Given a stream of graph edges from a dynamic graph, how can we assign anomaly scores to edges in an online manner, for the purpose of detecting unusual behavior, using constant time and memory? Existing approaches aim to detect individually surprising edges. In this work, we propose Midas, which focuses on detecting microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, such as lockstep behavior, including denial of service attacks in network traffic data. Midas has the following properties: (a) it detects microcluster anomalies while providing theoretical guarantees about its false positive probability; (b) it is online, thus processing each edge in constant time and constant memory, and also processes the data 108–505 times faster than state-of-the-art approaches; (c) it provides 46%-52% higher accuracy (in terms of AUC) than state-of-the-art approaches.

No abstract

Given a stream of entries in a multi-aspect data setting i.e., entries having multiple dimensions, how can we detect anomalous activities in an unsupervised manner? For example, in the intrusion detection setting, existing work seeks to detect anomalous events or edges in dynamic graph streams, but this does not allow us to take into account additional attributes of each entry. Our work aims to define a streaming multi-aspect data anomaly detection framework, termed MStream which can detect unusual group anomalies as they occur, in a dynamic manner. MStream has the following properties: (a) it detects anomalies in multi-aspect data including both categorical and numeric attributes; (b) it is online, thus processing each record in constant time and constant memory; (c) it can capture the correlation between multiple aspects of the data. MStream is evaluated over the KDDCUP99, CICIDS-DoS, UNSW-NB 15 and CICIDS-DDoS datasets, and outperforms state-of-the-art baselines.

We present a computational model capable of simulating aspects of human knowledge for thousands of real-world concepts. Our approach involves fine-tuning a transformer network for natural language understanding on participant-generated feature norms. We show that such a model can successfully extrapolate from its training dataset, and predict human knowledge for novel concepts and features. We also apply our model to stimuli from twenty-three previous experiments in semantic cognition research, and show that it reproduces fifteen classic findings involving semantic verification, concept typicality, feature distribution, and semantic similarity. We interpret these findings using established properties of classic connectionist networks. The success of our approach shows how the combination of natural language data and psychological data can be used to build cognitive models with rich world knowledge. Such models can be used in the service of new psychological applications, such as the cognitive process modeling of naturalistic semantic verification and knowledge retrieval, as well as the modeling of real-world categorization, decision making, and reasoning.

No abstract