Change detection in a dynamic stream of attributed networks

While anomaly detection in static networks has been extensively studied, only recently have researchers focused on dynamic networks. This trend is mainly due to the capacity of dynamic networks to represent complex physical, biological, cyber, and social systems. This article proposes a new methodology for modeling and monitoring dynamic attributed networks for quick detection of temporal changes in network structures. In this methodology, the generalized linear model (GLM) is used to model static attributed networks. This model is then combined with a state transition equation to capture the dynamic behavior of the system. Extended Kalman filter (EKF) is used as an online, recursive inference procedure to predict and update network parameters over time. In order to detect changes in the underlying mechanism of edge formation, prediction residuals are monitored through an exponentially weighted moving average (EWMA) control chart. The proposed modeling and monitoring procedure is examined through simulations for attributed binary and weighted networks. Email communication data from the Enron corporation is used as a case study to show how the method can be applied in real-world problems.