A Probabilistic Framework to Node-level Anomaly Detection in Communication Networks

TL;DR

This paper introduces a probabilistic framework for detecting node-level anomalies in communication networks by modeling communication events as clique streams and using non-parametric regression to identify abnormal activity.

Contribution

It presents a novel probabilistic approach combining non-parametric regression and concentration inequalities for interpretable anomaly detection at node level.

Findings

Effective detection of anomalies demonstrated on real sensor network data

Method outperforms existing approaches in accuracy and interpretability

Applicable to synthetic and real-world communication datasets

Abstract

In this paper we consider the task of detecting abnormal communication volume occurring at node-level in communication networks. The signal of the communication activity is modeled by means of a clique stream: each occurring communication event is instantaneous and activates an undirected subgraph spanning over a set of equally participating nodes. We present a probabilistic framework to model and assess the communication volume observed at any single node. Specifically, we employ non-parametric regression to learn the probability that a node takes part in a certain event knowing the set of other nodes that are involved. On the top of that, we present a concentration inequality around the estimated volume of events in which a node could participate, which in turn allows us to build an efficient and interpretable anomaly scoring function. Finally, the superior performance of the proposed approach is empirically demonstrated in real-world sensor network data, as well as using synthetic communication activity that is in accordance with that latter setting.