The research, led by Qi Zhang, Yulian Shi, and Shen Gao of the School of Information and Control Engineering at Southwest University of Science and Technology in Sichuan, China, together with Ling Xing of the College of Information Engineering and Artificial Intelligence at Henan University of Science and Technology, addresses a problem that has frustrated anomaly-detection systems for years. Malicious activity in social networks rarely announces itself through a single obvious signal. Instead, suspicious actions tend to be implicitly correlated with one another and to evolve over time, which makes it difficult to represent discrete individual actions alongside their shifting relational context. The central challenge, as the authors frame it, is to capture both the distinctiveness of each behavior and the complex, changing web of interactions in which it is embedded.

To meet that challenge, the team’s approach begins with the construction of a behavioral temporal knowledge graph. Knowledge graphs are structures that represent entities and the relationships between them as networks of nodes and edges, and they have proven powerful in domains ranging from search engines to drug discovery. Here, the graph serves to organize activity characteristics and the multiple interactions among them, giving the system a rich, multi-structural topological map of who did what, when, and with whom. By encoding behavior in this form, the method preserves information that flat feature lists would discard, such as the fact that a particular interaction pattern only looks suspicious in combination with certain other relationships.

Building on that foundation, the researchers introduce a comprehensive embedding strategy. Embeddings are dense numerical vectors that allow machine learning models to process complex entities as points in a continuous space, where distance and direction carry meaning. In this method, each individual action is represented with both multi-relational and temporal information, so the embedding reflects not only what the action is but how it relates to other actions and how its meaning shifts across evolving interaction scenarios. This is a crucial distinction, because behavior that appears innocuous at one moment may take on an entirely different character when viewed as part of a sequence.

The temporal dimension is handled through a particularly elegant mathematical device: a time-series tensor. A tensor generalizes the idea of a matrix to multiple dimensions, and in this case the tensor integrates association relationships within each time slice while incorporating temporal information into each behavioral representation. One can picture a stack of relationship snapshots, one per time interval, layered so that the model can perceive both the structure of interactions at any given moment and the trajectory of those structures across moments. This dual view allows the system to encode the dynamics of social interaction directly into the data representation rather than treating time as an afterthought.

With the representations in place, the detection itself is carried out by a hybrid neural architecture that pairs a variational autoencoder with a gated recurrent unit. Variational autoencoders are generative models that learn compressed, probabilistic representations of data; they excel at learning what ‘normal’ looks like and flagging inputs that do not fit. Gated recurrent units, a streamlined relative of the long short-term memory network, are designed to process sequential data, using internal gates to decide which information from past time steps should be remembered or forgotten. By combining the two, the model captures both dynamic and static interaction patterns of user activity. The recurrent component tracks how behavior evolves over time, while the autoencoder component learns the statistical shape of typical activity and identifies deviations from it.

This combination matters because real-world anomalous behavior is heterogeneous. Some threats manifest as sudden spikes or shifts in activity, the kind of dynamic pattern a recurrent network is built to catch. Others are subtler, appearing as structurally unusual relationships or interaction profiles that look abnormal even in a static snapshot. A detector tuned only to temporal anomalies will miss structural ones, and vice versa. The proposed method improves the detection of dynamically diverse anomalous behaviors precisely because it does not force this choice, instead fusing both perspectives into a unified identification model.

The authors report that extensive experiments demonstrate the effectiveness of the proposed method in detecting anomalous activities within social networks, and the architectural choices suggest why the approach should generalize well. Because the pipeline builds its understanding from the raw structure of interactions rather than relying on hand-engineered indicators of fraud, it can in principle adapt to new forms of manipulation that have not been seen before. That adaptability is increasingly essential as adversaries iterate: bot farms refine their posting schedules, influence operations mimic organic discourse more closely, and fraud networks fragment into smaller clusters to evade detection heuristics.

The broader implications extend beyond security. Anomaly detection of this kind is foundational to platform integrity, but the same techniques apply to detecting the early spread of misinformation, identifying coordinated harassment campaigns, flagging emergent health-related behavioral signals during epidemics, and studying how social contagion propagates through populations. Temporal knowledge graphs and time-series tensors offer researchers a way to treat social systems as the evolving, multilayered structures they truly are, rather than as static graphs frozen at a single instant. The method also connects to fast-growing interest in combining symbolic structures like knowledge graphs with deep learning, a hybrid paradigm that promises both the interpretability of graphs and the representational power of neural networks.

The research was supported by the National Natural Science Foundation of China under Grant No. 62171180, in part by the Natural Science Foundation of Henan Province (252300421237), and the Zhongyuan Talent Program Project (264200510018). The article, published open access on 22 September 2026 in the Journal of Big Data, reflects a growing recognition that the future of social network security lies in methods that honor time as much as topology. As online platforms continue to grow in scale and complexity, and as the line between authentic and manipulated behavior grows ever blurrier, tools that can simultaneously see the snapshot and the story may prove indispensable.

Subject of Research: Anomalous behavior detection in social networks using static and dynamic features

Article Title: A novel method for anomalous behavior detection based on static and dynamic features in social networks

Article References: Zhang, Q., Shi, Y., Gao, S., & Xing, L. (2026). A novel method for anomalous behavior detection based on static and dynamic features in social networks. Journal of Big Data. https://doi.org/10.1186/s40537-026-01556-9

Image Credits: AI Generated

DOI: 10.1186/s40537-026-01556-9

Keywords: social networks, anomaly detection, knowledge graph, tensor, variational autoencoder, gated recurrent unit, deep learning, time series analysis, dynamic networks, data mining, abnormal behavior detection, machine learning