Non-negative residual matrix factorization with application to graph anomaly detection

Hanghang Tong, Ching Yung Lin

Research output: Chapter in Book/Report/Conference proceedingConference contribution

51 Scopus citations

Abstract

Given an IP source-destination traffic network, how do we spot mis-behavioral IP sources (e.g., port-scanner)? How do we find strange users in a user-movie rating graph? Moreover, how can we present the results intuitively so that it is relatively easier for data analysts to interpret? We propose NrMF, a non-negative residual matrix factorization framework, to address such challenges. We present an optimization formulation as well as an effective algorithm to solve it. Our method can naturally capture abnormal behaviors on graphs. In addition, the proposed algorithm is linear wrt the size of the graph therefore it is suitable for large graphs. The experimental results on several data sets validate its effectiveness as well as efficiency.

Original languageEnglish (US)
Title of host publicationProceedings of the 11th SIAM International Conference on Data Mining, SDM 2011
Pages143-153
Number of pages11
StatePublished - Dec 1 2011
Event11th SIAM International Conference on Data Mining, SDM 2011 - Mesa, AZ, United States
Duration: Apr 28 2011Apr 30 2011

Publication series

NameProceedings of the 11th SIAM International Conference on Data Mining, SDM 2011

Other

Other11th SIAM International Conference on Data Mining, SDM 2011
CountryUnited States
CityMesa, AZ
Period4/28/114/30/11

    Fingerprint

ASJC Scopus subject areas

  • Software

Cite this

Tong, H., & Lin, C. Y. (2011). Non-negative residual matrix factorization with application to graph anomaly detection. In Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011 (pp. 143-153). (Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011).