Streaming data analytics for anomalies in graphs
William Eberle, Lawrence B. Holder · 2015
Protecting our nation's infrastructure and securing sensitive information are critical challenges for both industry and government. Due to the complex and diverse nature of the environments which can expose attacks or terrorism activity, one must not only be able to deal with attacks that are dynamic, or constantly changing, but also take into account the structural aspects of the networks and the relationships among communication events. However, analyzing a massive, ever-growing graph will quickly overwhelm currently-available computing resources. One potential solution to the issue of handling very large graphs is to handle data as a “stream”. In this work, we present an approach to processing a stream of changes to the graph in order to efficiently identify any changes in the normative patterns and any changes in the anomalies to these normative patterns without processing all previous data. The overall framework of our approach is called PLADS for Pattern Learning and Anomaly Detection in Streams. We evaluate our approach on a dataset that represents people movements and actions, as well as a scalable, streaming data generator that represents social network behaviors, in order to assess the ability to efficiently detect known anomalies.