Anomaly detection in the dynamics of web and social networks
This work addresses the problem of detecting localized anomalous activity in dynamic networks for applications in web and social network analysis, though it is incremental as it builds on existing memory network approaches.
The authors tackled anomaly detection in large time-evolving graphs by proposing a fast, scalable unsupervised method that combines graph and time information using a Hopfield network model, achieving good precision in spotting anomalies triggered by real-world events on datasets like Enron Email and Wikipedia page views.
In this work, we propose a new, fast and scalable method for anomaly detection in large time-evolving graphs. It may be a static graph with dynamic node attributes (e.g. time-series), or a graph evolving in time, such as a temporal network. We define an anomaly as a localized increase in temporal activity in a cluster of nodes. The algorithm is unsupervised. It is able to detect and track anomalous activity in a dynamic network despite the noise from multiple interfering sources. We use the Hopfield network model of memory to combine the graph and time information. We show that anomalies can be spotted with a good precision using a memory network. The presented approach is scalable and we provide a distributed implementation of the algorithm. To demonstrate its efficiency, we apply it to two datasets: Enron Email dataset and Wikipedia page views. We show that the anomalous spikes are triggered by the real-world events that impact the network dynamics. Besides, the structure of the clusters and the analysis of the time evolution associated with the detected events reveals interesting facts on how humans interact, exchange and search for information, opening the door to new quantitative studies on collective and social behavior on large and dynamic datasets.