Real-Time Anomaly Detection in Edge Streams

Cited 4 time in webofscience Cited 0 time in scopus
  • Hit : 230
  • Download : 0
Given a stream of graph edges from a dynamic graph, how can we assign anomaly scores to edges in an online manner, for the purpose of detecting unusual behavior, using constant time and memory? Existing approaches aim to detect individually surprising edges. In this work, we propose Midas, which focuses on detecting microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, such as lockstep behavior, including denial of service attacks in network traffic data. We further propose Midas-F, to solve the problem by which anomalies are incorporated into the algorithm's internal states, creating a "poisoning" effect that can allow future anomalies to slip through undetected. Midas-F introduces two modifications: (1) we modify the anomaly scoring function, aiming to reduce the "poisoning"effect of newly arriving edges; (2) we introduce a conditional merge step, which updates the algorithm's data structures after each time tick, but only if the anomaly score is below a threshold value, also to reduce the "poisoning"effect. Experiments show that Midas-F has significantly higher accuracy than Midas. In general, the algorithms proposed in thiswork have the following properties: (a) they detectsmicrocluster anomalies while providing theoretical guarantees about the false positive probability; (b) they are online, thus processing each edge in constant time and constant memory, and also processes the data orders-ofmagnitude faster than state-of-the-art approaches; and (c) they provides up to 62% higher area under the receiver operating characteristic curve than state-of-the-art approaches.
Publisher
ASSOC COMPUTING MACHINERY
Issue Date
2022-08
Language
English
Article Type
Article
Citation

ACM TRANSACTIONS ON KNOWLEDGE DISCOVERY FROM DATA, v.16, no.4

ISSN
1556-4681
DOI
10.1145/3494564
URI
http://hdl.handle.net/10203/296897
Appears in Collection
AI-Journal Papers(저널논문)
Files in This Item
There are no files associated with this item.
This item is cited by other documents in WoS
⊙ Detail Information in WoSⓡ Click to see webofscience_button
⊙ Cited 4 items in WoS Click to see citing articles in records_button

qr_code

  • mendeley

    citeulike


rss_1.0 rss_2.0 atom_1.0