Density-based structural embedding for anomaly detection in dynamic networks

Abstract

Dynamic networks continuously change their structure and properties, and anomaly detection methods must identify these structural changes at both local and global levels. Network embedding is considered a powerful tool for low-dimension structural representation of network objects. However, most embedding techniques developed for dynamic networks are incompetent in capturing the changes in global structures. Besides, with incoming edge streams, these techniques change the embeddings of all network objects, including those vertices and edges that do not experience any change in subsequent timestamps. In this paper, we propose an embedding algorithm DSEDN to identify anomalous vertices and edges in dynamic networks utilizing structural changes in networks. The algorithm uses sparse autoencoder to generate network embeddings minimizing the pair-wise and neighborhood distance between vertex representations of every subgraph derived from random walks. The subgraphs have been weighted based on their respective clustering coefficient, and the clustering algorithm is employed to identify network anomalies. The advantages of proposed method include: (i) better accuracy in detecting network anomalies; (ii) structure-preserving embeddings, such that it maintains the local and global structure of every snapshot of growing graphs; (iii) density-based embeddings; (iv) stable embeddings over time such that embeddings of consecutive timestamps do not change much for those network objects that do not experience any change; (v) scalability. We evaluate the proposed algorithm on anomaly detection and graph visualization on five real-world datasets. Our algorithm achieves improvement in AUC, scalability, and stability across all baselines.