[Paper Review] Anomaly detection in the dynamics of web and social networks

Volodymyr Miz, Benjamin Ricaud+2 more|arXiv (Cornell University)|Jan 22, 2019

Complex Network Analysis Techniques4 citations

TL;DR

This paper proposes an unsupervised, scalable method for detecting localized anomalies in dynamic web and social networks by modeling temporal activity patterns using a Hopfield network to combine graph structure and time-series data. The approach successfully identifies real-world events—such as the Charlie Hebdo attack or corporate incidents—in Wikipedia and Enron email datasets with high precision, demonstrating robustness and interpretability through memory-like recall of partial signals.

ABSTRACT

In this work, we propose a new, fast and scalable method for anomaly detection in large time-evolving graphs. It may be a static graph with dynamic node attributes (e.g. time-series), or a graph evolving in time, such as a temporal network. We define an anomaly as a localized increase in temporal activity in a cluster of nodes. The algorithm is unsupervised. It is able to detect and track anomalous activity in a dynamic network despite the noise from multiple interfering sources. We use the Hopfield network model of memory to combine the graph and time information. We show that anomalies can be spotted with a good precision using a memory network. The presented approach is scalable and we provide a distributed implementation of the algorithm. To demonstrate its efficiency, we apply it to two datasets: Enron Email dataset and Wikipedia page views. We show that the anomalous spikes are triggered by the real-world events that impact the network dynamics. Besides, the structure of the clusters and the analysis of the time evolution associated with the detected events reveals interesting facts on how humans interact, exchange and search for information, opening the door to new quantitative studies on collective and social behavior on large and dynamic datasets.

Motivation & Objective

• To address the challenge of detecting localized, collective anomalies in large-scale, time-evolving networks where node activity deviates from normal patterns.
• To bridge graph-based anomaly detection and spatio-temporal data mining by modeling both network topology and temporal dynamics simultaneously.
• To provide interpretable, rich spatio-temporal indicators of anomalies—beyond simple labels—enabling domain experts to investigate collective behavior.
• To enhance scalability by introducing the concept of 'potential anomalies' that pre-filter non-anomalous data using expert knowledge.
• To explore the analogy between anomaly detection and memory recall, enabling recovery of full anomalous events from incomplete or noisy inputs.

Proposed method

• The method models dynamic networks as attributed graphs where nodes have time-series attributes (e.g., page views or email counts), and the graph structure encodes relationships between entities.
• It employs a Hopfield network to encode temporal activity patterns as memory states, enabling the system to learn and recall anomalous collective behaviors.
• Anomalies are detected as localized increases in activity across connected node clusters, identified through iterative energy minimization in the Hopfield network.
• The algorithm uses a 'potential anomaly' concept to restrict computation to regions likely to contain anomalies, significantly improving scalability.
• A distributed implementation using Apache Spark GraphX enables processing of large-scale datasets such as Wikipedia and Enron email logs.
• The method supports recall from incomplete inputs by reconstructing full anomalous events from partial node activity, simulating memory recovery.

Experimental results

Research questions

• RQ1 How can we detect localized, collective anomalies in large, time-evolving networks where node activity changes in complex, non-simultaneous ways?
• RQ2 Can a Hopfield network model effectively learn and recall spatio-temporal anomaly patterns from dynamic network data?
• RQ3 To what extent can the method recover full anomalous events from incomplete or noisy inputs, simulating memory recall?
• RQ4 How do the detected anomalies relate to real-world events, and what insights do they reveal about collective human behavior?
• RQ5 Can the concept of 'potential anomalies' improve scalability without sacrificing detection accuracy in large-scale dynamic graphs?

Key findings

• The method successfully detected anomalous spikes in Wikipedia page views linked to real-world events such as the Charlie Hebdo attack, with clusters of related articles showing synchronized activity surges.
• In the Enron email dataset, the algorithm identified groups of employees with sudden increases in email exchange during major corporate events, confirming alignment with actual organizational dynamics.
• The Hopfield network model demonstrated strong recall ability, reconstructing full anomalous events from 20% of active nodes, with minimal reconstruction error during the event window.
• The model forgot activity outside the event bounds, confirming it captures only relevant, causally linked signals, reducing noise and improving interpretability.
• The approach showed high robustness to hyperparameter tuning, indicating practical usability in real-world deployment.
• The learned network structure functions as an artificial collective memory, storing and retrieving associations between topics and events, suggesting deep parallels with human memory systems.