Network relationships can be widely seen among entities in various fields such as social networks, supply networks and Internet of Things (IoT). Sometimes abnormal events such as cyber-attacks occur to cause an abrupt increase or decrease in the traffic of networks. Many anomaly detection methods have been developed to identify such abnormal events in networks. In recent years, statistical process control (SPC) has attracted more and more attention in network anomaly detection. However, many of the existing statistical models regard the interaction between two nodes in unweighted directed networks as a binary variable, i.e. presence and absence of contacts, which fails to reflect the intensity level of interactions. This article proposes a new model to describe the dyadic interactions with several ordinal levels and introduces special quantities to incorporate the ordinal information into the model. The model can be expressed in a matrix form to enable easy parameter estimation and derivation of a quadratic monitoring statistic. Numerous simulation studies show that the proposed methods detect anomalies in multi-relational networks more quickly than existing monitoring methods. A case study exhibits the implementation and superiority of the proposed method.
Read full abstract