[Paper Review] Multiple Network Embedding for Anomaly Detection in Time Series of Graphs

Guodong Chen, Jesús Arroyo+8 more|arXiv (Cornell University)|Aug 23, 2020

Complex Network Analysis Techniques47 references4 citations

TL;DR

This paper proposes a multiple adjacency spectral embedding (MASE)-based method for detecting anomalies in time series of graphs, leveraging joint graph embedding to improve detection of both anomalous graphs and temporally aberrant vertices. The approach achieves statistically principled false positive rate control and identifies anomalies beyond simple degree changes, as validated on Enron and search engine data with strong performance in simulations and real-world applications.

ABSTRACT

This paper considers the graph signal processing problem of anomaly detection in time series of graphs. We examine two related, complementary inference tasks: the detection of anomalous graphs within a time series, and the detection of temporally anomalous vertices. We approach these tasks via the adaptation of statistically principled methods for joint graph inference, specifically \emph{multiple adjacency spectral embedding} (MASE). We demonstrate that our method is effective for our inference tasks. Moreover, we assess the performance of our method in terms of the underlying nature of detectable anomalies. We further provide the theoretical justification for our method and insight into its use. Applied to the Enron communication graph, a large-scale commercial search engine time series of graphs, and a larval Drosophila connectome data, our approaches demonstrate their applicability and identify the anomalous vertices beyond just large degree change.

Motivation & Objective

• To address the challenge of detecting anomalous graphs and vertices in time series of dynamic networks.
• To improve detection power by jointly embedding multiple graphs using MASE, leveraging shared latent structures.
• To provide a statistically principled method with explicit false discovery rate (FDR) control for anomaly detection.
• To assess the method’s performance across different anomaly types, including those not detectable via degree changes alone.
• To demonstrate applicability on real-world datasets such as the Enron communication graph and a large-scale search engine query graph.

Proposed method

• The method employs multiple adjacency spectral embedding (MASE) to jointly embed multiple graphs in a time series into a shared low-dimensional latent space.
• Graph-level anomaly detection uses control charts or adjusted p-values based on test statistics derived from MASE embeddings to detect deviations from baseline behavior.
• Vertex-level anomaly detection applies similar test statistics to individual vertex latent positions, identifying temporally anomalous nodes.
• False discovery rate (FDR) control is achieved via the Benjamini-Hochberg procedure on p-values derived from MASE-based test statistics.
• The approach uses a moving window for control charts and accounts for temporal dependence through latent process modeling.
• Artificial anomalies are injected via a planted clique method in synthetic experiments to evaluate robustness and detection sensitivity.

Experimental results

Research questions

• RQ1 Can MASE-based joint embedding improve the detection of anomalous graphs in time series of networks compared to single-graph methods?
• RQ2 To what extent can the method detect vertex-level anomalies that are not characterized by extreme degree changes?
• RQ3 How does the method perform under different types of injected anomalies, including those with subtle structural shifts?
• RQ4 Does the control chart approach implicitly control the false discovery rate, and how does it compare to p-value adjustment methods?
• RQ5 What is the theoretical justification for the method’s effectiveness in detecting anomalies under a latent space model?

Key findings

• The MASE-based method successfully detected the artificial planted clique anomaly of size 493 in October in the MSB time series, with all methods except SCAN identifying it.
• Beyond artificial anomalies, the method detected a significant anomaly in April 2019 in the MSB dataset, which was also flagged by multiple methods, suggesting it may be a true anomaly despite lack of ground truth.
• The method detected all 473 artificially anomalous vertices in October, demonstrating high sensitivity in vertex-level anomaly detection.
• Latent position analysis revealed substantial shifts in vertex positions (e.g., vertex v₁₀₀₂) in March and April 2019, indicating structural changes not captured by degree-based metrics.
• Control charts identified fewer graph anomalies than adjusted p-values, suggesting potential implicit FDR control in the control chart approach.
• Theoretical justification is provided for graph-level anomaly detection under a latent process model, though vertex-level detection remains empirically supported without full theoretical characterization.