Laplacian Change Point Detection for Dynamic Graphs

Abstract

Dynamic and temporal graphs are rich data structures that are used to model complex relationships between entities over time. In particular, anomaly detection in temporal graphs is crucial for many real world applications such as intrusion identification in network systems, detection of ecosystem disturbances and detection of epidemic outbreaks. In this paper, we focus on change point detection in dynamic graphs and address two main challenges associated with this problem: I) how to compare graph snapshots across time, II) how to capture temporal dependencies. To solve the above challenges, we propose Laplacian Anomaly Detection (LAD) which uses the spectrum of the Laplacian matrix of the graph structure at each snapshot to obtain low dimensional embeddings. LAD explicitly models short term and long term dependencies by applying two sliding windows. In synthetic experiments, LAD outperforms the state-of-the-art method. We also evaluate our method on three real dynamic networks: UCI message network, US senate co-sponsorship network and Canadian bill voting network. In all three datasets, we demonstrate that our method can more effectively identify anomalous time points according to significant real world events. CCS CONCEPTS • Computing methodologies → Anomaly detection; Temporal reasoning; Spectral methods; • Mathematics of computing → Spectra of graphs; • Theory of computation → Dynamic graph algorithms.

Graph similarity learning for change-point detection in dynamic networks

“…Several model-agnostic methods for NCPD extract features from the graph snapshots, e.g., the degree distribution [30] or the joint distribution of a set of edges [31], and use classical discrepancy measures to quantify the amount of change. Other methods relying on pairwise comparison of graphs use a graph similarity or pseudo-distance, such as the DeltaCon metric [32], the Hamming distance and the Jaccard distances [33], the Frobenius and maximum norms [7], spectral distances based on the Laplacian [25,3,34], 2 or ∞ norms [18] or a graph kernel [35,23,36]. Nevertheless, these graph metrics suffer from intrinsic limitations; e.g., the Hamming distance is sensitive to the graph density and the Jaccard distance treats all edges uniformly [33].…”

“…In this method, the number of clusters and the lengths of the windows are pre-specified. • Laplacian anomaly detection (LAD) [25]. This method applies both to the anomaly detection and changepoint detection tasks for dynamic networks, and is based on the anomaly score…”

“…Note that Scenario 1 can be considered as a global change of the network structure, while the other scenarios correspond to a local topological change (i.e., localised on a subset of nodes). For each scenario and each difficulty level, we generate 50 sequences with one change-point uniformly sampled in the interval [25,75]. Moreover, for the pair classification task (see Section 4.1), in each scenario, we also independently generate 1000 labelled pairs of graphs…”

“…Consequently, without any domain knowledge, this choice is often arbitrary, and result in poor performances [22,15,24]. Moreover, most online NCPD methods require finely tuning several hyperparameters, such as detection thresholds [13] and window sizes [25]. To address these challenges, we propose a change-point agnostic and end-to-end method for online NCPD that in particular includes learning a data-driven graph similarity function.…”

Towards Better Evaluation for Dynamic Link Prediction

“…Parl. (new) [11]: is a dynamic political network documenting the interactions between Canadian Members of Parliaments (MPs) from 2006 to 2019. Each node is one MP representing an electoral district and each edge is formed when two MPs both voted "yes" on a bill.…”