d2c29","entry":"metrics_row","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/run_lanl_six_ablations.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/run_lanl_six_ablations.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5b0e6f71a58d2c29"}},{"code_sha256_prefix":"82f09177f3cb16fd","entry":"pairwise_logistic_rank_loss","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/run_lanl_tabular_baselines.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/run_lanl_tabular_baselines.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"82f09177f3cb16fd"}},{"code_sha256_prefix":"bae4a501c3f70a8b","entry":"precision_at_k","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/rdl_lanl.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/rdl_lanl.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bae4a501c3f70a8b"}},{"code_sha256_prefix":"7c231f23664d3721","entry":"precision_at_k","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/run_lanl_six_ablations.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/run_lanl_six_ablations.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7c231f23664d3721"}},{"code_sha256_prefix":"182af392557eb6ac","entry":"precision_at_k","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/run_lanl_tabular_baselines.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/run_lanl_tabular_baselines.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"182af392557eb6ac"}},{"code_sha256_prefix":"66af3e1086eecb6c","entry":"random_orthogonal_vectors","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/PrototypeNet/Model.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/PrototypeNet/Model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"66af3e1086eecb6c"}},{"code_sha256_prefix":"e9da42fee1d55f3a","entry":"summarize","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"lanl/run_lanl_six_ablations.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/lanl/run_lanl_six_ablations.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e9da42fee1d55f3a"}},{"code_sha256_prefix":"15cfee310a8f65c9","entry":"train_test_split","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/DataSet/MyDataset.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/DataSet/MyDataset.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"15cfee310a8f65c9"}},{"code_sha256_prefix":"98ba9fafc26a86ef","entry":"run","repo":"noahd15/RAD_RelationalAnomalyDetection","repo_kind":"found_in_text","path":"DRL/run_job.py","file_url":"https://github.com/noahd15/RAD_RelationalAnomalyDetection/blob/HEAD/DRL/run_job.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"98ba9fafc26a86ef"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":{"kind":"leaderboard_placements","source":"Syntology's leaderboard-shaped extractor over the paper's own arXiv-HTML tables: a model pointed at a cell, the number was read from that cell and checked against the board's metric, dataset, split and scale, and an independent check accepted the entry; not reviewed by the paper's authors or the archive's editors","extractor_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","verifier_model":null,"prompt_sha":"fa63d4bb9d755694","coverage":{"sentence":"Syntology has checked 6,264 of the 9,581 papers on this site that are newer than the archive; results from the others appear after they are checked.","papers_newer_than_archive":9581,"papers_checked":6264},"entries":[],"not_placed":{"boards":0,"rejected_by_independent_check":0,"refused_by_a_rule":0,"check_did_not_answer":0,"proposed_without_a_cell":0,"declined_by_site":0}}}