DeepAI
Log In Sign Up

Real-Time Streaming Anomaly Detection in Dynamic Graphs

09/17/2020
by   Siddharth Bhatia, et al.
27

Given a stream of graph edges from a dynamic graph, how can we assign anomaly scores to edges in an online manner, for the purpose of detecting unusual behavior, using constant time and memory? Existing approaches aim to detect individually surprising edges. In this work, we propose MIDAS, which focuses on detecting microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, such as lockstep behavior, including denial of service attacks in network traffic data. We further propose MIDAS-F, to solve the problem by which anomalies are incorporated into the algorithm's internal states, creating a 'poisoning' effect which can allow future anomalies to slip through undetected. MIDAS-F introduces two modifications: 1) We modify the anomaly scoring function, aiming to reduce the 'poisoning' effect of newly arriving edges; 2) We introduce a conditional merge step, which updates the algorithm's data structures after each time tick, but only if the anomaly score is below a threshold value, also to reduce the `poisoning' effect. Experiments show that MIDAS-F has significantly higher accuracy than MIDAS. MIDAS has the following properties: (a) it detects microcluster anomalies while providing theoretical guarantees about its false positive probability; (b) it is online, thus processing each edge in constant time and constant memory, and also processes the data 130 to 929 times faster than state-of-the-art approaches; (c) it provides 41 approaches.

READ FULL TEXT
11/11/2019

MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams

Given a stream of graph edges from a dynamic graph, how can we assign an...
11/26/2020

Fast and Accurate Anomaly Detection in Dynamic Graphs with a Two-Pronged Approach

Given a dynamic graph stream, how can we detect the sudden appearance of...
11/27/2021

Distributed Anomaly Detection in Edge Streams using Frequency based Sketch Datastructures

Often logs hosted in large data centers represent network traffic data o...
06/08/2021

Sketch-Based Streaming Anomaly Detection in Dynamic Graphs

Given a stream of graph edges from a dynamic graph, how can we assign an...
04/29/2022

HashNWalk: Hash and Random Walk Based Anomaly Detection in Hyperedge Streams

Sequences of group interactions, such as emails, online discussions, and...
04/04/2021

Isconna: Streaming Anomaly Detection with Frequency and Patterns

An edge stream is a common form of presentation of dynamic networks. It ...
10/21/2019

GraphSAC: Detecting anomalies in large-scale graphs

A graph-based sampling and consensus (GraphSAC) approach is introduced t...

Code Repositories

MIDAS

Anomaly Detection on Dynamic (time-evolving) Graphs in Real-time and Streaming manner. Detecting intrusions (DoS and DDoS attacks), frauds, fake rating anomalies.


view repo