Multi-scale Anomaly Detection on Attributed Networks

TL;DR

This paper introduces a multi-scale anomaly detection method for attributed networks, leveraging graph signal processing and Markov stability to identify outliers and their contexts effectively across different network scales.

Contribution

It presents a novel framework combining graph signal processing and Markov stability for multi-scale anomaly detection in attributed networks, addressing heterogeneity and scalability.

Findings

Outperforms existing anomaly detection algorithms on synthetic and real-world networks.

Effectively identifies anomalies and their contexts at multiple network scales.

Demonstrates scalability to large networks using Chebyshev polynomial approximations.

Abstract

Many social and economic systems can be represented as attributed networks encoding the relations between entities who are themselves described by different node attributes. Finding anomalies in these systems is crucial for detecting abuses such as credit card frauds, web spams or network intrusions. Intuitively, anomalous nodes are defined as nodes whose attributes differ starkly from the attributes of a certain set of nodes of reference, called the context of the anomaly. While some methods have proposed to spot anomalies locally, globally or within a community context, the problem remain challenging due to the multi-scale composition of real networks and the heterogeneity of node metadata. Here, we propose a principled way to uncover outlier nodes simultaneously with the context with respect to which they are anomalous, at all relevant scales of the network. We characterize anomalous nodes in terms of the concentration retained for each node after smoothing specific signals localized on the vertices of the graph. Besides, we introduce a graph signal processing formulation of the Markov stability framework used in community detection, in order to find the context of anomalies. The performance of our method is assessed on synthetic and real-world attributed networks and shows superior results concerning state of the art algorithms. Finally, we show the scalability of our approach in large networks employing Chebychev polynomial approximations.