A Probabilistic Framework to Node-level Anomaly Detection in
  Communication Networks
  In this paper we consider the task of detecting abnormal communication volume
occurring at node-level in communication networks. The signal of the
communication activity is modeled by means of a clique stream: each occurring
communication event is instantaneous and activates an undirected subgraph
spanning over a set of equally participating nodes. We present a probabilistic
framework to model and assess the communication volume observed at any single
node. Specifically, we employ non-parametric regression to learn the
probability that a node takes part in a certain event knowing the set of other
nodes that are involved. On the top of that, we present a concentration
inequality around the estimated volume of events in which a node could
participate, which in turn allows us to build an efficient and interpretable
anomaly scoring function. Finally, the superior performance of the proposed
approach is empirically demonstrated in real-world sensor network data, as well
as using synthetic communication activity that is in accordance with that
latter setting.
