Real-Time Anomaly Detection in Edge Streams
  Given a stream of graph edges from a dynamic graph, how can we assign anomaly
scores to edges in an online manner, for the purpose of detecting unusual
behavior, using constant time and memory? Existing approaches aim to detect
individually surprising edges. In this work, we propose MIDAS, which focuses on
detecting microcluster anomalies, or suddenly arriving groups of suspiciously
similar edges, such as lockstep behavior, including denial of service attacks
in network traffic data. We further propose MIDAS-F, to solve the problem by
which anomalies are incorporated into the algorithm's internal states, creating
a `poisoning' effect that can allow future anomalies to slip through
undetected. MIDAS-F introduces two modifications: 1) We modify the anomaly
scoring function, aiming to reduce the `poisoning' effect of newly arriving
edges; 2) We introduce a conditional merge step, which updates the algorithm's
data structures after each time tick, but only if the anomaly score is below a
threshold value, also to reduce the `poisoning' effect. Experiments show that
MIDAS-F has significantly higher accuracy than MIDAS. MIDAS has the following
properties: (a) it detects microcluster anomalies while providing theoretical
guarantees about its false positive probability; (b) it is online, thus
processing each edge in constant time and constant memory, and also processes
the data orders-of-magnitude faster than state-of-the-art approaches; (c) it
provides up to 62% higher ROC-AUC than state-of-the-art approaches.
