Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Multiresolution Analysis and Statistical Thresholding on Dynamic Networks

Raphaël Romero, Tijl De Bie, Nick Heard, Alexander Modell

Abstract

Detecting structural change in dynamic network data has wide-ranging applications. Existing approaches typically divide the data into time bins, extract network features within each bin, and then compare these features over time. This introduces an inherent tradeoff between temporal resolution and the statistical stability of the extracted features. Despite this tradeoff, reminiscent of time-frequency tradeoffs in signal processing, most methods rely on a fixed temporal resolution. Choosing an appropriate resolution parameter is typically difficult and can be especially problematic in domains like cybersecurity, where anomalous behavior may emerge at multiple time scales. We address this challenge by proposing ANIE (Adaptive Network Intensity Estimation), a multi-resolution framework designed to automatically identify the time scales at which network structure evolves, enabling the joint detection of both rapid and gradual changes. Modeling interactions as Poisson processes, our method proceeds in two steps: (1) estimating a low-dimensional subspace of node behavior, and (2) deriving a set of novel empirical affinity coefficients that quantify change in interaction intensity between latent factors and support statistical testing for structural change across time scales. We provide theoretical guarantees for subspace estimation and the asymptotic behavior of the affinity coefficients, enabling model-based change detection. Experiments on synthetic networks show that ANIE adapts to the appropriate time resolution and is able to capture sharp structural changes while remaining robust to noise. Furthermore, applications to real-world data showcase the practical benefits of ANIE's multiresolution approach to detecting structural change over fixed resolution methods.

Multiresolution Analysis and Statistical Thresholding on Dynamic Networks

Abstract

Detecting structural change in dynamic network data has wide-ranging applications. Existing approaches typically divide the data into time bins, extract network features within each bin, and then compare these features over time. This introduces an inherent tradeoff between temporal resolution and the statistical stability of the extracted features. Despite this tradeoff, reminiscent of time-frequency tradeoffs in signal processing, most methods rely on a fixed temporal resolution. Choosing an appropriate resolution parameter is typically difficult and can be especially problematic in domains like cybersecurity, where anomalous behavior may emerge at multiple time scales. We address this challenge by proposing ANIE (Adaptive Network Intensity Estimation), a multi-resolution framework designed to automatically identify the time scales at which network structure evolves, enabling the joint detection of both rapid and gradual changes. Modeling interactions as Poisson processes, our method proceeds in two steps: (1) estimating a low-dimensional subspace of node behavior, and (2) deriving a set of novel empirical affinity coefficients that quantify change in interaction intensity between latent factors and support statistical testing for structural change across time scales. We provide theoretical guarantees for subspace estimation and the asymptotic behavior of the affinity coefficients, enabling model-based change detection. Experiments on synthetic networks show that ANIE adapts to the appropriate time resolution and is able to capture sharp structural changes while remaining robust to noise. Furthermore, applications to real-world data showcase the practical benefits of ANIE's multiresolution approach to detecting structural change over fixed resolution methods.

Paper Structure

This paper contains 32 sections, 5 theorems, 54 equations, 13 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. Multiresolution Change Detection in Dynamic Networks
  4. A Low-Rank Poisson Process Model
  5. Change Detection as an Intensity Estimation Problem
  6. ANIE : Adaptive Network Intensity Estimation
  7. Function Spaces and Basis Decomposition
  8. First stage: Low-Rank Decomposition
  9. Second stage: Denoising through statistical thresholding
  10. Parameter Selection and Computational Efficiency
  11. Experiments
  12. Intensity Estimation on Synthetic Datasets
  13. Case Study: Multi-scale Anomaly Detection on the UCI Messages Dataset
  14. Discussion and Conclusion
  15. Full algorithm
  16. ...and 17 more sections

Key Result

Theorem 4.1

Suppose that $\mathbb{Y}\sim COSIP({\mathbf{U}}, \mathbb{S})$ and that there exists a fixed matrix-function $\mathbf{R}(t)=\sum_{b=1}^{B} {\mathbf{C}}^{b}\phi^b(t) \in \mathbb{R}^{D \times D}$, and a sparsity factor $\rho_N \leq 1$ satisfying $N\rho_N = \omega(\log^3(N))$, such that $\mathbf{S}(t) : Then, there exists an orthogonal matrix $\mathbf{Q}$ such that

Figures (13)

  • Figure 2: Comparison of intensity estimation methods on ER-blocks and SBM datasets. The first two rows show the estimated intensity functions for different methods, while the last row shows the MISE vs. number of nodes for both datasets.
  • Figure 3: Comparison of anomaly detection methods on the UCI dataset. Left column show respectively (a) message count over time, (b) LAD anomaly score huangLaplacianChangePoint2024, and (c) Tensorsplat koutraTensorSplatSpottingLatent2012. Right column (d) shows the multi-scale anomaly scores from our ANIE method. The two main events identified in panzarasaPatternsDynamicsUsers2009a are highlighted with vertical dashed lines.
  • Figure 4: Intensity functions for the synthetic network models. (a) ER‐blocks uses a piecewise‐constant intensity with abrupt jumps. (b) DSBM distinguishes intra‐community (blue) and inter‐community (orange) intensities, with a mid‐experiment perturbation.
  • Figure 5: Fitting time of ANIE vs number of nodes for different values of $J$.
  • Figure 6: Estimation error vs number of levels for the linear and the thresholded estimator
  • ...and 8 more figures

Theorems & Definitions (8)

  • Definition 3.1: Common Subspace Independent Processes (COSIP)
  • Theorem 4.1: Subspace Estimation Consistency
  • Definition 4.1: Empirical affinity coefficients
  • Theorem 4.2: Asymptotic normality of the empirical affinity coefficients
  • Lemma 1
  • Lemma 2: Corollary 3.12 of bandeira2016sharp
  • Lemma 3: Lyapunov's Central Limit Theorem (CLT)
  • proof