Title: | Anomaly Detection in Temporal Networks |
---|---|
Description: | Anomaly detection in dynamic, temporal networks. The package 'oddnet' uses a feature-based method to identify anomalies. First, it computes many features for each network. Then it models the features using time series methods. Using time series residuals it detects anomalies. This way, the temporal dependencies are accounted for when identifying anomalies (Kandanaarachchi, Hyndman 2022) <arXiv:2210.07407>. |
Authors: | Sevvandi Kandanaarachchi [aut, cre] , Rob Hyndman [aut] |
Maintainer: | Sevvandi Kandanaarachchi <[email protected]> |
License: | GPL (>= 3) |
Version: | 0.1.1.2 |
Built: | 2024-11-02 02:57:27 UTC |
Source: | https://github.com/sevvandi/oddnet |
This function identifies anomalous networks from a series of temporal networks. It uses graph theoretic features to transform networks to a feature space. This function has parameters for feature computation, scaling, robust PCA and anomaly detection procedures. ADD MORE DESCRIPTION.
anomalous_networks( networks, alpha = 0.05, dd = 2, trim = 0.005, na_action = NULL, vert_attr = FALSE, attr_name = NULL, attr_mat = NULL, fast = FALSE, feature_subset = NULL )
anomalous_networks( networks, alpha = 0.05, dd = 2, trim = 0.005, na_action = NULL, vert_attr = FALSE, attr_name = NULL, attr_mat = NULL, fast = FALSE, feature_subset = NULL )
networks |
The input series of temporal networks given in a list with each network denoted by its adjacency matrix. |
alpha |
An anomaly detection parameter. The level of significance for the anomaly detection algorithm lookout. Default is 0.05. |
dd |
A robust PCA parameter. The number of reduced dimensions in robust PCA. Default is 2. |
trim |
A scaling parameter. The percentage used to compute trimmed mean and trimmed standard deviation. Default is 0.5 percent. |
na_action |
The action for NA valued features. |
vert_attr |
A feature computation parameter. If |
attr_name |
A feature computation parameter. The name of the network vertex attribute. Only a single attribute can be specified. |
attr_mat |
A feature computation parameter. If network nodes/vertices have attributes, the list of attribute matrices for each network can be given using this feature. |
fast |
If set to |
feature_subset |
A feature computation parameter. A subset of features to be used for anomaly detection. |
Object imported from lookout.
[lookout::lookout()]
# We generate a series of networks and add an anomaly at 50th network. set.seed(1) networks <- list() p.or.m.seq <- rep(0.1, 50) p.or.m.seq[20] <- 0.3 # anomalous network at 20 for(i in 1:50){ gr <- igraph::erdos.renyi.game(50, p.or.m = p.or.m.seq[i]) networks[[i]] <- igraph::as_adjacency_matrix(gr) } anomalous_networks(networks, fast = TRUE)
# We generate a series of networks and add an anomaly at 50th network. set.seed(1) networks <- list() p.or.m.seq <- rep(0.1, 50) p.or.m.seq[20] <- 0.3 # anomalous network at 20 for(i in 1:50){ gr <- igraph::erdos.renyi.game(50, p.or.m = p.or.m.seq[i]) networks[[i]] <- igraph::as_adjacency_matrix(gr) } anomalous_networks(networks, fast = TRUE)
This function computes features for each network using graph theoretic constructs.
compute_features(gr, attributes = FALSE, attr_name = NULL, fast = FALSE)
compute_features(gr, attributes = FALSE, attr_name = NULL, fast = FALSE)
gr |
The network or graph as an |
attributes |
If the network nodes/vertices have attributes, then |
attr_name |
The name of the node/vertex attribute. Only a single attribute can be specified. |
fast |
If set to |
A network features object containing 20 graph-theoretic features.
set.seed(1) gr <- igraph::erdos.renyi.game(100, 0.05) compute_features(gr)
set.seed(1) gr <- igraph::erdos.renyi.game(100, 0.05) compute_features(gr)
Laplacian Eigen Value method by Shenyang Huang, Yasmeen Hitti, Guillaume Rabusseau and Reihaneh Rabbany from their KDD'20 paper Laplacian Change Point Detection for Dynamic Graphs
lad(matlist, k = NULL, short_win, long_win, alpha = 0.05, from_file = NULL)
lad(matlist, k = NULL, short_win, long_win, alpha = 0.05, from_file = NULL)
matlist |
The matrix list, where each matrix is an adjacency matrix of the graph. |
k |
The number of eigen values to connsider |
short_win |
The length of the shorter windows |
long_win |
The length of the longer windows |
alpha |
The threshold to declare anomalies |
from_file |
This is an additional parameter only if a file needs to be read |
An object of class lad. LAD is a window based method. It considers short and a long windows. The lad object has anomalous scores when taking into account short and long windows along with the identified anomalies for both short and long windows.
Huang, S., Hitti, Y., Rabusseau, G., & Rabbany, R. (2020). Laplacian Change Point Detection for Dynamic Graphs. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 349–358. https://doi.org/10.1145/3394486.3403077
# We generate a series of networks and add an anomaly at 50th network. set.seed(1) networks <- list() p.or.m.seq <- rep(0.05, 50) p.or.m.seq[20] <- 0.2 # anomalous network at 20 for(i in 1:50){ gr <- igraph::erdos.renyi.game(100, p.or.m = p.or.m.seq[i]) networks[[i]] <- igraph::as_adjacency_matrix(gr) } ladobj <- lad(networks, k = 6, short_win = 2, long_win = 4) ladobj
# We generate a series of networks and add an anomaly at 50th network. set.seed(1) networks <- list() p.or.m.seq <- rep(0.05, 50) p.or.m.seq[20] <- 0.2 # anomalous network at 20 for(i in 1:50){ gr <- igraph::erdos.renyi.game(100, p.or.m = p.or.m.seq[i]) networks[[i]] <- igraph::as_adjacency_matrix(gr) } ladobj <- lad(networks, k = 6, short_win = 2, long_win = 4) ladobj