Scalable Anomaly Ranking of Attributed Neighborhoods

Abstract

Given a graph with node attributes, what neighborhoods 1 are anomalous? To answer this question, one needs a quality score that utilizes both structure and attributes. Popular existing measures either quantify the structure only and ignore the attributes (e.g., conductance), or only consider the connectedness of the nodes inside the neighborhood and ignore the cross-edges at the boundary (e.g., density).In this work we propose normality, a new quality measure for attributed neighborhoods. Normality utilizes structure and attributes together to quantify both internal consistency and external separability. It exhibits two key advantages over other measures: (1) It allows many boundaryedges as long as they can be "exonerated"; i.e., either (i) are expected under a null model, and/or (ii) the boundary nodes do not exhibit the subset of attributes shared by the neighborhood members. Existing measures, in contrast, penalize boundary edges irrespectively. (2) Normality can be efficiently maximized to automatically infer the shared attribute subspace (and respective weights) that characterize a neighborhood. This efficient optimization allows us to process graphs with millions of attributes.We capitalize on our measure to present a novel approach for Anomaly Mining of Entity Neighborhoods (AMEN). Experiments on real-world attributed graphs illustrate the effectiveness of our measure at anomaly detection, outperforming popular approaches including conductance, density, OddBall, and SODA. In addition to anomaly detection, our qualitative analysis demonstrates the utility of normality as a powerful tool to contrast the correlation between structure and attributes across different graphs.

HitFraud: A Broad Learning Approach for Collective Fraud Detection in Heterogeneous Information Networks

“…Input Output HITFRAUD a heterogeneous graph (EA payment transaction graph) nodes (transactions) ABCOutliers [8] a heterogeneous graph (Wikipedia entity graph) subgraphs (entity groups) StreamSpot [19] multiple heterogeneous graphs (information flow graphs) graphs (system logs) CloseMine [17] multiple heterogeneous graphs (software behavior graphs) graphs (program runs) FRAUDAR [11] a bipartite graph (social graph) nodes (users) fBox [27] a bipartite graph (social, rating graph) nodes (users) CopyCatch [1] a bipartite graph (Page Likes graph) nodes (users) FocusCO [25] a homogeneous graph (DBLP, co-purchase, citation graph) nodes (authors/movies/bloggers) CatchSync [13] a homogeneous graph (social graph) nodes (users) SybilRank [4] a homogeneous graph (social graph) nodes (users) Collusionrank [7] a homogeneous graph (social graph) nodes (users) CODA [6] a homogeneous graph (DBLP graph) nodes (conferences/authors) TrustRank [10] a homogeneous graph (web graph) nodes (pages) AMEN [24] a homogeneous graph (DBLP, social graph) subgraphs (author/user groups) SODA [9] a homogeneous graph (DBLP, yeast graph) subgraphs (author/protein groups)…”

Incorporating User's Preference into Attributed Graph Clustering

“…The homogeneity of attributes is measured by the proposed unimodality compactness which also exploits Hartigans' dip-test. • AMEN [32,33] develops a measure called Normality to quantify both internal consistency and external separability Algorithm 1: LOCLU Input: Adjacency matrix A, data matrix X ∈ R n×d , the seed vertex index q, the indexes of the designated attributes I = {a 1 , a 2 , · · · , a u } Output: Local cluster C 1ε ← 0.001, t ← 0, iter← 1000; 2 C ← [1 : n]; /* C contains the indexes of vertices. */ 3 compute the random walk transition matrix W; 4 v 0 ← randn (n, 1); /* power iteration */ 5 repeat x ← X(C, s);…”

Anomalydae: Dual Autoencoder for Anomaly Detection on Attributed Networks

“…We compare AnomalyDAE with the state-of-the-art methods including LOF [18], SCAN [19], AMEN [8], Radar [12], Anomalous [13], and Dominant [14]. The AUC scores (the Area Under a receiver operating characteristic Curve) for anomaly detection are reported in Table 3.…”