Scan Statistics for the Online Detection of Locally Anomalous Subgraphs

Abstract

Identifying anomalies in computer networks is a challenging and complex problem.Often, anomalies occur in extremely local areas of the network. Locality is complex in this setting, since we have an underlying graph structure. To identify local anomalies, we introduce a scan statistic for data extracted from the edges of a graph over time.[24] J.I. Naus. Approximations for distributions of scan statistics.

Understanding the heavy-tailed dynamics in human behavior

“…The red dots correspond to events produced during the active state, and it can clearly be seen that these do correspond to genuine bursts in the data. The HMM with Lognormal active state inter-event times appears to describe human behavior very well and would hence be appropriate in any of the myriad of circumstances where it is important to have an accurate model for behavior [10,14,28]. Previously we noted that the communication patterns of humans on Twitter are interesting because they are likely to emerge from two distinct types of behavior.…”

“…We use a large social media data set to test these hypotheses, and find that although models that incorporate circadian rhythms and burstiness do explain part of the observed heavy tails, there is residual unexplained heavy tail behavior which suggests a more fundamental cause. Based on this, we develop a new quantitative model of human behavior which improves on existing approaches, and gives insight into the mechanisms underlying human interactions.The prospect of finding quantitative models that can describe and predict human behavior has fascinated researchers for decades, partly because understanding such behavior is interesting in its own right, and partly because these models can have important practical uses in fields as diverse as network analysis [8,10,16,26], cyber security [14,28], and the analysis of terrorism [27]. The increased availability of databases containing large volumes of electronic communication data such as phone call records, emails, and social media interactions, has now made it possible to study human behavior on a larger scale than ever before.…”

“…The prospect of finding quantitative models that can describe and predict human behavior has fascinated researchers for decades, partly because understanding such behavior is interesting in its own right, and partly because these models can have important practical uses in fields as diverse as network analysis [8,10,16,26], cyber security [14,28], and the analysis of terrorism [27]. The increased availability of databases containing large volumes of electronic communication data such as phone call records, emails, and social media interactions, has now made it possible to study human behavior on a larger scale than ever before.…”

NetSpot: Spotting Significant Anomalous Regions on Dynamic Networks

“…Although time is explicitly considered, slices of the network are evaluated independently. Neil et al [20] restrict their patterns to paths and stars. In contrast to the methods above, our focus is to find arbitrary-shape anomalies that can possibly span multiple time slices.…”

“…They aim to spot and summarize anomalies in spatio-temporal domains. Extensions to dynamic networks [25,20] are limited to detecting regions of predefined shapes such as disks and paths. Priebe et al [25] compute anomalous regions by aggregating edge values in Enron, while restricting the region shapes to "disks" (neighborhood of order k).…”