Ranking and Discovering Anomalous Neighborhoods in Attributed Multiplex Networks

The attributed multiplex network is a set of attributed networks in which each network represents a different type of interaction between the same set of nodes. Individual networks are termed as layers or dimensions and network nodes are characterized by attribute vectors. Neighborhood, in general, refers to any dense connected subgraph. We refer neighborhood1 as subgraph induced on graph node and its neighbors. It is usually observed that majority of the nodes in multilayer networks are active only on small number of layers except some outliers [18]. However, node activity is not strictly correlated to the edges incident in a node. A node might be active at few layers with relatively large number of incident edges and at the same time, multi-active node might not have many links even on single layer. Moreover, each layer has distinct importance in the multiplex networks2 and the structure and size of neighborhood formed by these multiplex nodes are different on each layer. Nodes with different attributes come together on different layers in the attributed multiplex networks. This node and layer heterogeneity should be considered while identifying anomalous neighborhoods in the attributed multiplex networks. Thus, a measure is required to quantify the quality of neighborhoods formed by active nodes on different layers. Existing approaches do not consider heterogeneity among network layers and do quantify the structure of networks either separately for each layer or its aggregated network and ignore the attributes of nodes. In this work, we define a novel quality measure Multi-Normality which utilizes the structure and attributes together of each layer and detect attribute coherence in neighborhoods between layers. We also propose an algorithm exhausting multi-normality to identify anomalous neighborhoods in multiplex networks and is named as Anomaly Detection of Entity Neighborhoods in Multiplex Networks (ADENMN). We evaluate the effectiveness of the proposed algorithm in anomaly detection by comparing its performance with three existing baseline approaches including ADOMS, AMM and AGG+AD on five real-world attributed multiplex networks including Amazon, YouTube, Noordin top terrorist network, DBLP_C, and Aarhus. The results of experiments demonstrate that multi-normality outperforms baseline algorithms.