Anomaly detection for live streaming graphs using copula based student-t process regression

Abstract

In a time dependent streaming graph, detecting unusual activities such as intrusions by unregistered users (anomalous nodes) or unauthorized high value transactions (anomalous edges) presents a significant challenge. To address this, a time-evolving Laplacian graph energy was introduced to help identify specific anomalous nodes and edges. The weights of the streaming nodes and edges are captured using student-t process regression over time, enabling prediction of the expected graph energy. Significant deviations in graph energy from expected values, based on new observations, indicate potential anomalies, allowing us to identify unusual nodes or edges precisely. The kernel function’s hyperparameters are tuned using a copula function over an observation window, allowing the model to integrate historical behavior with emerging patterns. To validate this approach, real-world data from the UCI messages, Bitcoin OTC, DARPA and DGraphFin datasets were used for evaluation.