Change detection in evolving computer networks: Changes in densification and diameter over time

Abstract

Large-scale attacks on computer networks usually cause abrupt changes in network traffic, which makes change detection an integral part of attack detection especially in large communication networks. Such changes in traffic can be defined in terms of sudden absence of key nodes or edges, or the addition of new nodes and edges to the network. These are micro level changes. This on the other hand may lead to changes at the macro level of the network such as changes in the density and diameter of the network that describe connectivity between nodes as well as flow of information within the network. Our assumption is that, changes in the behavior of such key nodes in a network translates into changes in the overall structure of the network since these key nodes represent the major chunk of communication in the network. In this study, we focus on detecting changes at the network-level where we sample the network and select key subgraphs associated to central nodes. Our objective is to study selected network-level properties because they provide a bigger picture of underlying events in the network.