DGRMiner: Anomaly Detection and Explanation in Dynamic Graphs

  • Karel VaculíkEmail author
  • Luboš Popelínský
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9897)


Ubiquitous network data has given rise to diverse graph mining and analytical methods. One of the graph mining domains is anomaly detection in dynamic graphs, which can be employed for fraud detection, network intrusion detection, suspicious behaviour identification, etc. Most existing methods search for anomalies rather on the global level of the graphs. In this work, we propose a new anomaly detection and explanation algorithm for dynamic graphs. The algorithm searches for anomaly patterns in the form of predictive rules that enable us to examine the evolution of dynamic graphs on the level of subgraphs. Specifically, these patterns are able to capture addition and deletion of vertices and edges, and relabeling of vertices and edges. In addition, the algorithm outputs normal patterns that serve as an explanation for the anomaly patterns. The algorithm has been evaluated on two real-world datasets.


Graph mining Data mining Dynamic graphs Rule mining Anomaly detection Outlier detection Anomaly explanation 



We would like to thank the IDA reviewers for valuable comments and suggestions. We would also like to thank Jan Ramon for helpful discussion on anomaly detection in graphs. This work has been partially supported by Faculty of Informatics, Masaryk University, Brno.


  1. 1.
    Akoglu, L., Tong, H., Koutra., D.: Graph-based anomaly detection and description: a survey. DAMI 28(4) (2014)Google Scholar
  2. 2.
    Araujo, M., Papadimitriou, S., Günnemann, S., Faloutsos, C., Basu, P., Swami, A., Papalexakis, E.E., Koutra, D.: Com2: fast automatic discovery of temporal (‘Comet’) communities. In: Tseng, V.S., Ho, T.B., Zhou, Z.-H., Chen, A.L.P., Kao, H.-Y. (eds.) PAKDD 2014. LNCS (LNAI), pp. 271–283. Springer, Heidelberg (2014). doi: 10.1007/978-3-319-06605-9_23 CrossRefGoogle Scholar
  3. 3.
    Cohen, W.W.: Enron Email Dataset. Web, Accessed 3 May 2016.
  4. 4.
    Heard, N.A., et al.: Bayesian anomaly detection methods for social networks. Ann. Appl. Stat. 4, 645–662 (2010)MathSciNetCrossRefzbMATHGoogle Scholar
  5. 5.
    Koutra, D., Papalexakis, E., Faloutsos, C.: Tensorsplat: spotting latent anomalies in time. In: 16th Panhellenic Conference on Informatics (PCI) (2012)Google Scholar
  6. 6.
    Mao, H.-H., Wu, C.-J., Papalexakis, E.E., Faloutsos, C., Lee, K.-C., Kao, T.-C.: MalSpot: multi2 malicious network behavior patterns analysis. In: Bailey, J., Khan, L., Washio, T., Dobbie, G., Huang, J.Z., Wang, R. (eds.) PAKDD 2016. LNCS (LNAI), vol. 9651, pp. 1–14. Springer, Heidelberg (2014). doi: 10.1007/978-3-319-06608-0_1 CrossRefGoogle Scholar
  7. 7.
    Papalexakis, E.E., Faloutsos, C., Sidiropoulos, N.D.: ParCube: sparse parallelizable tensor decompositions. In: Flach, P.A., Bie, T., Cristianini, N. (eds.) ECML PKDD 2012. LNCS (LNAI), pp. 521–536. Springer, Heidelberg (2012). doi: 10.1007/978-3-642-33460-3_39 CrossRefGoogle Scholar
  8. 8.
    Priebe, C.E., et al.: Scan Statistics on Enron Graphs. Web, Accessed 3 2016.
  9. 9.
    Rayana, S., Akoglu, L.: Less is more: building selective anomaly ensembles (with application to event detection in temporal graphs). In: SIAM SDM, Vancouver, BC, Canada (2015)Google Scholar
  10. 10.
    Sun, J., Tao, D., Faloutsos, C.: Beyond streams and graphs: dynamic tensor analysis. In: SIGKDD, Philadelphia, PA, pp. 374–383 (2006)Google Scholar
  11. 11.
    Vaculík, K., Nezvalová, L., Popelínský, L.: Educational data mining for analysis of students’ solutions. In: Agre, G., Hitzler, P., Krisnadhi, A.A., Kuznetsov, S.O. (eds.) AIMSA 2014. LNCS (LNAI), pp. 150–161. Springer, Heidelberg (2014). doi: 10.1007/978-3-319-10554-3_14 Google Scholar
  12. 12.
    Vaculík, K.: A versatile algorithm for predictive graph rule mining. In: Proceedings ITAT 2015: Information Technologies - Applications and Theory, pp. 51–58. Prague (2015).
  13. 13.
    Yan, X., Han, J.: gSpan: Graph-based substructure pattern mining. In: IEEE ICDM 2002. Washington, DC, USA (2002)Google Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  1. 1.KD LabFI MU BrnoBrnoCzech Republic

Personalised recommendations