
A Microcluster-Based Anomaly Detector in Edge Streams - siddharthbhatia
https://github.com/bhatiasiddharth/MIDAS
======
siddharthbhatia
Given a stream of graph edges from a dynamic graph, how can we assign anomaly
scores to edges in an online manner, for the purpose of detecting unusual
behavior, using constant time and memory? Existing approaches aim to detect
individually surprising edges. We present MIDAS, which focuses on detecting
microcluster anomalies, or suddenly arriving groups of suspiciously similar
edges, such as lockstep behavior, including denial of service attacks in
network traffic data.

MIDAS has the following properties:

(a) it detects microcluster anomalies while providing theoretical guarantees
about its false positive probability;

(b) it is online, thus processing each edge in constant time and constant
memory, and also processes the data 108 − 505 times faster than state-of-the-
art approaches;

(c) it provides 46%-52% higher accuracy (in terms of AUC) than state-of-the-
art approaches.

Paper:
[https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf)

Feedback is welcome!

