  Recently, graph anomaly detection on attributed networks has attracted
growing attention in data mining and machine learning communities. Apart from
attribute anomalies, graph anomaly detection also aims at suspicious
topological-abnormal nodes that exhibit collective anomalous behavior. Closely
connected uncorrelated node groups form uncommonly dense substructures in the
network. However, existing methods overlook that the topology anomaly detection
performance can be improved by recognizing such a collective pattern. To this
end, we propose a new graph anomaly detection framework on attributed networks
via substructure awareness (ARISE for abbreviation). Unlike previous
algorithms, we focus on the substructures in the graph to discern
abnormalities. Specifically, we establish a region proposal module to discover
high-density substructures in the network as suspicious regions. The average
node-pair similarity can be regarded as the topology anomaly degree of nodes
within substructures. Generally, the lower the similarity, the higher the
probability that internal nodes are topology anomalies. To distill better
embeddings of node attributes, we further introduce a graph contrastive
learning scheme, which observes attribute anomalies in the meantime. In this
way, ARISE can detect both topology and attribute anomalies. Ultimately,
extensive experiments on benchmark datasets show that ARISE greatly improves
detection performance (up to 7.30% AUC and 17.46% AUPRC gains) compared to
state-of-the-art attributed networks anomaly detection (ANAD) algorithms.
