A multi-level anomaly detection algorithm for time-varying graph data with interactive visualization
- Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)
- North Carolina State Univ., Raleigh, NC (United States)
This work presents a novel modeling and analysis framework for graph sequences which addresses the challenge of detecting and contextualizing anomalies in labelled, streaming graph data. We introduce a generalization of the BTER model of Seshadhri et al. by adding flexibility to community structure, and use this model to perform multi-scale graph anomaly detection. Specifically, probability models describing coarse subgraphs are built by aggregating node probabilities, and these related hierarchical models simultaneously detect deviations from expectation. This technique provides insight into a graph's structure and internal context that may shed light on a detected event. Additionally, this multi-scale analysis facilitates intuitive visualizations by allowing users to narrow focus from an anomalous graph to particular subgraphs or nodes causing the anomaly. For evaluation, two hierarchical anomaly detectors are tested against a baseline Gaussian method on a series of sampled graphs. We demonstrate that our graph statistics-based approach outperforms both a distribution-based detector and the baseline in a labeled setting with community structure, and it accurately detects anomalies in synthetic and real-world datasets at the node, subgraph, and graph levels. Furthermore, to illustrate the accessibility of information made possible via this technique, the anomaly detector and an associated interactive visualization tool are tested on NCAA football data, where teams and conferences that moved within the league are identified with perfect recall, and precision greater than 0.786.
- Research Organization:
- Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)
- Sponsoring Organization:
- USDOE Laboratory Directed Research and Development (LDRD) Program; Work for Others (WFO)
- Grant/Contract Number:
- AC05-00OR22725
- OSTI ID:
- 1330521
- Journal Information:
- Social Network Analysis and Mining, Vol. 6, Issue 1; ISSN 1869-5450
- Publisher:
- SpringerCopyright Statement
- Country of Publication:
- United States
- Language:
- English
Similar Records
EGBTER: Capturing Degree Distribution, Clustering Coefficients, and Community Structure in a Single Random Graph Model
Understanding the Hierarchy of Dense Subgraphs in Stationary and Temporally Varying Setting