Detecting Anomalous Activity on Networks With the Graph Fourier Scan Statistic

Abstract

We consider the problem of deciding, based on a single noisy measurement at each vertex of a given graph, whether the underlying unknown signal is constant over the graph or there exists a cluster of vertices with anomalous activation. This problem is relevant to several applications such as surveillance, disease outbreak detection, biomedical imaging, environmental monitoring, etc. Since the activations in these problems often tend to be localized to small groups of vertices in the graphs, we model such activity by a class of signals that are supported over a (possibly disconnected) cluster with low cut size relative to its size. We analyze the corresponding generalized likelihood ratio (GLR) statistics and relate it to the problem of finding a sparsest cut in the graph. We develop a tractable relaxation of the GLR statistic based on the combinatorial Laplacian of the graph, which we call the graph Fourier scan statistic, and analyze its properties. We show how its performance as a testing procedure depends directly on the spectrum of the graph, and use this result to explicitly derive its asymptotic properties on a few significant graph topologies. Finally, we demonstrate theoretically and with simulations that the graph Fourier scan statistic can outperform naïve testing procedures based on global averaging and vertex-wise thresholding. We also demonstrate the usefulness of the GFSS by analyzing groundwater Arsenic concentrations from a U.S. Geological Survey dataset. *

NetMix: A network-structured mixture model for reduced-bias estimation of altered subnetworks

“…More generally, the Normally Distributed Altered Subnetwork Problem is related to a larger class of network anomaly problems, which have been studied extensively in the machine learning and statistics literature [6,4,1,3,83,82,81,80,5]. To be er understand the relationships between these problems and the algorithms developed to solve them, we will describe a generalization of the Altered Subnetwork Problem.…”

“…Separately, many publications in the statistics and machine learning literature investigate the problem of detecting whether or not a network contains an anomalous subnetwork, or a network anomaly, e.g., [6,4,1,3,83,82,81,80,5]. ese papers describe speci c generative models of network anomalies and use a rigorous hypothesis-testing framework to prove asymptotic results regarding the conditions under which it is possible to detect a network anomaly.…”

Distributed Change Detection in Streaming Graph Signals

“…where δ is non-zero only on C * with a constant value over this cluster. These assumptions differ from [8] in that (1) depends on time t and m is not necessarily constant over all vertices.…”

“…where g(y) is the graph-filtered signal in (3), and h * (µ) is the frequency response of the filter defined as [8]:…”

Percolation-Based Detection of Anomalous Subgraphs in Complex Networks

“…This method was applied to scan statistics [2,26,27], using elements of spectral graph theory [9] to find a relaxed form of the connectivity constraint. Similar ideas were also used in a slightly different context [29][30][31], where the class Λ consists of subgraphs with low cut size rather than connected ones. Algorithmic Approaches.…”