SEDANSPOT: Detecting Anomalies in Edge Streams

Given a stream of edges from a time-evolving (un)weighted (un)directed graph, we consider the problem of detecting anomalous edges in near real-time using sublinear memory. We propose SEDANSPOT, a principled randomized algorithm, which exploits two tell-tale signs of anomalous edges: they tend to (i) occur as bursts of activity and (ii) connect parts of the graph which are sparsely connected. SEDANSPOT has the following desirable properties: (a) Burst resistance: It provably downsamples edges from bursty periods of network traffic, (b) Holistic scoring: It takes into account the whole (sampled) graph while scoring the anomalousness of an edge, giving diminishing importance to far-away neighbors, (c) Efficiency: It supports fast updates and scoring and hence can be efficiently maintained over stream; further, it can detect anomalous edges in sublinear space and constant time per edge. Through experiments on real-world data, we demonstrate that SEDANSPOT is 3× faster and 270% more accurate (in terms of AUC) than the state-of-the-art.