A Sketch Based Game Theoretic Approach to Detect Anomalous Dense Sub-Communities in Large Data Streams

TL;DR

This paper introduces a game-theoretic method for detecting dense, anomalous sub-communities in large streaming graphs, using constant memory and modularity to identify potential security threats in real-time.

Contribution

It presents a novel game-theoretic framework for online dense subcommunity detection that operates with constant memory, improving anomaly detection in streaming graphs.

Findings

Effective detection of dense subgraphs in real datasets.

Operates with constant memory, suitable for large streams.

Demonstrates practical applicability in industrial scenarios.

Abstract

Detecting anomalous subgraphs in a dynamic graph in an online or streaming fashion is an important requirement in industrial settings for intrusion detection or denial of service attacks. While only detecting anomalousness in the system by edge frequencies is an optimal approach, many latent information can get unnoticed in the process, since as a characteristic of the network only edge frequencies are considered. We propose a game theoretic approach whereby using the modularity function we try to estimate in a streaming graph \emph{whether addition of a new edge in the current time tick results in a dense subgraph creation, thus indicating possible anomalous score}. Our contributions are as follows: (a) We propose a novel game-theoretic framework for detecting dense subcommunities in an online streaming environment; (b) We detect such subcommunities using constant memory storage. Our results are corroborated with empirical evaluation on real datasets.