Link-Based Anomaly Detection in Communication Networks

Communication networks, such as networks formed by phone calls and email communications, can be modeled as dynamic graphs with vertices representing agents and edges representing communications. Anomaly detection is to identify abnormal behaviour occurring in these networks. This is crucial for anti-terrorism, resource allocation and network management. The contents of the communications are often unavailable or protected by regulations or encryption, which makes linkage information the only type of data we can rely on in order to identify anomalies. In this paper, we propose a link-based anomaly detection method that considers deviations from individual patterns by taking into account the behaviour pattern of the cluster to which the individual belongs. Clusters can be formed by a standard clustering procedure or based on a specific attribute depending on the dataset. Experiments show that this method performs well on both network traffic and email communication data.