Mutually exciting point process graphs for modelling dynamic networks

TL;DR

This paper introduces mutually exciting point process graphs (MEG), a scalable model for dynamic networks that captures event dependencies and infers unobserved connections, useful for anomaly detection in applications like cyber-security.

Contribution

The paper proposes MEG, a novel scalable model combining mutually exciting processes with latent space models for dynamic networks, enabling inference on unobserved edges and efficient estimation.

Findings

MEG accurately models dynamic network events.

The model effectively detects anomalies and unobserved connections.

Algorithms show excellent performance on real datasets.

Abstract

A new class of models for dynamic networks is proposed, called mutually exciting point process graphs (MEG). MEG is a scalable network-wide statistical model for point processes with dyadic marks, which can be used for anomaly detection when assessing the significance of future events, including previously unobserved connections between nodes. The model combines mutually exciting point processes to estimate dependencies between events and latent space models to infer relationships between the nodes. The intensity functions for each network edge are characterised exclusively by node-specific parameters, which allows information to be shared across the network. This construction enables estimation of intensities even for unobserved edges, which is particularly important in real world applications, such as computer networks arising in cyber-security. A recursive form of the log-likelihood function for MEG is obtained, which is used to derive fast inferential procedures via modern gradient ascent algorithms. An alternative EM algorithm is also derived. The model and algorithms are tested on simulated graphs and real world datasets, demonstrating excellent performance.