Relative Hausdorff distance for network analysis

Aksoy, Sinan G.; Nowak, Kathleen E.; Purvine, Emilie; Young, Stephen J.

doi:10.1007/s41109-019-0198-0

Title: Relative Hausdorff distance for network analysis

Journal Article · Thu Oct 17 00:00:00 EDT 2019 · Applied Network Science

DOI:https://doi.org/10.1007/s41109-019-0198-0· OSTI ID:1576960

^[1]; Nowak, Kathleen E. ^[1];

^[2];

^[1]

Pacific Northwest National Lab. (PNNL), Richland, WA (United States)
Pacific Northwest National Lab. (PNNL), Seattle, WA (United States)

Similarity measures are used extensively in machine learning and data science algorithms. The newly proposed graph Relative Hausdorff (RH) distance is a lightweight yet nuanced similarity measure for quantifying the closeness of two graphs. In this work we study the effectiveness of RH distance as a tool for detecting anomalies in time-evolving graph sequences. We apply RH to cyber data with given red team events, as well to synthetically generated sequences of graphs with planted attacks. In our experiments, the performance of RH distance is at times comparable, and sometimes superior, to graph edit distance in detecting anomalous phenomena. Furthermore, our results suggest that in appropriate contexts, RH distance has advantages over more computationally intensive similarity measures.

View Accepted Manuscript (DOE)

Cite

Export

Save

Research Organization:: Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)

Sponsoring Organization:: USDOE

Grant/Contract Number:: AC05-76RL01830

OSTI ID:: 1576960

Report Number(s):: PNNL-SA-141621

Journal Information:: Applied Network Science, Vol. 4, Issue 1; ISSN 2364-8228

Country of Publication:: United States

Language:: English

References (46)

Directed Random Dot Product Graphs Young, Stephen J.; Scheinerman, Edward Internet Mathematics, Vol. 5, Issue 1-2 https://doi.org/10.1080/15427951.2008.10129301	journal	January 2008
Graph based anomaly detection and description: a survey Akoglu, Leman; Tong, Hanghang; Koutra, Danai Data Mining and Knowledge Discovery, Vol. 29, Issue 3 https://doi.org/10.1007/s10618-014-0365-y	journal	July 2014
Authoritative sources in a hyperlinked environment Kleinberg, Jon M. Journal of the ACM, Vol. 46, Issue 5 https://doi.org/10.1145/324133.324140	journal	September 1999
HyperHeadTail: a Streaming Algorithm for Estimating the Degree Distribution of Dynamic Multigraphs Stolman, Andrew; Matulef, Kevin Proceedings of the 2017 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining 2017 - ASONAM '17 https://doi.org/10.1145/3110025.3119395	conference	January 2017
Multi-centrality graph spectral decompositions and their application to cyber intrusion detection Chen, Pin-Yu; Choudhury, Sutanay; Hero, Alfred O. 2016 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) https://doi.org/10.1109/icassp.2016.7472539	conference	March 2016
Information spreading in dynamic graphs Clementi, Andrea; Silvestri, Riccardo; Trevisan, Luca Distributed Computing, Vol. 28, Issue 1 https://doi.org/10.1007/s00446-014-0219-2	journal	June 2014
Flooding Time of Edge-Markovian Evolving Graphs Clementi, Andrea E. F.; Macci, Claudio; Monti, Angelo SIAM Journal on Discrete Mathematics, Vol. 24, Issue 4 https://doi.org/10.1137/090756053	journal	January 2010
Temporal networks Holme, Petter; Saramäki, Jari Physics Reports, Vol. 519, Issue 3 https://doi.org/10.1016/j.physrep.2012.03.001	journal	October 2012
The phase transition in inhomogeneous random graphs Bollobás, Béla; Janson, Svante; Riordan, Oliver Random Structures and Algorithms, Vol. 31, Issue 1 https://doi.org/10.1002/rsa.20168	journal	January 2007
Outlier detection in graph streams Aggarwal, Charu C.; Zhao, Yuchen; Yu, Philip S. 2011 IEEE International Conference on Data Engineering (ICDE 2011), 2011 IEEE 27th International Conference on Data Engineering https://doi.org/10.1109/icde.2011.5767885	conference	April 2011
Catching the Head, Tail, and Everything in Between: A Streaming Algorithm for the Degree Distribution Simpson, Olivia; Seshadhri, C.; McGregor, Andrew 2015 IEEE International Conference on Data Mining (ICDM) https://doi.org/10.1109/ICDM.2015.47	conference	November 2015
Anomaly detection in dynamic networks: a survey Ranshous, Stephen; Shen, Shitian; Koutra, Danai Wiley Interdisciplinary Reviews: Computational Statistics, Vol. 7, Issue 3 https://doi.org/10.1002/wics.1347	journal	March 2015
A Measure of Similarity between Graph Vertices: Applications to Synonym Extraction and Web Searching Blondel, Vincent D.; Gajardo, Anahí; Heymans, Maureen SIAM Review, Vol. 46, Issue 4 https://doi.org/10.1137/S0036144502415960	journal	January 2004
Quantification and comparison of degree distributions in complex networks Aliakbary, Sadegh; Habibi, Jafar; Movaghar, Ali 2014 7th International Symposium on Telecommunications (IST), 7'th International Symposium on Telecommunications (IST'2014) https://doi.org/10.1109/istel.2014.7000748	conference	September 2014
Non-Negative Residual Matrix Factorization with Application to Graph Anomaly Detection Tong, Hanghang; Lin, Ching-Yung Proceedings of the 2011 SIAM International Conference on Data Mining https://doi.org/10.1137/1.9781611972818.13	conference	December 2013
Cyber security data sources for dynamic network research Kent, Alexander D. Dynamic Networks and Cyber-Security https://doi.org/10.1142/9781786340757_0002	book	March 2016
Detecting Periodic Subsequences in Cyber Security Data Price-Williams, Matthew; Heard, Nick; Turcotte, Melissa 2017 European Intelligence and Security Informatics Conference (EISIC) https://doi.org/10.1109/eisic.2017.40	conference	September 2017
Measuring Closeness of Graphs—The Hausdorff Distance Banič, Iztok; Taranenko, Andrej Bulletin of the Malaysian Mathematical Sciences Society, Vol. 40, Issue 1 https://doi.org/10.1007/s40840-015-0259-1	journal	November 2015
The Average Distance in a Random Graph with Given Expected Degrees Chung, Fan; Lu, Linyuan Internet Mathematics, Vol. 1, Issue 1 https://doi.org/10.1080/15427951.2004.10129081	journal	January 2004
Botnet Detection Based on Anomaly and Community Detection Wang, Jing; Paschalidis, Ioannis Ch. IEEE Transactions on Control of Network Systems, Vol. 4, Issue 2 https://doi.org/10.1109/TCNS.2016.2532804	journal	June 2017
Comparing stars: on approximating graph edit distance Zeng, Zhiping; Tung, Anthony K. H.; Wang, Jianyong Proceedings of the VLDB Endowment, Vol. 2, Issue 1 https://doi.org/10.14778/1687627.1687631	journal	August 2009
A distance measure between attributed relational graphs for pattern recognition Sanfeliu, Alberto; Fu, King-Sun IEEE Transactions on Systems, Man, and Cybernetics, Vol. SMC-13, Issue 3 https://doi.org/10.1109/TSMC.1983.6313167	journal	May 1983
A tutorial on spectral clustering von Luxburg, Ulrike Statistics and Computing, Vol. 17, Issue 4 https://doi.org/10.1007/s11222-007-9033-z	journal	August 2007
A survey of graph edit distance Gao, Xinbo; Xiao, Bing; Tao, Dacheng Pattern Analysis and Applications, Vol. 13, Issue 1 https://doi.org/10.1007/s10044-008-0141-y	journal	January 2009
Real-Time Dynamic Network Anomaly Detection Noble, Jordan; Adams, Niall IEEE Intelligent Systems, Vol. 33, Issue 2 https://doi.org/10.1109/MIS.2018.022441346	journal	March 2018
Computing the Two-Sided Kolmogorov-Smirnov Distribution Simard, Richard; L'Ecuyer, Pierre Journal of Statistical Software, Vol. 39, Issue 11 https://doi.org/10.18637/jss.v039.i11	journal	January 2011
The average distances in random graphs with given expected degrees Chung, F.; Lu, L. Proceedings of the National Academy of Sciences, Vol. 99, Issue 25 https://doi.org/10.1073/pnas.252631999	journal	December 2002
A Survey on Different Graph Based Anomaly Detection Techniques Sensarma, Debajit; Sen Sarma, Samar Indian Journal of Science and Technology, Vol. 8, Issue 31 https://doi.org/10.17485/ijst/2015/v8i1/75197	journal	November 2015
A survey on some inequalities for expectation and variance Agarwal, R. P.; Barnett, N. S.; Cerone, P. Computers & Mathematics with Applications, Vol. 49, Issue 2-3 https://doi.org/10.1016/j.camwa.2002.11.026	journal	January 2005
A graph distance metric combining maximum common subgraph and minimum common supergraph Fernández, Mirtha-Lina; Valiente, Gabriel Pattern Recognition Letters, Vol. 22, Issue 6-7 https://doi.org/10.1016/S0167-8655(01)00017-4	journal	May 2001
Proof without prejudice: use of the Kolmogorov-Smirnov test for the analysis of histograms from flow systems and other sources. Young, I. T. Journal of Histochemistry & Cytochemistry, Vol. 25, Issue 7 https://doi.org/10.1177/25.7.894009	journal	July 1977
Stochastic kronecker graphs Mahdian, Mohammad; Xu, Ying Random Structures & Algorithms, Vol. 38, Issue 4 https://doi.org/10.1002/rsa.20335	journal	July 2010
Visualizing Automatically Detected Periodic Network Activity Gove, Robert; Deason, Lauren 2018 IEEE Symposium on Visualization for Cyber Security (VizSec) https://doi.org/10.1109/vizsec.2018.8709177	conference	October 2018
Nonparametric Statistical Inference: Book Reviews Shalabh, Journal of the Royal Statistical Society: Series A (Statistics in Society), Vol. 174, Issue 2 https://doi.org/10.1111/j.1467-985x.2010.00681_6.x	journal	March 2011
Information spreading in dynamic graphs Clementi, Andrea; Silvestri, Riccardo; Trevisan, Luca Proceedings of the 2012 ACM symposium on Principles of distributed computing - PODC '12 https://doi.org/10.1145/2332432.2332439	conference	January 2012
A Survey on Different Graph Based Anomaly Detection Techniques Sensarma, Debajit Indian Journal of Science and Technology, Vol. 8, Issue 1 https://doi.org/10.17485/ijst/2015/v8i31/75197	journal	January 2015
Anonymized User-Computer Authentication Associations in Time Kent, Alex Los Alamos National Laboratory (LANL), Los Alamos, NM (United States) https://doi.org/10.11578/1160076	dataset	January 2014
Nonparametric Statistical Inference Randles, Ronald H.; Gibbons, Jean Dickinson Technometrics, Vol. 28, Issue 3 https://doi.org/10.2307/1269084	journal	August 1986
Temporal Networks Holme, Petter; Saramäki, Jari arXiv https://doi.org/10.48550/arxiv.1108.1780	text	January 2011
Quantification and Comparison of Degree Distributions in Complex Networks Aliakbary, Sadegh; Habibi, Jafar; Movaghar, Ali arXiv https://doi.org/10.48550/arxiv.1307.3625	preprint	January 2013
Detecting periodic subsequences in cyber security data Price-Williams, Matthew; Heard, Nick; Turcotte, Melissa arXiv https://doi.org/10.48550/arxiv.1707.00640	preprint	January 2017
A General Formalism for Inhomogeneous Random Graphs Soderberg, Bo arXiv https://doi.org/10.48550/arxiv.cond-mat/0211063	text	January 2002
Graph-based Anomaly Detection and Description: A Survey Akoglu, Leman; Tong, Hanghang; Koutra, Danai arXiv https://doi.org/10.48550/arxiv.1404.4679	preprint	January 2014
Feature Extraction from Degree Distribution for Comparison and Analysis of Complex Networks Aliakbary, Sadegh; Habibi, Jafar; Movaghar, Ali arXiv https://doi.org/10.48550/arxiv.1407.3386	preprint	January 2014
Catching the head, tail, and everything in between: a streaming algorithm for the degree distribution Simpson, Olivia; Seshadhri, C.; McGregor, Andrew arXiv https://doi.org/10.48550/arxiv.1506.02574	preprint	January 2015
A measure of similarity between graph vertices Blondel, Vincent; Gajardo, Anahi; Heymans, Maureen arXiv https://doi.org/10.48550/arxiv.cs/0407061	preprint	January 2004

Similar Records

A Linear-Time Algorithm and Analysis of Graph Relative Hausdorff Distance

Journal Article · Tue Oct 01 00:00:00 EDT 2019 · SIAM Journal on Mathematics of Data Science · OSTI ID:1576960

Aksoy, Sinan G.; Nowak, Kathleen E.; Young, Stephen J.

Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection

Conference · Thu Feb 01 00:00:00 EST 2018 · OSTI ID:1576960

Tuor, Aaron R.; Baerwolf, Ryan; Knowles, Nicholas; +3 more

SIGNATURES OF ILLICIT NUCLEAR PROCUREMENT NETWORKS: AN OVERVIEW OF PRELIMINARY APPROACHES AND RESULTS

Conference · Mon May 12 00:00:00 EDT 2014 · OSTI ID:1576960

Webster, Jennifer B.; Erikson, Luke E.; Gastelum, Zoe N.; +4 more

Related Subjects

97 MATHEMATICS AND COMPUTING
graph similarity measure
cyber anomaly detection
machine learning
temporal graphs
Relative Hausdorff distance

Title: Relative Hausdorff distance for network analysis

Citation Formats

References (46)

Similar Records

Related Subjects