ATD: Collaborative Research: Statistically Principled Real-Time Detection of Anomalies for Temporal Network Data

Cornell University, Ithaca NY

Investigators

Abstract

The detection of anomalous events in time-evolving networks of interconnected entities is gaining importance in our increasingly connected world. Example applications of anomaly detection in this setting include detecting terrorist cells or hate groups in a social network, identifying over-burdened power plants in a power grid, and uncovering illegal activity in financial markets. A major benefit of casting these problems as anomaly detection in networks is the ability to leverage the underlying network structure to significantly improve detection power. This research aims to develop a framework for anomaly detection in networks that guarantees good detection performance. This research aims to develop a two-stage pipeline for statistically-principled detection of anomalous events in static and dynamic networks. The first stage uses the structure and temporal evolution of the network to generate continually evolving time-series data for each node on the network. These multivariate time-series will be built out of a range of features, potentially including global information such as that from the spectral embedding and local information such as a nodes participation in subgraph patterns, or so-called "motifs". Part of this research is therefore necessarily developing efficient means to compute and update these features as the network evolves. The second stage leverages recent developments in robust statistics, especially multivariate quantile regression, to integrate side information and flag potential anomalies for further investigation. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.