MIDAS：基于微簇的边缘流异常检测器
MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams
摘要：
给定来自动态图的图边缘流，我们如何以在线方式为边缘分配异常分数，以检测异常行为，使用恒定的时间和内存？现有的方法旨在检测个别令人惊讶的边缘。在这项工作中，我们提出了MIDAS，它专注于检测微簇异常，或突然到达的可疑相似的边缘组，如锁步行为，包括拒绝服务攻击的网络流量数据。MIDAS具有以下特性：（a）它检测微簇异常，同时提供关于其假阳性概率的理论保证;（b）它是在线的，因此在恒定时间和恒定内存中处理每个边缘，并且处理数据的速度比最新方法快162-644倍;（c）它提供了比现有技术方法高42%-48%的准确性（就AUC而言）。
英文摘要：
Given a stream of graph edges from a dynamic graph, how can we assign anomaly scores to edges in an online manner, for the purpose of detecting unusual behavior, using constant time and memory? Existing approaches aim to detect individually surprising edges. In this work, we propose MIDAS, which focuses on detecting microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, such as lockstep behavior, including denial of service attacks in network traffic data. MIDAS has the following properties: (a) it detects microcluster anomalies while providing theoretical guarantees about its false positive probability; (b) it is online, thus processing each edge in constant time and constant memory, and also processes the data 162-644 times faster than state-of-the-art approaches; (c) it provides 42%-48% higher accuracy (in terms of AUC) than state-of-the-art approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
