A Nonparametric Approach to Uncovering Connected Anomalies by Tree Shaped Priors

Wu, Nannan; Chen, Feng; Li, Jianxin; Huai, Jinpeng; Zhou, Baojian; Li, Bo; Ramakrishnan, Naren

doi:10.1109/tkde.2018.2868097

Cited by 9 publications

(6 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…vertices and edges in G, and P ∈ R n is the specific anomaly feature set of G. P is widely obtained by the mapping function p : V → [0, 1] defines the empirical p-value corresponding to each node v ∈ V [Wu et al, 2018, Chen andNeill, 2014], the smaller the p-value, the more abnormal the node.…”

Section: Problem Formulationmentioning

confidence: 99%

FadMan: Federated Anomaly Detection across Multiple Attributed Networks

Wu¹,

Zhang²,

Wang³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Anomaly subgraph detection has been widely used in various applications, ranging from cyber attack in computer networks to malicious activities in social networks. Despite an increasing need for federated anomaly detection across multiple attributed networks, only a limited number of approaches are available for this problem. Federated anomaly detection faces two major challenges. One is that isolated data in most industries are restricted share with others for data privacy and security. The other is most of the centralized approaches training based on data integration. The main idea of federated anomaly detection is aligning private anomalies from local data owners on the public anomalies from the attributed network in the server through public anomalies to federate local anomalies. In each private attributed network, the detected anomaly subgraph is aligned with an anomaly subgraph in the public attributed network. The significant public anomaly subgraphs are selected for federated private anomalies while preventing local private data leakage. The proposed algorithm FadMan is a vertical federated learning framework for public node aligned with many private nodes of different features, and is validated on two tasks -correlated anomaly detection on multiple attributed networks and anomaly detection on an attributeless network -using five real-world datasets. In the first scenario, FadMan outperforms competitive methods by at least 12% accuracy at 10% noise level. In the second scenario, by analyzing the distribution of abnormal nodes, we find that the nodes of traffic anomalies are associated with the event of postgraduate entrance examination on the same day. 1 In this paper, we use 'graph ' and 'network', 'vertex' and 'node', and 'attribute' and 'feature' interchangeably. Preprint. Under review.

show abstract

Section: Problem Formulationmentioning

confidence: 99%

FadMan: Federated Anomaly Detection across Multiple Attributed Networks

Wu¹,

Zhang²,

Wang³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…These methods for dynamic networks are statistical approaches without theoretical guarantees and are designed for some specific scenarios, which restricts their applications. The aforementioned algorithms [4]- [6], [9], [10] mainly leverage statistical theories, which cannot optimize on raw data and thus rarely give any theoretical guarantee for optimization.…”

Section: Related Work A: Subgraph Detection In Attributed Networkmentioning

confidence: 99%

“…Our work generalizes the aforementioned ideas in [24], [26], [27] in that we can solve combinatorial optimization problems with topological constraints via structured sparsity optimization. Other works such as [5], [10] have been designed for uncovering specificshape subgraphs via nonparametric statistics, which do not possess the ability to run on raw data. More importantly, those works only handle structural constraints defined on an isolated network (i.e.…”

Section: B: Structured Sparse Optimizationmentioning

confidence: 99%

“…Algorithm 2 Block-coordinate descent method with proximal linear update to solve problem (10) Input:…”

Section: B Graph Block-structured Gradient Hard Thresholding Pursuitmentioning

confidence: 99%

“…A canonical challenging problem in graph analytics is the detection of subgraphs. Subgraph detection is useful in many fields, such as intrusion detection in computer networks [4], [5], disease outbreak detection [6], event detection in activity networks [7], [8], and traffic congestion detection [9], [10]. In this paper, we focus on subgraph detection in attributed networks, in which nodes in a graph are associated with 1 In this article, the terms graph and network are used interchangeably.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Framework for Subgraph Detection in Interdependent Networks via Graph Block-Structured Optimization

et al. 2020

Self Cite

View full text Add to dashboard Cite

As the backbone of many real-world complex systems, networks interact with others in nontrivial ways from time to time. It is a challenging problem to detect subgraphs that have dependencies on each other across multiple networks. Instead of devising a method for a specific scenario, we propose a generic framework to discover subgraphs in multiple interdependent networks, which generalizes the classical subgraph detection problem in a single network and can be applied to more practical applications. Specifically, we propose the Graph Block-structured Gradient Hard Thresholding Pursuit (GB-GHTP) framework to optimize interdependent networks with block-structured constraints, which enjoys 1) a theoretical guarantee and 2) a nearly linear time complexity on the network size. It is demonstrated how our framework can be applied to three practical applications: 1) evolving anomalous subgraph detection in dynamic networks, 2) anomalous subgraph detection in networks of networks, and 3) connected dense subgraph detection in dual networks. We evaluate our framework on large-scale datasets with comprehensive experiments, which validate our framework's effectiveness and efficiency.INDEX TERMS subgraph detection, sparse optimization, interdependent networks.

show abstract