Abstract Anomalous connected subgraph detection has been widely used in multiple scenarios, such as botnet detection, fraud detection and event detection. Nevertheless, the huge search space makes a serious computational challenge. Moreover, the anomalous connected subgraph detection becomes much harder when the networks involve a large number of attributes and become the multi-attributed networks. With the multi-attributed characteristic, most existing approaches are unable to solve this problem effectively and efficiently since it involves the anomalous connected subgraph detection and attributes selection simultaneously. In view of this, this paper proposes a general framework, namely multi-attributed anomalous subgraphs and attributes scanning (MASA), to solve this problem in multi-attributed networks. We formulate and optimize a great number of complicated nonparametric scan statistic functions that are employed to measure the joint anomalousness of the connected subgraphs and the corresponding subset of attributes in multi-attributed networks. More specifically, we first propose to transform each formulated nonparametric scan statistic function into a set of sub-functions with the theoretical analysis. Then using techniques of the tree approximation priors and the dynamic algorithms, an efficient approximation algorithm is presented to solve each transformed sub-function. Finally, with three real-world datasets from different domains, we conduct extensive experimental evaluations to demonstrate the effectiveness and efficiency of the proposed approach.

中文翻译：

---

MASA：一种高效的多属性网络异常检测框架

摘要 异常连通子图检测已广泛应用于僵尸网络检测、欺诈检测和事件检测等多种场景。然而，巨大的搜索空间带来了严峻的计算挑战。此外，当网络涉及大量属性并成为多属性网络时，异常连接子图的检测变得更加困难。由于多属性特性，现有的大多数方法都无法有效地解决这个问题，因为它同时涉及异常连通子图检测和属性选择。鉴于此，本文提出了一个通用框架，即多属性异常子图和属性扫描（MASA），以解决多属性网络中的这一问题。我们制定并优化了大量复杂的非参数扫描统计函数，用于测量多属性网络中连接子图和相应属性子集的联合异常度。更具体地说，我们首先建议通过理论分析将每个制定的非参数扫描统计函数转换为一组子函数。然后利用树逼近先验技术和动态算法，提出了一种有效的逼近算法来求解每个变换后的子函数。最后，使用来自不同领域的三个真实世界数据集，我们进行了广泛的实验评估，以证明所提出方法的有效性和效率。