Change Detection in a Dynamic Stream of Attributed Networks

TL;DR

This paper introduces a novel method for detecting changes in dynamic attributed networks using a combination of generalized linear models, Kalman filtering, and EWMA control charts, demonstrated through simulations and real-world data.

Contribution

It develops a new approach integrating GLM, EKF, and EWMA for real-time change detection in dynamic attributed networks, addressing a gap in existing static network anomaly detection.

Findings

Effective in detecting temporal changes in simulated attributed networks

Successfully applied to Enron email data for real-world change detection

Provides a framework for online monitoring of complex network systems

Abstract

While anomaly detection in static networks has been extensively studied, only recently, researchers have focused on dynamic networks. This trend is mainly due to the capacity of dynamic networks in representing complex physical, biological, cyber, and social systems. This paper proposes a new methodology for modeling and monitoring of dynamic attributed networks for quick detection of temporal changes in network structures. In this methodology, the generalized linear model (GLM) is used to model static attributed networks. This model is then combined with a state transition equation to capture the dynamic behavior of the system. Extended Kalman filter (EKF) is used as an online, recursive inference procedure to predict and update network parameters over time. In order to detect changes in the underlying mechanism of edge formation, prediction residuals are monitored through an Exponentially Weighted Moving Average (EWMA) control chart. The proposed modeling and monitoring procedure is examined through simulations for attributed binary and weighted networks. The email communication data from the Enron corporation is used as a case study to show how the method can be applied in real-world problems.