A multi-domain splitting framework for time-varying graph structure

1 INTRODUCTION . In the analysis of spatial-temporal structured data , graph signal processing ( GSP ) is an important type of method , taking advantages of graph model to represent the structure . Graph has abundant features , which should be captured by appropriate rules . These methods can be divided into 2 categories by whether graph structure is variable or not.The first , in the applications with invariant graph structure , there are no temporal differences on graph to consider . For instance , in traffic flow forecasting proposed by Yu et al . ( 2018 ) , the road map is regarded as the graph structure ( adjacency matrix ) , which is generated by fixed longitude and latitude without temporal features . The second , in the tasks that consider spatial-temporal structured datasets , the graph structure must be influenced by time lapse , such as , traffic ( Guo et al . ( 2020 ) ) , urban , Covid-19 , etc . Thus , in the tasks belong to second category , it is inevitable to consider the graph structure as time-varying . Also , time-varying data structures could be more common than the invariant cases in real world . Then , anomaly detection is of great importance in modern data science , as singular or anomaly data is ubiquitous among real-world datasets , which are time-series collected from distributed sensor or receiver networks . Especially , detecting the anomalies in the time-varying structure is then becomes an open challenge Atluri et al . ( 2018 ) , Bergman & Hoshen ( 2020 ) . The applications include traffic events detection , neighbors discovery , pandemic spreading analysis and social network clustering . Significantly , the applications in traffic are the most considered task Zhang et al . ( 2020 ) . The meticulous and effective analysis of graph structure are important for valuable detecting of anomalies of vertices Djenouri et al . ( 2019 ) . However , how to divide graph sequence into appropriate sub-sequences adaptively is the key point in the challenge of temporal dynamic graph structure capturing . Therefore , to break the limitation of time-varying structure analysis , the time-vertex-frequency multi-domain graph splitting framework , called GMDS , which is proposed to capture the timevarying graph structure . The first part is an augmented dickey-fuller ( ADF ) test based data preprocessing . The second is the discrete wavelet transform based graph time-series local splitting . Based on ARIMA , the third part of the GMDS is the graph generation to capture the variable graph struc- ture that segmented by the second part . The last part is the global detection , which is designed as anomaly detection to extract the dependencies and eigenvalues among graph . The output of last part is the anomalies . And the implementations of our framework without training part are accessible at https : //github.com/Zehua-Yu/TVF-anomaly-detection . Our contributions are summarized as follows : • A novel framework based on the appropriate temporal splitting in multi-domain called GMDS is proposed for time-varying graph structure anomaly detection . • Through the dynamic adaptive partition graph , our framework can analyze the data of different periods more carefully and accurately . It breaks the limitation of global unified graph generation and prevents local features from being submerged in the global scope . • The experiments show that GMDS has the generalization to different types of traffic data . 2 RELATED WORK . There are many methods with abundant mechanisms and modules that have been applied to anomaly detection . Zhang et al . ( 2020 ) has done a survey of urban anomaly analysis approaches , including description , detection and prediction . These methods can be divided into sets by different standards . Djenouri et al . ( 2019 ) summarize the anomalies detection algorithms that are applicated in urban traffic . All the methods are divided into 2 categories : flow outlier detection and trajectory outlier detection . The front category includes statistical , similarity , and pattern mining methods . The latter one includes offline and online processing . However , the above methods consider little about the spatial-temporal and interaction topology analysis among data . Graph is a widly used structure , which is good at modeling the data with complicated multi-meta to capture the saptial-temporal topology and other types linkages among vertices . Sofuoglu & Aviyente ( 2021 ) introduce low-rank matrix recovery on graphs into low-rank tensor recovery to imply the anomaly detection in spatial-temporal data . Tasneem et al . ( 2019 ) presents numerous examples and proofs to illustrate the validity of the theorems of using antimagic graph labeling for splitting . Then , Ioannidis et al . ( 2021 ) present GraphSAC to effectively detect anomaly vertices in graph with complicated dependency features . ITGCN have been proposed by Yu et al . ( 2021 ) to capture the interactions among vertices , and performed well in Covid-19 daily confirmed cases forecasting . 3 PRELIMINARIES . In this section , we recap the preliminaries in graph signal , ARIMA , discrete wavelet transform ( DWT ) and graph wavelet transform . 3.1 GRAPH SIGNAL . In our works , the graph signals are defined on the graphs , which are weighted , connected and undirected . Following the Zheng et al . ( 2019 ) , the graphs considered in this work are denoted as G = ( V , E , A ) , where V = v0 , v1 , ... , vN−1 is the set of vertices that contain features , E is the set of edges , A ∈ RN×N is the adjacency matrix that represent weights . The adjacency matrix is symmetric , shown as A ( i , j ) = A ( j , i ) , where A ( i , j ) ∈ R denotes the weight assigned to the edge e ( i , j ) between the vertices vi and vj . The degree matrix D of the graph G is defined as a diagonal matrix whose D ( i , i ) is given by the degree of vertex i , i.e. , D ( i , i ) = deg ( vi ) , where deg ( vi ) is the degree of vertex i . All the graphs considered in this work are undirected weighted graph without self-loops as shown in Fig . 1 . The linkages between vertices are all nonnegative . 3.2 ARIMA . Auto regressive integrated moving average ( ARIMA ) is widly used in sequences modeling or forecasting tasks . No significant difference with stationarity and with a rapidly decreasing autocorrelation function are two satisfied requirements for ARMA modeling . Thus , for the data without the requirements above , the difference is introduced to solve this problem in ARIMA . Let d be a nonnegative integer , { Xt } isARIMA ( p , d , q ) , if Yt , ( 1−B ) dXt is the causalARMA ( p , q ) process , the { X } satisfies φ∗ ( B ) Xt ≡ φ ( B ) ( 1 − B ) dXt = θ ( B ) Zt , { Zt } ∼ WN ( 0 , σ2 ) where φ ( z ) and θ ( z ) are p-order and q-order polynomials respectively , B is the coefficient setted by mission requirement , d is the differences order . 3.3 DISCRETE WAVELET TRANSFORM . Signals defined on time are discrete . At the same time , the scale parameter a and time shift parameter b are also processed by discretion ( a = 2j , b = k2j , ( j , k ∈ Z ) ) . Under this definition , mother wavelet and other wavelets are all discrete , represented by φ ( n ) and φj , k ( n ) respectively , where φj , k ( n ) is defined as φj , k ( n ) = 2−j/2φ ( 2−jn−k ) , ( j , k ∈ Z ) where j , k are calculated according to the specific data . Let f ( n ) be the input , the DWT of f ( n ) according to φj , k ( n ) is Cj , k , DWTφf ( 2 j , k2j ) = ∑∞ n=−∞ f ( n ) ¯φj , k ( n ) = 2 −j/2∑∞ n=−∞ f ( n ) φ̄ ( 2 −jn − k ) , ( j , k , n ∈ Z ) where n is the total number of discrete time . 3.4 SPECTRAL GRAPH WAVELET TRANSFORM . Following the definition of Graph Fourier Transform Hammond et al . ( 2011 ) , the spectral graph wavelet transform can be defined as follow . The transform will be determined by the choice of a kernel function g : R+ → R+ , which is analogous to Fourier domain wavelet ψ̂∗ in ( T sδa ) ( x ) = 1/sψ ∗ ( a − x/s ) This kernel g should behave as a band-pass filter , i.e . it satisfies g ( 0 ) = 0 and limx→∞g ( x ) = 0 . We will defer the exact specification of the kernel g that we use until later . The spectral graph wavelet transform is generated by wavelet operators that are operator-valued functions of the Laplacian L , which is L = 1 − D−1/2AD1/2 . L is a real symmetric matrix , it has a complete set of orthonormal eigenvector denoted by χl for l = 0 , ... , N − 1 , with associated eigenvalues λl . A measureable function of a bounded self-adjoint linear operator on a Hilbert space using the continuous functional calculus is defined to achieved using the spectral representation of the operator , which is equivalent to the graph Fourier transform defined in Hammond et al . ( 2011 ) . In particular , for spectral graph wavelet kernel g , the wavelet operator Tg = g ( L ) acts on a given function f by modulating each Fourier mode as ˆTgf ( l ) = g ( λl ) f̂ ( l ) . Employing the inverse Fourier transform yields ( Tgf ) ( m ) = ∑N−1 l=0 g ( λl ) f̂ ( l ) χl ( m ) . The wavelet operators at scale t is then defined by T tg = g ( tL ) . The spectral graph wavelets are then realized through localizing these opertors by applying them to the impulse on a single vertex , i.e . ψt , n = T tgδn . Using the orthonormality of the χl , it can be seen that the wavelet coefficients can also be achieved directly from the wavelet opertors , as Wf ( t , n ) = ( T tgf ) ( n ) = ∑N−1 l=0 g ( tλl ) f̂ ( l ) χl ( n ) . The above is the main part of the application of SGWT in our method . See Hammond et al . ( 2011 ) for other notes and proofs . Then in next section , following the definition above , we will introduce the details of our method . 4 GMDS FRAMEWORK . In this section , the multi-domain splitting framework for graph structure is proposed , and we describe the detailed architecture of it shown in Figure 1 . Firstly , we use preprocessing module to clean the original data , and form them into the appropriate format of next layer . Secondly , the Local Splitting is used to split the graph time-series that follow our framework order by local DWT analysis . Then , after the splitting , we use graph generation module to generate the adjacency matrix of each splitted graph time-series . In the last layer , we use spectral graph wavelet transform ( SGWT ) to implement the frequency domain global detection . And the output of our framework is the detection results that involve in the anomaly vertices finding , vertices classification and related application analysis . Furthermore , the local part is detection in each splitted period , the global part stands for splitting on whole time-series .

Summary: In this paper, the authors considered the problem of time-varying graph structure anomaly detection. A graph multi-domain splitting framework was proposed by integrating the time, vertex, and frequency features to locate the anomalies. The authors designed a splitting approach for separating the graph sequences into several sub-sequences adaptively, which is based on the discrete wavelet transform. The experiments showed that the proposed method has a better performance than the baselines.