Node classification in dynamic networks using graph factorization

A system for detecting and responding to anomalous nodes in a network, comprising:

• a hardware processor;
• a memory, configured to store a temporal graph factorization network that is executed by the processor, wherein the temporal graph factorization network is configured to infer temporal factors that represent changes in a network graph across a plurality of time steps, with a temporal factor for each time step depending on a temporal factor for a previous time step, to infer an invariant factor that represents information about the network graph that does not change across the plurality of time steps, to combine the temporal factors and the invariant factor into a combined temporal-invariant representation, and to determine that an unlabeled node is anomalous, based on the combined temporal-invariant representation;
• and
• a security console, configured to perform a security action responsive to the determination that unlabeled node is anomalous.