Extreme Value Modelling of Feature Residuals for Anomaly Detection in Dynamic Graphs

TL;DR

This paper introduces a novel anomaly detection method for dynamic graphs that combines time series analysis of graph features, residual modeling, and Extreme Value Theory to improve accuracy and reduce false positives.

Contribution

It presents a new approach that explicitly models temporal dependencies and applies Extreme Value Theory to effectively detect anomalies in dynamic graphs.

Findings

Achieves higher accuracy than TensorSplat and Laplacian Anomaly Detection

Reduces false positive rates in anomaly detection

Handles variable-sized graphs and complex temporal dynamics

Abstract

Detecting anomalies in a temporal sequence of graphs can be applied is areas such as the detection of accidents in transport networks and cyber attacks in computer networks. Existing methods for detecting abnormal graphs can suffer from multiple limitations, such as high false positive rates as well as difficulties with handling variable-sized graphs and non-trivial temporal dynamics. To address this, we propose a technique where temporal dependencies are explicitly modelled via time series analysis of a large set of pertinent graph features, followed by using residuals to remove the dependencies. Extreme Value Theory is then used to robustly model and classify any remaining extremes, aiming to produce low false positives rates. Comparative evaluations on a multitude of graph instances show that the proposed approach obtains considerably better accuracy than TensorSplat and Laplacian Anomaly Detection.