Non-negative residual matrix factorization with application to graph anomaly detection

Hanghang Tong; Ching Yung Lin

doi:10.1137/1.9781611972818.13

Non-negative residual matrix factorization with application to graph anomaly detection

Hanghang Tong, Ching Yung Lin

Arizona State University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

105 Scopus citations

Abstract

Given an IP source-destination traffic network, how do we spot mis-behavioral IP sources (e.g., port-scanner)? How do we find strange users in a user-movie rating graph? Moreover, how can we present the results intuitively so that it is relatively easier for data analysts to interpret? We propose NrMF, a non-negative residual matrix factorization framework, to address such challenges. We present an optimization formulation as well as an effective algorithm to solve it. Our method can naturally capture abnormal behaviors on graphs. In addition, the proposed algorithm is linear wrt the size of the graph therefore it is suitable for large graphs. The experimental results on several data sets validate its effectiveness as well as efficiency.

Original language	English (US)
Title of host publication	Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011
Publisher	Society for Industrial and Applied Mathematics Publications
Pages	143-153
Number of pages	11
ISBN (Print)	9780898719925
DOIs	https://doi.org/10.1137/1.9781611972818.13
State	Published - 2011
Event	11th SIAM International Conference on Data Mining, SDM 2011 - Mesa, AZ, United States Duration: Apr 28 2011 → Apr 30 2011

Publication series

Name	Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011

Other

Other	11th SIAM International Conference on Data Mining, SDM 2011
Country/Territory	United States
City	Mesa, AZ
Period	4/28/11 → 4/30/11

ASJC Scopus subject areas

Software

Access to Document

10.1137/1.9781611972818.13

Cite this

Tong, H., & Lin, C. Y. (2011). Non-negative residual matrix factorization with application to graph anomaly detection. In Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011 (pp. 143-153). (Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011). Society for Industrial and Applied Mathematics Publications. https://doi.org/10.1137/1.9781611972818.13

Non-negative residual matrix factorization with application to graph anomaly detection. / Tong, Hanghang; Lin, Ching Yung.
Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011. Society for Industrial and Applied Mathematics Publications, 2011. p. 143-153 (Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Tong, H & Lin, CY 2011, Non-negative residual matrix factorization with application to graph anomaly detection. in Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011. Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011, Society for Industrial and Applied Mathematics Publications, pp. 143-153, 11th SIAM International Conference on Data Mining, SDM 2011, Mesa, AZ, United States, 4/28/11. https://doi.org/10.1137/1.9781611972818.13

Tong H, Lin CY. Non-negative residual matrix factorization with application to graph anomaly detection. In Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011. Society for Industrial and Applied Mathematics Publications. 2011. p. 143-153. (Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011). doi: 10.1137/1.9781611972818.13

@inproceedings{bb27eef28f1342c8a8b58e0540f8ac44,

title = "Non-negative residual matrix factorization with application to graph anomaly detection",

abstract = "Given an IP source-destination traffic network, how do we spot mis-behavioral IP sources (e.g., port-scanner)? How do we find strange users in a user-movie rating graph? Moreover, how can we present the results intuitively so that it is relatively easier for data analysts to interpret? We propose NrMF, a non-negative residual matrix factorization framework, to address such challenges. We present an optimization formulation as well as an effective algorithm to solve it. Our method can naturally capture abnormal behaviors on graphs. In addition, the proposed algorithm is linear wrt the size of the graph therefore it is suitable for large graphs. The experimental results on several data sets validate its effectiveness as well as efficiency.",

author = "Hanghang Tong and Lin, {Ching Yung}",

year = "2011",

doi = "10.1137/1.9781611972818.13",

language = "English (US)",

isbn = "9780898719925",

series = "Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011",

publisher = "Society for Industrial and Applied Mathematics Publications",

pages = "143--153",

booktitle = "Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011",

note = "11th SIAM International Conference on Data Mining, SDM 2011 ; Conference date: 28-04-2011 Through 30-04-2011",

}

TY - GEN

T1 - Non-negative residual matrix factorization with application to graph anomaly detection

AU - Tong, Hanghang

AU - Lin, Ching Yung

PY - 2011

Y1 - 2011

N2 - Given an IP source-destination traffic network, how do we spot mis-behavioral IP sources (e.g., port-scanner)? How do we find strange users in a user-movie rating graph? Moreover, how can we present the results intuitively so that it is relatively easier for data analysts to interpret? We propose NrMF, a non-negative residual matrix factorization framework, to address such challenges. We present an optimization formulation as well as an effective algorithm to solve it. Our method can naturally capture abnormal behaviors on graphs. In addition, the proposed algorithm is linear wrt the size of the graph therefore it is suitable for large graphs. The experimental results on several data sets validate its effectiveness as well as efficiency.

AB - Given an IP source-destination traffic network, how do we spot mis-behavioral IP sources (e.g., port-scanner)? How do we find strange users in a user-movie rating graph? Moreover, how can we present the results intuitively so that it is relatively easier for data analysts to interpret? We propose NrMF, a non-negative residual matrix factorization framework, to address such challenges. We present an optimization formulation as well as an effective algorithm to solve it. Our method can naturally capture abnormal behaviors on graphs. In addition, the proposed algorithm is linear wrt the size of the graph therefore it is suitable for large graphs. The experimental results on several data sets validate its effectiveness as well as efficiency.

UR - http://www.scopus.com/inward/record.url?scp=84865437346&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84865437346&partnerID=8YFLogxK

U2 - 10.1137/1.9781611972818.13

DO - 10.1137/1.9781611972818.13

M3 - Conference contribution

AN - SCOPUS:84865437346

SN - 9780898719925

T3 - Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011

SP - 143

EP - 153

BT - Proceedings of the 11th SIAM International Conference on Data Mining, SDM 2011

PB - Society for Industrial and Applied Mathematics Publications

T2 - 11th SIAM International Conference on Data Mining, SDM 2011

Y2 - 28 April 2011 through 30 April 2011

ER -

Non-negative residual matrix factorization with application to graph anomaly detection

Abstract

Publication series

Other

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this