Search

Anomaly detection is distinguishing unusual objects from normal patterns. It is a complex task due to unpredictable nature of anomalies, which can appear in many forms or they can be hidden by mimicking normal behaviors in a graph structure. Such diversity makes this Deep learning approaches can solve these problems by extracting complex patterns from networks. However, addressing different forms of anomalous instances is essential for successfully implementing these approaches, as different anomaly types require further analysis. Additionally, it is challenging to interpret anomalies beforehand without focusing on every aspect of anomalies. Our objective is to propose an architecture capable of handling all types of anomalous entities by tackling challenges across various domains. In this paper, we introduce ARNAD, a novel framework that integrates three deep models to identify anomalies in graphs: graph neural network, autoencoder, and adversarial autoencoder. ARNAD approaches graph anomaly detection by utilizing the features of the deep parts, and four key elements stand out: (1) the autoencoder learns the overall graph structure and identifies highly deviated ones, (2) the graph neural network exploits graph structure to detect anomalies among the communities, (3) a fixed-size randomized neighborhood that prevents overfitting while reducing complexity (4) the adversarial autoencoder improves the robustness of the framework and discriminates anomalies. To detect anomalies, four receptive components assign risk scores to objects in the attributed network. We evaluated the framework with three synthetic datasets that simulate different behaviors of anomalies and six widely used real attributed networks. Our experimental results show that ARNAD performs competitively with other state-of-the-art models in detecting anomalous entities while minimizing false positives, demonstrating ARNAD's effectiveness in detecting graph anomalies. [ABSTRACT FROM AUTHOR]

In this paper the stochastic differential equation (SDE) is utilized as a quantitative description of a natural phenomenon to distinguish normal and anomalous samples. In this framework, discrete samples are modeled as a continuous time-dependent diffusion process with time varying drift and diffusion coefficients. We employ a local non-parametric technique using kernel regression and polynomial fitting to learn coefficients of stochastic models. Next, a numerical discrete construction of likelihood over a sliding window is established using Girsanov's theorem to calculate an anomalous score for test observations. One of the benefits of the method is to estimate the ratio of probability density functions (PDFs) through the Girsanov's theorem instead of evaluating PDFs themselves. Another feature of employing SDE model is its generality, in the sense that it includes most of the well-known stochastic models. Performance of the new approach in comparison to other methods is demonstrated through simulated and real data. For real-world cases, we test our method on detecting anomalies in twitter user engagement data and discriminating speech samples from non-speech ones. In both simulated and real data, proposed algorithm outperforms other methods. [ABSTRACT FROM AUTHOR]

In this paper, we study anomaly detection in a distributed network of nodes and introduce a novel algorithm based on Support Vector Machines (SVMs). We first reformulate the conventional SVM optimization problem for a distributed network of nodes. We then directly train the parameters of this SVM architecture in its primal form using a gradient based algorithm in a fully distributed manner, i.e., each node in our network is allowed to communicate only with its neighboring nodes in order to train the parameters. Therefore, we not only obtain a high performing anomaly detection algorithm thanks to strong modeling capabilities of SVMs, but also achieve significantly reduced communication load and computational complexity due to our fully distributed and efficient gradient based training. Here, we provide a training algorithm in a supervised framework, however, we also provide the extensions of our implementation to an unsupervised framework. We illustrate the performance gains achieved by our algorithm via several benchmark real life and synthetic experiments. [ABSTRACT FROM AUTHOR]