S EDAN S POT : Detecting Anomalies in Edge Streams Supplementary

This document supplements [1] by giving proofs of theoretical results and details on additional experiments. I. PROOFS OF THEORETICAL ANALYSIS IN SEC. VI Proof of Lem. 1: Follows from Proposition 3 of [2]. Proof of Thm. 1: A sampled edge e can belong to Hk in |Hk| mutually exclusive ways. Hence, Pr [e ∈ Hk | e ∈ S] = ∑ e′∈Hk Pr [e = e ′ | e ∈ S], which can be simplified using Bayes’ rule to ∑ e′∈Hk Pr [e = e ′ ∧ e ∈ S] /Pr [e ∈ S] ∝ ∑ e′∈Hk Pr [e ′ ∈ S] since Pr [e ∈ S] is independent of k. Suppose γ1<γ2 . <γzk=τk are the anchored time ticks during interval Ik:=(τk−1, τk]. Let γ0=τk−1 and Eγi be the set of edges occuring at γi. Then, ∑ e∈Eγi Pr [e′ ∈ S] ∝ ∑ e∈Eγi 1/r(e′) = γi−γi−1. Thus, Pr [e ∈ Hk | e ∈ S] ∝ ∑ e′∈Hk Pr [e ′ ∈ S] = ∑zk i=1 γi−γi−1 = τk−τk−1 = `k. Proof of Lem. 2: O (N/α) comes from the N local random walks, each of expected length E [Geometric(α)] = 1/α (lines 16-22 of Alg. 3). Each step of random walk takes O (1) due to constant-time neighbor sampling via LAT. Proof of Lem. 3: The O (log |V|) is a lower bound on the memory requirement, since each edge (including vertex IDs) needs to be read. Thus, O (S log |V|) space is needed to store LAT data structures over the sample of S edges. Proof of Lem. 4: For i > S, the probability of sampling the ith edge ei in the stream is pi = r(ei)/ ∑i j=1 r(ej) −1 ≤ rmax/(i · rmin). The expected number of updates is S + ∑L S+1 pi ≤ S + rmax/rmin ∑L S+1 1/i, each update costing O (logS) for sampling and O (davg) for scoring in expectation (assuming no correlation between edge rate and the degrees of incident vertices). Amortization completes the proof. II. ADDITIONAL EXPERIMENTS Here, we describe our datasets and then answer the following from the main paper: Q3) Discoveries: Does SEDANSPOT lead to interesting discoveries in practice? Q4) Parameters: How do accuracy and running time depend on S, N and α? A. Dataset description DARPA [3] dataset consists of network traffic from 9484 source IPs to 23398 destination IPs over 87.7K minutes. There are ∼ 4.5M directed <srcIP, dstIP, 1, time> edges in total, of which 60% are manually annotated as anomalous. They correspond to 89 network attacks – such as denial of service or port scan – injected by domain experts. Despite this high proportion, the attacks themselves occurred infrequently (but as bursts of activity) and originated from a mix of IP addresses which either were solely dedicated to attacks, or more challengingly, attempted camouflage by participating in normal traffic. This makes DARPA dataset the perfect testbed for SEDANSPOT, which aims to detect precisely such anomalous bursts occurring in sparse regions of the graph. ENRON [4] dataset consists of e-mail communications among the 151 employees of Enron company from May 1999 to April 2002, a period of three years surrounding the famous Enron scandal. There are ∼50K directed <sender, receiver, 1, date> edges. Since ground truth is not directly available, we verify anomalies by correlating their time stamps with realworld events. We expect more edges to be flagged anomalous during periods of large internal (e.g., new CEO) or external (e.g., updates on lawsuit) changes which create (or result from) excitement or turbulence among the employees. DBLP [5] is the collaboration network of authors of papers from DBLP computer science bibliography. Each undirected edge <auth1, auth2, 1, pub_year> between two authors represents a joint publication. For simplicity, we only consider papers published in 1991-2010 and retain nodes (authors) who have at least 50 edges, filtering out the remaining nodes (and corresponding edges). This resulted in a graph containing around 55.5K authors and 3.7M coauthorships. We expect anomalous edges to represent unlikely collaborations, e.g., authors from unrelated fields or different geographical regions. We verify anomalies using the public profiles of the authors. Q3) Discoveries (on ENRON and DBLP datasets) ENRON: Fig. 1 depicts the anomaly detection results on ENRON dataset using N=50 walks, α=0.15 restart probability and S=2K edges in sample. The inset, plotting the distribution of anomaly scores, showcases a large separation in scores for anomalies and non-anomalies, which is desirable. Accordingly, we use the threshold marked in red (=0.76) to flag anomalies1. The rest of the figure plots the temporal distribution of flagged edges (aggregated weekly), which we verify by correlating with the publicly-available ENRON time line2. The red arrows in Fig. 1 mark the top five non-contiguous periods of time having the highest number of anomalous edges. As expected, these periods coincide well with notable events 1In practice, one can use the median μ̂ and inter-quantile range σ̂ of past scores to flag anomalies, in an online manner, when the score exceeds μ̂+3σ̂. 2http://www.agsm. edu.au/bobm/teaching/BE/Enron/timeline.html Fig. 1. Anomaly detection in ENRON dataset surrounding the ENRON scandal, creating a flood of unusual emails from (even low-level) employees: (1) Dec 2000: Skilling announced as CEO. (2) Jun 2001: The California energy crisis ends. (3) Aug 2001: Skilling announces resignation. Lay named CEO. (4) Oct-Nov 2001: Fastow ousted. A formal investigation against Enron is launched. Stocks crumble. Enron files for bankruptcy. (5) Jan-Feb 2002: Cooper takes over as CEO after Lay resigns. Fastow, Kopper, Skilling and Watson (whistle-blower) testify before Congress. DBLP: We run SEDANSPOT on DBLP with S=200K, α=0.15 and N=1000. As we show with the help of anecdotal evidence, the top anomalous edges indeed represent unexpected or unlikely collaborations – (i) Alex Galis, Robert Szabo (2004): This is due a joint invited paper at an IEEE MATA 2004 workshop, which marked the beginning of an unexpected collaboration between authors of different countries, namely, Galis from Univ. College London (UK) and Szabo from Budapest Univ. of Technology and Economics (Hungary). (ii) Nikol Rummel, Nikolaos Avouris (2007): This is the result of an interdisciplinary paper about Computer Supported Collaborative Learning, requiring collaboration between authors belonging to different fields (Psychology, ECE). (iii) Ryan Thibodeau, Mark Carrington (2010): This is the product of a rare massive collaboration effort among 44 authors across seven institutions, including Thibodeau from Univ. of Georgia, USA and Carrington from Univ. of Cambridge, UK. This marks their only joint publication. Q4) Accuracy and running time w.r. t. parameters Fig. 2 and Fig. 3 show how accuracy and running time (to process 0.5M edges) vary with the number of walks N , restart probability α and sample size S. By default, we use S=10K, N=100 and α=0.15. All values are averaged over five runs and error bars indicate standard deviations. Accuracy w.r. t. α: Fig. 2a shows that the accuracy is robust (∼ 0.635) to the restart probability α ∈ [0.5, 0.11]. This is consistent with the trend observed for page rank (closely related to random walks), where α has little effect on the top ranking webpages based on their page ranks [6]. W.r. t. S: Fig. 2b shows that the accuracy exhibits a ‘diminishing return’ behavior as sample size S is increased in [6K, 20K]. As SEDANSPOT stores more edges, it better models normal behavior and thus accuracy increases. But the marginal increase itself decreases: once the normal behavior is captured (a) α (b) S (c) N Fig. 2. Accuracy w.r. t. parameters