## 3 A Community Anomaly Detection Approach Based on Structural/Attribute Information
### Proposed Community Anomaly Detection Approach
#### 3.2.2 Second Phase: Anomaly Scoring
* We multiply the two vectors and set \(\lambda\) as the normalized value of the resulted vector. * By applying Equation (4), we obtain the eigenvector centrality of the first iteration. * We repeat the same calculation until the eigenvector values converge. The following calculation shows two iterations of the eigenvector centrality:  
Figure 1: Example of a graph with communities. where \((f_{ri}-f_{rj})\) is the \(r^{th}\) attribute values for the nodes \(i\) and \(j\), and \(U_{r}=\sum_{i=1}^{p}\frac{f_{ri}}{p}\) denotes the mean of the \(r^{th}\) attribute. \(\mathcal{D}\) denotes a diagonal matrix with \(D_{ii}=\sum_{j}S_{ij}\), and \(S\) is the similarity matrix, whose elements are defined as follows:  
\[S_{ij}=\left\{ \begin{array}{ll}e^{-\frac{\|(x_{i}-x_{j})^{2}\|}{2\theta^{2}} }&\text{if $x_{i}$ and $x_{j}$ are neighbors}\\ 0&\text{Otherwise.}\end{array} \right.\]  
where \(\theta\) is a constant, and \(x_{i}\) and \(x_{j}\) are considered as neighbors if \(x_{i}\) is among the \(k\) nearest neighbors of \(x_{j}\) in terms of Euclidean distance or \(x_{j}\) is among the \(k\) nearest neighbors of \(x_{i}\). As the smallest Laplacian score is preferable, the best attribute is the attribute that minimizes Equation (6) by smaller \((f_{ri}-f_{rj})\). Therefore, the best attribute is the one in which the nodes are close to each other, if, and only if, they are connected. As a result, we choose a subset with size \(N\) of the most important attributes, where \(N\) is an input parameter for our algorithm. Since the context (relevant attributes) is defined, we use these relevant attributes to estimate the attribute-based score that we define as the mean of all the attributes' scores, which is described as:  
\[AttrAnomaly(v)=\frac{\sum_{r=1}^{n}S(v,a_{r})}{n},\forall a_{r}\in A \tag{7}\]  
where \(n\) is the number of attributes in the relevant attributes set \(A\), and \(S(v,a_{r})\) is the attribute score of node \(v\) for the attribute \(a_{r}\), \(\forall a_{r}\in A\), which is defined as:  
\[S(v,a_{r})=\frac{\sum_{j=1}^{C}d(v,v_{j})}{|C|},\forall v_{j}\in C \tag{8}\]  
where \(v_{j}\) denotes the other nodes in the community, \(|C|\) is the number of nodes in the community, and \(d(v,v_{j})\) is the distance between the nodes \(v\) and \(v_{j}\), which is set at 0 if the distance between the two nodes is equal and less than the mean distance (Md) or 1 otherwise. \[d(v,v_{j})=\left\{ \begin{array}{ll}0&\text{if}|a_{r}(v_{i})-a_{r}(v_{j})| \leq Md(C_{(v)},a_{r})\\ 1&\text{Otherwise.}\end{array} \right.\]  
where \(a_{r}(v_{i})\) is the value of the attribute \(a_{r}\) in the attribute vector of node \(v\), and \(Md(C_{(v)},a_{r})\) denotes the mean distance of attribute \(a_{r}\) in the community of node \(v\), and it is described as follows:  
\[Md(C_{v},a_{r})=\frac{\sum_{i,j=1}^{C}(a_{r(vi)}-a_{r(v)})}{p} \tag{9}\]  
where \((a_{r(vi)}-a_{r(vj)})\) is the distance between the node \(v_{i}\) and the node \(v_{j}\), and \(p\) is the number of node pairs in the community. The anomaly score \(AnomalyS\) of a node \(v\) is defined as:  
\[AnomalyS(v)=\alpha*StrAnomaly(v)+(1-\alpha)*AttrAnomaly(v) \tag{10}\]  
where \(\alpha\) is a weight used for controlling the relative importance of structure-based anomalies and attribute-based anomalies. The value of \(\alpha\) depends on the type of network.