An anomaly detection framework for time-evolving attributed networks

Real-world information systems are naturally dynamic, and they are usually represented as a time-evolving attributed network (i.e., a sequence of static attributed networks). Recently, there is a surge of research interests in finding anomalous nodes upon attributed networks due to its significant implications in many high-impact applications, such as financial fraud detection, network intrusion detection, and opinion spam detection, to name a few. Despite the importance of anomaly detection in time-evolving attributed network, a vast majority of existing methods fail to capture the evolution of the underlying networks properly, as they regard the whole system as static and neglect the evolution process. Meanwhile, they treat all the attributes and the instances equally, ignoring the existence of noisy which may lead to the adverse effects to the detection results. To tackle these problems, in this paper, we propose a novel dynamic anomaly detection framework on time-evolving attributed networks on the basis of residual analysis, namely AMAD. Under the assumption of temporal smoothness property, AMAD leverages the small smooth disturbance between two consecutive time stamps to characterize the evolution of networks for incrementally update. Experiments conducted on both synthetic and real-world time-evolving attributed networks show the superiority of our proposed method in detecting anomalies. Moreover, our method is competitive in terms of efficiency compared to the existing work.