Midas: Microcluster-Based Detector of Anomalies in Edge Streams

Abstract

Given a stream of graph edges from a dynamic graph, how can we assign anomaly scores to edges in an online manner, for the purpose of detecting unusual behavior, using constant time and memory? Existing approaches aim to detect individually surprising edges. In this work, we propose Midas, which focuses on detecting microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, such as lockstep behavior, including denial of service attacks in network traffic data. Midas has the following properties: (a) it detects microcluster anomalies while providing theoretical guarantees about its false positive probability; (b) it is online, thus processing each edge in constant time and constant memory, and also processes the data 108–505 times faster than state-of-the-art approaches; (c) it provides 46%-52% higher accuracy (in terms of AUC) than state-of-the-art approaches.

Analysis Techniques for Illicit Bitcoin Transactions

“…This automated simultaneous analysis lends itself well to the Bitcoin-blockchain environment as the graphs formed here are constantly being updated with new addresses and transactions. This capability is particularly useful for ransomware attacks whose first indications are often sudden bursts of activity on the blockchain (Bhatia et al, 2019).…”

JUDO: Just-in-time rumour detection in streaming social platforms

“…Design Principles. Anomaly scoring in streaming social media needs to overcome the trade-off between the explore and exploit effects [30]. While traditional anomaly scoring relies on the whole or a sample of data to compute statistical signals, doing so in streaming social media induces an overhead of recomputation, which delays the detection of rumours for damage mitigation.…”

“…We further validate the influence of our LSH-based indexing component by replacing it with the feasible alternatives. More precisely, two representative baselines are adopted: p-value (i.e., an anomaly detector that exploits entitylevel statistical significance [9]) and Midas (i.e., anomaly detector Midas [30]).…”

Follow the money: Revealing risky nodes in a Ransomware-Bitcoin network

“…This lends itself well to the Bitcoin -blockchain environment as the graphs formed here are constantly being updated with new addresses and transactions. In addition, when it comes to discovering ransomware graphs in such an environment micro cluster detection helps detect sudden bursts of activity on nodes or edges, which are common to the behaviours of both the cash in and cash out graphs in ransomware / Bitcoin activity [29].…”