Location of Repository

Anomaly detection in large graphs

By Leman Akoglu, Mary Mcglohon and Christos Faloutsos

Abstract

Discovering anomalies is an important and challenging task for many settings, from network intrusion to fraud detection. However, most work to date has focused on clouds of multi-dimensional points, with little emphasis on graph data; even then, the focus is on un-weighted, node-labeled graphs. Here we propose OddBall, an algorithm to detect anomalous nodes in weighted graphs. The contributions are the following: (a) we carefully choose features, that easily reveal nodes with strange behavior; (b) we discover several new rules (power laws) in density, weights, ranks and eigenvalues that seem to govern the so-called “neighborhood graphs ” and we show how to use them for anomaly detection; (c) we empirically show that our method scales linearly with the number of edges in the graph, and (d) we report experiments on many real graphs with up to 1.5 Given a real graph, with weighted edges, which nodes should we consider as “strange”? Applications of this setting abound: For example, in network intrusion detection, we have computers sending packets to each other, and we want to know which nodes misbehave (e.g., spammers, portscanners). In a who-calls-whom network [30], strange behavior may indicate defecting customers

Year: 2009
OAI identifier: oai:CiteSeerX.psu:10.1.1.188.2619
Provided by: CiteSeerX
Download PDF:
Sorry, we are unable to provide the full text but you may find it at the following location(s):
  • http://citeseerx.ist.psu.edu/v... (external link)
  • http://www.cs.cmu.edu/%7Elakog... (external link)
  • Suggested articles


    To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.