Anomaly Detection And Analysis For Nodes Behaviors In Social Network

The anomaly detection for nodes behaviors in social network is an important part of social network evolution analysis.It not only has an important theoretical value on the formation mechanism of social network,evolution analysis and behavior prediction,but also has extensive using value in network security,national security and financial control.However,most of the current researches have detected the anomalous node behaviors only from the node topology perspective,and lacked the modeling and anomaly analysis for node behavior evolution.Moreover,most of them use single anomaly detection method for node anomaly detection,while single anomaly detection method may fail to reliably identify the anomalies of interest to a given application,and its stability and adaptability are poor.In order to solve the above problems,the main work of this paper is as follows.(1)This paper expounded what is anomalous behavior of nodes in static network and dynamic network,and proposed a framework for analyzing nodes' anomalous behavior in social network.Aiming at the detection of outliers in static networks,this paper proposed a new framework for community discovery and anomalous node detection,COFNC,which combined network embedding and clustering.Specifically,COFNC used network embedding method to convert nodes in static networks into points in high dimensional space,and proposed a density-ordered tree partition algorithm to detect community structure and anomalous node.(2)For the dynamic network,this paper used the hidden variable model to model the evolution of the nodes behaviors and transformed the nodes behaviors into the multidimensional time series.Therefore,the anomaly detection problem of the nodes behaviors was transformed into the anomaly detection problem in the multidimensional time series.This paper also proposed an Rank-based Ensemble Anomaly Detection method(READ)to detect anomalous behavior of node,and suggested a strategy to visualize nodes behaviors.(3)With the evolution of the network,we can obtained some ground-truth dataset for nodes' normal or abnormal behaviors by hand marking.Based on the ground-truth dataset,this paper employed the stochastic model to calculate the anomaly preference value of node behavior,and proposed a Score-based Ensemble Anomaly Detection method with anomaly Preference(SEADP)to improve the effect of node anomaly detection.By taking anomaly preference value of node behavior as the goal,SEADP utilized a vertical sort strategy to select some anomaly detection methods as the ensemble detectors,and applied a score-based ensemble method to aggregate these detectors.(4)The vector autoregressive model was used to predict the nodes behaviors.Considering the nodes' anomalous behavior data may affect the model prediction accuracy,this paper first reconstructed the anomalous behavior data by using random forest algorithm,then the vector autoregressive model and monte carlo simulation method are used to predict the behavior of nodes.We tested the performance of the anomaly detection algorithm by using Enron network data and simulation data,and found that the ensemble anomaly detection method,READ,was better than the single anomaly detection method for nodes' anomalous behaviors detection,and it could effectively achieve different types of anomaly detection.Furthermore,Compared to READ,SEADP,using the prior knowledge,can significantly improved the accuracy of anomaly detection for nodes behaviors.In addition,it was found that the vector autoregressive model can improve the accuracy of predicting the behavior of the nodes after reconstructing the nodes' anomalous behaviors dataset.