[论文解读] Multi-Level Anomaly Detection on Streaming Graph Data.

Robert A. Bridges, John P. Collins+3 more|arXiv (Cornell University)|Oct 16, 2014

Anomaly Detection Techniques and Applications参考文献 8被引用 1

一句话总结

本文提出了一种基于广义BTER模型的多层级异常检测框架，用于流式图数据，该模型能够捕捉分层社区结构。通过跨尺度的概率聚合，该方法在节点、子图和图层级均实现了高精度和高召回率的异常检测，支持直观的可视化与根本原因分析。

ABSTRACT

As a natural structure for representing entities and in-teractions, graphs are commonly used in many domains. Because of inherent complexity, converting graph data to meaningful information through analysis or visual-ization is often challenging. Identifying patterns and aberrations in graph data can pinpoint areas of inter-est, provide context for deeper understanding, and en-able discovery in many applications. This work presents a novel modeling and analysis framework for graph sequences. The framework ad-dresses the issues of modeling, detecting anomalies at multiple scales, and enabling understanding of graph data. A new graph model, generalizing the BTER model of Seshadhri et al. by adding flexibility to com-munity structure, is introduced and used to perform multi-scale graph anomaly detection. Specifically, prob-ability models describing coarse subgraphs are built by aggregating probabilities at finer levels, and these closely related hierarchical models simultaneously de-tect deviations from expectation. This technique pro-vides insight into the graph’s structure and internal con-text that may shed light on a detected event. Addition-ally, this multi-scale analysis facilitates intuitive visu-alizations by allowing users to narrow focus from an anomalous graph to particular subgraphs causing the anomaly. For evaluation, two hierarchical anomaly de-tectors are tested against a baseline on a series of sam-pled graphs. The superior hierarchical detector outper-forms the baseline, and changes in community struc-ture are accurately detected at the node, subgraph, and graph levels. To illustrate the accessibility of informa-tion made possible via this technique, a prototype vi-sualization tool, informed by the multi-scale analysis is tested on NCAA football data. Teams and confer-ences exhibiting changes in membership are identified with greater than 92 % precision and recall. Screenshots of an interactive visualization, allowing users to probe into selected communities, are given.

研究动机与目标

• 解决由于固有的结构复杂性与动态变化带来的流式图数据异常检测挑战。
• 实现多尺度异常检测，同时识别节点、子图和图层级的偏离行为。
• 通过分层建模，提供对检测到的异常结构上下文的可解释性洞察。
• 通过支持用户从异常图下钻至导致异常的具体子图，实现直观的可视化。
• 在真实数据上展示该框架的有效性，实现高检测精度与结构可解释性。

提出的方法

• 提出一种广义BTER模型，通过灵活的社区结构建模扩展原始模型。
• 通过将细粒度子图的概率聚合至粗粒度子图，构建分层概率模型。
• 利用这些分层模型检测跨多个尺度的结构模式偏离。
• 应用概率聚合，将局部异常与全局图层级的偏离关联，实现上下文感知的异常检测。
• 开发一个原型交互式可视化工具，支持对检测到的社区与子图进行深入探查。
• 在采样图序列与真实NCAA橄榄球数据上测试该框架，以评估检测性能。

实验结果

研究问题

• RQ1 如何同时在节点、子图和图层级等多个结构尺度上检测图异常？
• RQ2 与基线方法相比，分层概率建模是否能提升异常检测的准确性？
• RQ3 该框架在多大程度上能够识别社区结构的变化，例如球队或联盟成员的变动？
• RQ4 可视化工具在帮助用户探索与解释检测到的异常的根本原因方面有多有效？
• RQ5 该方法能否在流式图数据中以高精确率与高召回率检测结构变化？

主要发现

• 分层异常检测器在所有尺度上的异常检测性能显著优于基线方法。
• 在NCAA橄榄球中检测到的社区结构变化（如球队成员变动）精确率与召回率均超过92%。
• 多尺度框架通过将局部偏离与全局图层级异常关联，成功识别出异常子图。
• 可视化工具使用户能够深入探查特定社区，提升了对检测事件的可解释性与上下文理解。
• 在分层级别间进行概率聚合，为检测到的异常的内部结构与上下文提供了有意义的洞察。