[Paper Review] Near-optimal Anomaly Detection in Graphs using Lovasz Extended Scan Statistic

James Sharpnack, Akshay Krishnamurthy+1 more|arXiv (Cornell University)|Dec 11, 2013

Anomaly Detection Techniques and Applications29 references47 citations

TL;DR

This paper proposes the Lovász Extended Scan Statistic (LESS), a computationally efficient approximation to the intractable generalized likelihood ratio test for detecting anomalous, well-connected clusters in graphs under Gaussian noise. By leveraging submodularity and connections to Markov random fields and electrical network theory, LESS achieves near-optimal detection performance—matching known lower bounds—while enabling polynomial-time computation via successive minimum s-t cut optimizations.

ABSTRACT

The detection of anomalous activity in graphs is a statistical problem that arises in many applications, such as network surveillance, disease outbreak detection, and activity monitoring in social networks. Beyond its wide applicability, graph structured anomaly detection serves as a case study in the difficulty of balancing computational complexity with statistical power. In this work, we develop from first principles the generalized likelihood ratio test for determining if there is a well connected region of activation over the vertices in the graph in Gaussian noise. Because this test is computationally infeasible, we provide a relaxation, called the Lovasz extended scan statistic (LESS) that uses submodularity to approximate the intractable generalized likelihood ratio. We demonstrate a connection between LESS and maximum a-posteriori inference in Markov random fields, which provides us with a poly-time algorithm for LESS. Using electrical network theory, we are able to control type 1 error for LESS and prove conditions under which LESS is risk consistent. Finally, we consider specific graph models, the torus, k-nearest neighbor graphs, and epsilon-random graphs. We show that on these graphs our results provide near-optimal performance by matching our results to known lower bounds.

Motivation & Objective

• . The paper aims to address the challenge of detecting anomalous, well-connected clusters in graphs under Gaussian noise.
• It seeks to balance statistical power with computational feasibility in graph-structured anomaly detection.
• The objective is to develop a test that is both statistically powerful and computationally tractable for large graphs.
• The authors aim to provide theoretical guarantees on type I error control and risk consistency for their method.
• They further aim to demonstrate near-optimality of their method by matching performance to known lower bounds on specific graph models.

Proposed method

• . The paper derives the generalized likelihood ratio test (GSS) as the optimal but computationally infeasible solution for detecting anomalous clusters.
• It introduces the Lovász Extended Scan Statistic (LESS) as a relaxation of GSS using submodularity to ensure tractability.
• LESS is computed via successive minimum s-t cut problems, enabling polynomial-time computation.
• The method connects LESS to maximum a-posteriori (MAP) inference in Markov random fields (MRFs), providing a probabilistic interpretation.
• Type I error control is achieved using electrical network theory, relating the test threshold to effective resistances of graph cuts.
• Theoretical analysis links detection performance to effective resistances, enabling risk consistency and near-optimality guarantees.

Experimental results

Research questions

• RQ1 . Can a computationally efficient test be developed for detecting well-connected anomalous clusters in graphs under Gaussian noise?
• RQ2 . Does the proposed LESS method achieve near-optimal detection performance compared to known statistical lower bounds?
• RQ3 . Can type I error be controlled in LESS using graph-theoretic concepts such as effective resistance?
• RQ4 . Is the LESS method provably risk consistent under appropriate signal-to-noise ratio (SNR) conditions?
• RQ5 . Can the LESS method be efficiently computed using graph cut algorithms, and how does it relate to MRF inference?

Key findings

• . The Lovász Extended Scan Statistic (LESS) achieves near-optimal detection performance on various graph models, matching known lower bounds up to logarithmic factors.
• . For edge-transitive graphs such as the l-dimensional torus, LESS distinguishes H0 from H1 when µ = ω(max{√(ρ/d log p), log p}).
• . On k-nearest neighbor graphs with k/p → 0 and k(k/p)²/D → ∞, LESS detects anomalies when µ = ω(max{√(ρ/k log p), log p}).
• . For ǫ-graphs with ǫ → 0 and nǫD+2 → ∞, LESS detects anomalies when µ = ω(max{√(ρ/(pǫD log p)), log p}).
• . The type I error of LESS is controlled at level α using a threshold derived from effective resistances, with minimal loss in performance compared to the intractable GSS.
• . Experimental results show LESS outperforms spectral scan statistics and UST wavelet detectors in ROC performance across torus, k-NN, and ǫ-graph models.