Simulations and applications to an international trade dataset and a primary-school contact network illustrate the performance of the proposed method, revealing a dissolution-driven trade decline followed by formation-driven recovery during COVID-19 and temporary merge-type mixing between school classes.
Abstract
We study anomaly detection in temporally dependent network sequences. Methods based only on adjacency matrices, which are widely used for static networks, can miss changes in the way edges evolve. We instead represent each pair of consecutive networks by separate formation and dissolution event matrices, and embed the resulting matrix sequences using unfolded adjacency spectral embedding. Comparing these embeddings against a stationary baseline yields vertex- and network-level statistics that detect an anomalous transition and identify whether it involves formation, dissolution, or both. For autoregressive random dot product graphs, we establish uniform rowwise consistency of the transition-event embeddings and derive high-probability guarantees for vertex- and network-level detection and exact recovery of the anomalous vertex set. The theory separates a vertex's own displacement from interference caused by other vertices and from autoregressive memory. We quantify the memory left by an earlier anomaly, show that it decays geometrically after the transition mechanism returns to baseline, and give conditions under which it is negligible. A degree-corrected stochastic block model extension gives exact community recovery and provides community-reassignment, centre-shift, split, and merge anomaly statistics with high-probability detection and recovery guarantees. Simulations and applications to an international trade dataset and a primary-school contact network illustrate the performance of the proposed method, revealing a dissolution-driven trade decline followed by formation-driven recovery during COVID-19 and temporary merge-type mixing between school classes.
Multivariate time series anomaly detection typically relies on evaluating discrepancies between observations and outputs produced by models trained on normal data. An alternative perspective is to characterize the distribution of normal data through the generative dynamics, i.e., the velocity field, of flow matching mo...
Ze-Peng Zhang, Jhony H. Giraldo, Wen-Bin Wang et al.· 0 citations
Dynamic networks describe evolving relational systems in which abrupt structural changes may signal anomalous events or important transitions. Detecting such changes requires distinguishing genuine structural signals from fluctuations in network observations and learned representations. We propose a DeepWalk-based fram...
Hou-Lin Zhou, Ye-Jin Wang, Xu-Fei Tang et al.· 0 citations
A common but underexplored decision in network anomaly detection is how to aggregate time series data before feeding it into a model. This paper studies that decision directly and argues that temporal aggregation is not a neutral preprocessing step: the choice of window size and boundary placement changes which periods...
Alex Yang, Maulshree Singh, S. Handurukande et al.· International Symposium on N...· 0 citations
BAD is proposed, an unsupervised framework for anomaly detection in continuous-time dynamic graphs that represents nodes with learnable identity embeddings and performs pairwise compatibility modeling via cross-attention between each destination node and the source’s recent neighbors, enabling direct characterization o...
Jia-Chi Luo, Sha-Meng Wen, Zi-Yan Qiu et al.· Proceedings of the Thirty-Fi...· 0 citations
Robust anomaly detection in time series remains challenging because sparse abnormal observations, noise contamination, nonlinear dynamics, and long-range temporal dependencies can obscure deviation patterns. This paper proposes the SALK anomaly detection model, which integrates an attention-enhanced long short-term mem...