Detecting Anomalies in Network Communities Based on Structural and Attribute Deviation

Abstract

Anomaly detection in online social networks (OSNs) is an important data mining task that aims to detect unexpected and suspicious users. To enhance anomaly exploration, anomaly ranking is used to assess the degree of user anomaly rather than applying binary detection methods, which depend on identifying users as either anomalous users or normal users. In this paper, we propose a community-based anomaly detection approach called Community ANOMaly detection (CAnom). Our approach aims to detect anomalous users in an OSN community and rank them based on their degree of deviation from normal users. Our approach measures the level of deviation in both the network structure and a subset of the attributes, which is defined by the context selection. The approach consists of two phases. First, we partition the network into communities. Then, we compute the anomaly ranking score, which is composed of a community-structure-based score and an attribute-based score. Experiments on real-world benchmark datasets show that CAnom detects ground-truth groups and outperforms baseline algorithms on accuracy. On synthetic datasets, the results show that CAnom has high AUC and ROC curves even when the attribute number increases; therefore, our model is suitable for today’s applications, where the number of attributes is rising.