Discovering anomalies is an important and challenging task for many settings, from network intrusion to fraud detection. However, most work to date has focused on clouds of multi-dimensional points, with little emphasis on graph data; even then, the focus is on un-weighted, node-labeled graphs. Here we propose OddBall, an algorithm to detect anomalous nodes in weighted graphs. The contributions are the following: (a) we carefully choose features, that easily reveal nodes with strange behavior; (b) we discover several new rules (power laws) in density, weights, ranks and eigenvalues that seem to govern the so-called “neighborhood graphs ” and we show how to use them for anomaly detection; (c) we empirically show that our method scales linearly with the number of edges in the graph, and (d) we report experiments on many real graphs with up to 1.5 Given a real graph, with weighted edges, which nodes should we consider as “strange”? Applications of this setting abound: For example, in network intrusion detection, we have computers sending packets to each other, and we want to know which nodes misbehave (e.g., spammers, portscanners). In a who-calls-whom network , strange behavior may indicate defecting customers
To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.