SedanSpot: Detecting Anomalies in Edge Streams

Eswaran, Dhivya; Faloutsos, Christos

doi:10.1109/icdm.2018.00117

Cited by 62 publications

(67 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This allows one to design scalable approximation algorithms to solve the underlying problems. There has been extensive work on estimating triangles (cycles of length three) in graphs [19,21], butterflies (cycles of length four) in bipartite graphs [15], and anomaly detection [8] when the graph is input as a stream of edges. A framework for estimating the number of connected induced sub-graphs on three and four vertices is presented in [6].…”

Section: Related Workmentioning

confidence: 99%

Estimating Descriptors for Large Graphs

Hassan

Shabbir

Khan

et al. 2020

Advances in Knowledge Discovery and Data Mining

View full text Add to dashboard Cite

Embedding networks into a fixed dimensional feature space, while preserving its essential structural properties is a fundamental task in graph analytics. These feature vectors (graph descriptors) are used to measure the pairwise similarity between graphs. This enables applying data mining algorithms (e.g classification, clustering, or anomaly detection) on graph-structured data which have numerous applications in multiple domains. State-of-the-art algorithms for computing descriptors require the entire graph to be in memory, entailing a huge memory footprint, and thus do not scale well to increasing sizes of real-world networks. In this work, we propose streaming algorithms to efficiently approximate descriptors by estimating counts of sub-graphs of order k ≤ 4, and thereby devise extensions of two existing graph comparison paradigms: the Graphlet Kernel and NetSimile. Our algorithms require a single scan over the edge stream, have space complexity that is a fraction of the input size, and approximate embeddings via a simple sampling scheme. Our design exploits the trade-off between available memory and estimation accuracy to provide a method that works well for limited memory requirements. We perform extensive experiments on real-world networks and demonstrate that our algorithms scale well to massive graphs.

show abstract

Section: Related Workmentioning

confidence: 99%

Estimating Descriptors for Large Graphs

Hassan

Shabbir

Khan

et al. 2020

Advances in Knowledge Discovery and Data Mining

View full text Add to dashboard Cite

show abstract

“…Another survey ( Gupta et al 2014 ) applied outlier detection methods to temporal data. Recently, researchers targeted the outlier “bridge edges" in a streaming of graphs ( Eswaran et al 2018 ; Aggarwal et al 2011 ) or a streaming of separate point-to-point edges ( Eswaran and Faloutsos 2018 ; Takahashi et al 2011 ). Our proposed outlier detection method deals with the new target of information walks, which considers both overall structural and temporal patterns.…”

Section: Related Workmentioning

confidence: 99%

“…We use a simulation-based test of information walk outliers in the network of information walks in order to (1) demonstrate the efficacy of the model for the information walks network; (2) complement the proposed BPR-IW model of walk prediction since the users of an intelligent network platform may not have time to focus on every walk and check the prediction of its future direction while an overall outlier detection function could filter some “abnormal” or “new” walks and remind users to check. In related work ( Savage et al 2014 ; Ranshous et al 2015 ; Eswaran and Faloutsos 2018 ; Takahashi et al 2011 ), researchers have targeted different parts in a graph to build a specific outlier detection algorithm, including nodes, subgraphs, separate point-to-point edges (e.g., TCP-IP communication, connections between new accounts in social networks). Herein we are the first to implement outlier detection for a whole information walk, which differs from prior work due to the existence of the same single “walker” or information flow along the sequence of visited nodes.…”

Section: Introductionmentioning

confidence: 99%

Towards intelligent complex networks: the space and prediction of information walks

O’Malley

Rockmore

2019

Appl Netw Sci

View full text Add to dashboard Cite

In this paper we study the problem of walk-specific information spread in directed complex social networks. Classical models usually analyze the “explosive” spread of information on social networks (e.g., Twitter) – a broadcast or epidemiological model focusing on the dynamics of a given source node “infecting” multiple targets. Less studied, but of equal importance is the case of single-track information flow, wherein the focus is on the node-by-node (and not necessarily a newly visited node) trajectory of information transfer. An important and motivating example is the sequence of physicians visited by a given patient over a presumed course of treatment or health event. This is the so-called a referral sequence which manifests as a path in a network of physicians. In this case the patient (and her health record) is a source of “information" from one physician to the next. With this motivation in mind we build a Bayesian Personalized Ranking (BPR) model to predict the next node on a walk of a given network navigator using network science features. The problem is related to but different from the well-investigated link prediction problem. We present experiments on a dataset of several million nodes derived from several years of U.S. patient referral records, showing that the application of network science measures in the BPR framework boosts hit-rate and mean percentile rank for the task of next-node prediction. We then move beyond the simple information walk to consider the derived network space of all information walks within a period, in which a node represents an information walk and two information walks are connected if have nodes in common from the original (social) network. To evaluate the utility of such a network of information walks, we simulate outliers of information walks and distinguish them with the other normal information walks, using five distance metrics for the derived feature vectors between two information walks. The experimental results of such a proof-of-concept application shows the utility of the derived information walk network for the outlier monitoring of information flow on an intelligent network.

show abstract

“…A summary of the related work is listed in Table 1. There are reviews addressing the chal- Scientific Work Reviews [19,27] Graph-based methods [2,12,13,36,37,41,42] Graph-based and time-sensitive methods [1,45] Machine learning-based [6,14,32] Statistical processes [33,44,48,50] Wavelet analysis [25,31,35] Industrial Intrusion Detection [3,15,18,20,23,28,34,38,39,46] lenge of anomaly detection for intrusion detection. García-Teodoro et al address the challenges of this field of work while presenting techniques and systems [19].…”

Section: Related Workmentioning

confidence: 99%

“…Pasqualetti et al present a method specifically for detecting attacks on Cyber-Physical Systems (CPSs) while considering graph-properties [37]. A different kind of approach for detecting anomalies in graph is presented by Eswaran and Faloutsos [13]. They consider dynamic graphs and look at the edges in any given time step, called an edge stream.…”

Section: Related Workmentioning

confidence: 99%

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

Antón¹,

Fraunholz²,

Schotten³

2019

Proceedings of the 14th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Until two decades ago, industrial networks were deemed secure due to physical separation from public networks. An abundance of successful attacks proved that assumption wrong. Intrusion detection solutions for industrial application need to meet certain requirements that differ from home-and office-environments, such as working without feedback to the process and compatibility with legacy systems. Industrial systems are commonly used for several decades, updates are often difficult and expensive. Furthermore, most industrial protocols do not have inherent authentication or encryption mechanisms, allowing for easy lateral movement of an intruder once the perimeter is breached. In this work, an algorithm for motif discovery in time series, Matrix Profiles, is used to detect outliers in the timing behaviour of an industrial process. This process was monitored in an experimental environment, containing ground truth labels after attacks were performed. Furthermore, the graph representations of a different industrial data set that has been emulated are used to detect malicious activities. These activities can be derived from anomalous communication patterns, represented as edges in the graph. Finally, an integration concept for both methods is proposed.• Security and privacy → Intrusion detection systems; Network security; • Theory of computation → Design and analysis of algorithms; • Applied computing → Enterprise architectures.

show abstract

SedanSpot: Detecting Anomalies in Edge Streams

Cited by 62 publications

References 21 publications

Estimating Descriptors for Large Graphs

Estimating Descriptors for Large Graphs

Towards intelligent complex networks: the space and prediction of information walks

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

Contact Info

Product

Resources

About