## 3 A Community Anomaly Detection Approach Based on Structural/Attribute Information
### Proposed Community Anomaly Detection Approach
#### 3.2.2 Second Phase: Anomaly Scoring  
In this phase, we consider the structure information and attribute information to characterize the communities' anomalous nodes. Therefore, the node's anomaly score has to integrate its deviation within the relevant attributes and its connections to its community. This score raises new challenges, as one has to unify the information from both components defined in this section: the deviation in the relevant attribute values and the connections within the community. Our anomaly score has two parts: the community-structure-based score and the attribute-based score, which are described in the next subsections. * Community-structure-based score  
The community-structure-based score investigates the node's importance and the node's attachment to its community. Therefore, we use the eigenvector centrality and node connectivity to calculate the community-structure-based score, which is described as:  
\[StrAnomaly=1-Ec(v)\times con(v) \tag{2}\]  
where \(Ec(v)\) is its eigenvector centrality and \(Con(v)\) is the connectivity of node \(v\). The node connectivity is a measure that we introduce to assess the node's connection strength to its community compared with other nodes in the community. A high value is produced when the node has a connection to its community greater than the average connection in the community. The node connectivity is described as:  
\[con(v)=\frac{nb(v)}{\frac{\sum_{i=1}^{n}nb(v_{i})}{|c|}} \tag{3}\]where \(nb\) is the node neighbors in the community, and \(|c|\) is the number of nodes in the community. A high connectivity value indicates normal nodes, and a low connectivity value indicates anomalous nodes. The eigenvector centrality [20] measures the node's importance by calculating the number and the importance of its neighbors. We apply eigenvector centrality, since this precisely corresponds to our intuition for estimating the notion of connections to important nodes and/or parts of the network, which is relevant for anomaly detection. The eigenvector centrality of a node is the sum of eigenvector centralities of its neighbors, which is defined as the following: for a given graph \(G:=(V,E)\) with \(|V|\) nodes, let \(A=(av,t)\) be the adjacency matrix, where \((av,t)=1\) if the node \(v\) is linked to the node \(t\), and \((av,t)=0\) otherwise. The relative centrality score \(Ec\) of node \(v\) can be defined as:  
\[E_{c}=\frac{1}{\lambda}\sum_{t\in m(v)}E_{c}(t)=\frac{1}{\lambda}\sum_{t\in G }a_{v,t}E_{c}(t) \tag{4}\]  
where \(m(v)\) is a set of the neighbors of \(v\), \(Ec(t)\) the eigenvector centrality of \(t\in m(v)\), and \(\lambda\) is a constant. With a small rearrangement, it can be written in vector notation as the eigenvector equation:  
\[AE_{c}=\lambda E_{c} \tag{5}\]  
While there will be many different eigenvalues \(\lambda\), only the largest positive value is considered. A high eigenvector centrality means the node has many important neighbors, and it is a normal node. The algorithm assigns an initial eigenvector centrality equal to one for all nodes. It then iterates to recalculate the eigenvector centrality (Equation (4)) until the change in the computed values between two iterations is smaller than an error tolerance equal to \(1.0\times 10^{-6}\). For example, in Figure 1, the graph has eight nodes, and is partitioned into two communities by the Louvain algorithm. In the first community, the most important node is node B, as it has the greatest number of neighbors, and it is connected to the most important nodes. In contrast, the less important node is \(E\), as it has the least number of neighbors. Figure 2 shows the basic principle of the eigenvector centrality in simplified form, in which a node's centrality is the sum of its neighbors' centralities. The mathematical calculation of the eigenvector centrality of the graph's nodes is computed as:  
* We present the graph with an adjacency matrix, and for eigenvector centrality,we set an initial value to all nodes equal to 1.