Graph based anomaly detection and description: a survey

• Published in: Data mining and knowledge discovery Vol. 29; no. 3; pp. 626 - 688
• Main Authors: Akoglu, Leman, Tong, Hanghang, Koutra, Danai
• Format: Journal Article
• Language: English
• Published: Boston Springer US 01.05.2015; Springer Nature B.V
• Subjects: Algorithms; Anomalies; Artificial Intelligence; Chemistry and Earth Sciences; Computer Science; Correlation; Data mining; Data Mining and Knowledge Discovery; Datasets; Electronic mail systems; Excavation; Failure; Fraud; Graph representations; Graphs; Information Storage and Retrieval; Knowledge management; Law enforcement; Malware; Physics; Product reviews; Social networks; Statistics for Engineering; Traffic flow; Event detection; Visual analytics; Change point detection; Network anomaly detection; Fraud detection; Anomaly detection; Anomaly description; Graph mining
• ISSN: 1384-5810; 1573-756X
• DOI: 10.1007/s10618-014-0365-y

Detecting anomalies in data is a vital task, with numerous high-impact applications in areas such as security, finance, health care, and law enforcement. While numerous techniques have been developed in past years for spotting outliers and anomalies in unstructured collections of multi-dimensional points, with graph data becoming ubiquitous, techniques for structured graph data have been of focus recently. As objects in graphs have long-range correlations, a suite of novel technology has been developed for anomaly detection in graph data. This survey aims to provide a general, comprehensive, and structured overview of the state-of-the-art methods for anomaly detection in data represented as graphs. As a key contribution, we give a general framework for the algorithms categorized under various settings: unsupervised versus (semi-)supervised approaches, for static versus dynamic graphs, for attributed versus plain graphs. We highlight the effectiveness, scalability, generality, and robustness aspects of the methods. What is more, we stress the importance of anomaly attribution and highlight the major techniques that facilitate digging out the root cause, or the ‘why’, of the detected anomalies for further analysis and sense-making. Finally, we present several real-world applications of graph-based anomaly detection in diverse domains, including financial, auction, computer traffic, and social networks. We conclude our survey with a discussion on open theoretical and practical challenges in the field.