Two-stage anomaly detection algorithm via dynamic community evolution in temporal graph
Two-stage anomaly detection algorithm via dynamic community evolution in temporal graph
复制标题
DOI：
10.1007/s10489-021-03109-4
复制
发表时间：
2022-02
影响因子：
5.3
通讯作者：
Yan Jiang;Guannan Liu
中科院分区：
文献类型：
--
作者：
Yan Jiang;Guannan Liu
从大量的用户行为数据中检测异常通常被比作大海捞针。虽然从时间图中进行异常检测已经付出了巨大的努力，但现有的研究很少同时考虑群落演化和演化路径，并且为了异常检测的目的而分析这些特征。因此，我们提出了一个两阶段异常检测框架来检测异常。在本研究中，我们建议通过构建进化二部图和设计群落相似性分数来从快照图序列中检测群落进化事件。在此基础上，提出了一种基于社区进化的异常检测和基于进化路径的异常检测相结合的异常检测方法。在基于社区演化的异常检测方法中，通过提取演化社区的特征，设计了一个异常评分来检测社区演化异常事件。此外，为了降低虚警率，本文提出了基于进化路径的异常检测方法，在基于社区进化的异常检测的基础上，通过对识别出的异常进化路径进行特征提取，进一步检测出识别出的正常进化路径的异常。我们在真实世界的数据集上进行了广泛的实验，并证明了TSAD在异常检测方面始终优于竞争的基线方法。
Detecting anomalies from a massive amount of user behavioral data is often liken to finding a needle in a haystack. While tremendous efforts have been devoted to anomaly detection from temporal graphs, existing studies rarely consider community evolution and evolutionary paths simultaneously, and analyze those characteristics for the purpose of anomaly detection. Therefore, we propose a two-stage anomaly detection (TSAD) framework to detect anomalies. In this study, we suggest detecting the community evolution events from a sequence of snapshot graphs by constructing an evolution bipartite graph and designing community similarity scores. We then propose a novel anomaly detection method combining community evolution-based anomaly detection and evolutionary path-based anomaly detection. An anomalous score is designed to detect anomalous community evolution events by extracting the characteristics of evolution communities in the community evolution-based anomaly detection method. Moreover, to reduce the false alarm rate, we propose evolutionary path-based anomaly detection to further detect the abnormality of the identified normal evolutionary paths by extracting the characteristics of the identified anomalous evolutionary paths based on community evolution-based anomaly detection. We conduct extensive experiments on real-world datasets and demonstrate that TSAD consistently outperforms competitive baseline methods in anomaly detection.