Localizing anomalous changes in time-evolving graphs

Sricharan, Kumar; Das, Kunal

doi:10.1145/2588555.2612184

Cited by 60 publications

(42 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This forms an irregular connection with respect to his past connections in the network (Koutra et al, 2012). Sricharan and Das (2014) use a method based on commute time distances to detect changes involving edges. Given a graph, the commute time distance between vertex i and vertex j is the expected return path length between vertex i and vertex j (Khoa & Chawla, 2012).…”

Section: Changes In Edgesmentioning

confidence: 99%

Change detection in dynamic attributed networks

Hewapathirana

2018

WIREs Data Min & Knowl

View full text Add to dashboard Cite

A network provides powerful means of representing complex relationships between entities by abstracting entities as vertices, and relationships as edges connecting vertices in a graph. Beyond the presence or absence of relationships, a network may contain additional information that can be attributed to the entities and their relationships. Attaching these additional attribute data to the corresponding vertices and edges yields an attributed graph. Moreover, in the majority of real‐world applications, such as online social networks, financial networks and transactional networks, relationships between entities evolve over time. Change detection in dynamic attributed networks is an important problem in many areas, such as fraud detection, cyber intrusion detection, and health care monitoring. It is a challenging problem because it involves a time sequence of attributed graphs, each of which is usually very large and can contain many attributes attached to the vertices and edges, resulting in a complex, high‐dimensional mathematical object. In this survey we provide an overview of some of the existing change detection methods that utilize attribute information. We categorize these methods based on the levels of structure in the graph that are exploited to detect changes. These levels are vertices, edges, subgraphs, communities, and the overall graph. We focus attention on the strengths and weaknesses of these methods, including their performance and scalability. Furthermore, we discuss some publicly available dynamic network datasets and give a brief overview of models to generate dynamic attributed networks. Finally, we discuss the limitations of existing approaches identifying key areas for future research. This article is categorized under: Fundamental Concepts of Data and Knowledge > Data Concepts Algorithmic Development > Spatial and Temporal Data Mining Technologies > Machine Learning Application Areas > Business and Industry

show abstract

Section: Changes In Edgesmentioning

confidence: 99%

Change detection in dynamic attributed networks

Hewapathirana

2018

WIREs Data Min & Knowl

View full text Add to dashboard Cite

show abstract

“…There already have been works investigating graph embedding for anomaly detection [4], [15], [27]. While [4] shows the possibility of using embedding for outlier detection, an automatic detection method remains missing.…”

Section: Related Workmentioning

confidence: 99%

“…While [4] shows the possibility of using embedding for outlier detection, an automatic detection method remains missing. [27] uses the commute time distance for detecting anomalies in dynamic graphs, where the eigenspace embedding only serves to approximately compute the commute time distance, and [15] proposes to use the spectral embedding to reveal anomalous community structure across multiple sources. Different from these works, our approach adopts a new measure to evaluate the level of anomalousness, incorporates the graph partitioning technique, and proposes a novel dimension reduction technique to make the approach more scalable and effective for large networks.…”

Section: Related Workmentioning

confidence: 99%

“…In recent years, the detection of anomalies in networks has started attracting significant attention [1], [3], [5], [7], [15], [17], [24], [27], [30], because of the increasing attention on social network analysis models. Network anomalies are useful to discover, both from the perspective of their application-specific significance, and the possibility to improve the performance of other network-centric data mining tasks such as community detection and classification.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An embedding approach to anomaly detection

Aggarwal²,

et al. 2016

2016 IEEE 32nd International Conference on Data Engineering (ICDE)

View full text Add to dashboard Cite

Network anomaly detection has become very popular in recent years because of the importance of discovering key regions of structural inconsistency in the network. In addition to application-specific information carried by anomalies, the presence of such structural inconsistency is often an impediment to the effective application of data mining algorithms such as community detection and classification. In this paper, we study the problem of detecting structurally inconsistent nodes that connect to a number of diverse influential communities in large social networks. We show that the use of a network embedding approach, together with a novel dimension reduction technique, is an effective tool to discover such structural inconsistencies. We also experimentally show that the detection of such anomalous nodes has significant applications: one is the specific use of detected anomalies, and the other is the improvement of the effectiveness of community detection.

show abstract

“…For example, consider the time varying email communications between a set of employees in an organisation. A sudden collaboration between a set of employees who rarely communicated during the recent past, may indicate some unusual motivation or a major event involving the organisation [3]. Such changes in entity behaviour can be detected by monitoring the behaviour of vertices in the corresponding sequence of graphs.Monitoring the behaviour of every vertex in the graph is a challenging problem because each graph in the time sequence contains a large number of vertices resulting in a high-dimensional mathematical object.…”

mentioning

confidence: 99%

Change detection in noisy dynamic networks: a spectral embedding approach

Lee

Moltchanova

McLeod

2020

Soc. Netw. Anal. Min.

View full text Add to dashboard Cite

Change detection in dynamic networks is an important problem in many areas, such as fraud detection, cyber intrusion detection and health care monitoring. It is a challenging problem because it involves a time sequence of graphs, each of which is usually very large and sparse with heterogeneous vertex degrees, resulting in a complex, high dimensional mathematical object. Spectral embedding methods provide an effective way to transform a graph to a lower dimensional latent Euclidean space that preserves the underlying structure of the network. Although change detection methods that use spectral embedding are available, they do not address sparsity and degree heterogeneity that usually occur in noisy real-world graphs and a majority of these methods focus on changes in the behaviour of the overall network.In this paper, we adapt previously developed techniques in spectral graph theory and propose a novel concept of applying Procrustes techniques to embedded points for vertices in a graph to detect changes in entity behaviour. Our spectral embedding approach not only addresses sparsity and degree heterogeneity issues, but also obtains an estimate of the appropriate embedding dimension. We call this method CDP (change detection using Procrustes analysis). We demonstrate the performance of CDP through extensive simulation experiments and a real-world application. CDP successfully detects various types of vertex-based changes including (i) changes in vertex degree, (ii) changes in community membership of vertices, and (iii) unusual increase or decrease in edge weight between vertices. The change detection performance 1.2 Hewapathirana et al.of CDP is compared with two other baseline methods that employ alternative spectral embedding approaches. In both cases, CDP generally shows superior performance.A network is a collection of entities, that have inherent relationships. Some examples include a social network of friendships among people, a communication network of company employees connected by phone calls, emails or text messages, and a biological network of neurons connected by their synapses. A network can be mathematically conceptualized as a graph by associating entities with vertices, and relationships with edges connecting vertices in the graph. For example, in the graph representation of a social network like Facebook, vertices may represent friends and edges represent friendship connections.Most real-world networks evolve as time progresses. That is, the entities and their relationships keep evolving with time. This type of relational data can be represented as a dynamic network. For example, a communication network of a company is a dynamic network because new employees (entities) join the network and communication patterns (relationships) are modified continuously. Although both the entities and the relationships in a network can vary over time, in this paper, we assume that a dynamic network consists of a fixed set of entities with time varying relationships between them. A dynamic network can be represente...

show abstract

Localizing anomalous changes in time-evolving graphs

Cited by 60 publications

References 15 publications

Change detection in dynamic attributed networks

Change detection in dynamic attributed networks

An embedding approach to anomaly detection

Change detection in noisy dynamic networks: a spectral embedding approach

Contact Info

Product

Resources

About