Uncovering Specific-Shape Graph Anomalies in Attributed Graphs

Abstract

As networks are ubiquitous in the modern era, point anomalies have been changed to graph anomalies in terms of anomaly shapes. However, the specific-shape priors about anomalous subgraphs of interest are seldom considered by the traditional approaches when detecting the subgraphs in attributed graphs (e.g., computer networks, Bitcoin networks, and etc.). This paper proposes a nonlinear approach to specific-shape graph anomaly detection. The nonlinear approach focuses on optimizing a broad class of nonlinear cost functions via specific-shape constraints in attributed graphs. Our approach can be used to many different graph anomaly settings. The traditional approaches can only support linear cost functions (e.g., an aggregation function for the summation of node weights). However, our approach can employ more powerful nonlinear cost functions, and enjoys a rigorous theoretical guarantee on the near-optimal solution with the geometrical convergence rate.

A Framework for Subgraph Detection in Interdependent Networks via Graph Block-Structured Optimization

“…Our work generalizes the aforementioned ideas in [24], [26], [27] in that we can solve combinatorial optimization problems with topological constraints via structured sparsity optimization. Other works such as [5], [10] have been designed for uncovering specificshape subgraphs via nonparametric statistics, which do not possess the ability to run on raw data. More importantly, those works only handle structural constraints defined on an isolated network (i.e.…”

“…A canonical challenging problem in graph analytics is the detection of subgraphs. Subgraph detection is useful in many fields, such as intrusion detection in computer networks [4], [5], disease outbreak detection [6], event detection in activity networks [7], [8], and traffic congestion detection [9], [10]. In this paper, we focus on subgraph detection in attributed networks, in which nodes in a graph are associated with 1 In this article, the terms graph and network are used interchangeably.…”

“…We use the shrunk Pearson correlation coefficient to compute the research similarity between authors[46]. The dual networks for the database community are similarly constructed based5 https://comunelab.fbk.eu/data.php on papers published in 3 database conferences: SIGMOD, VLDB, and ICDE. This dataset is denoted as DBLP-DB, in which 4,402 authors and 6,087 papers are included.…”