1. Graph-Based Anomaly Detection
Eiman Alshammari

2. Problem Definition
Why and What … ??

3. Anomaly detection is an area that has received much attention in recent years.
Little work has focused on anomaly detection in graph-based data.
In this project, a new technique for graph-based anomaly detection is introduced .
Clustering technique is applied afterwards to determine the likelihood of successful anomaly detection within graph-based data.
Experimental results is provided using artificially-created data.

4. Nodes represent pages / web pages Edges represent hyperlinks
Represent Web as Graph
page
university
texas
learning
group
projects
subdue
robotics
parallel
hyperlink
work
word
planning
Nodes represent pages / web pages
Edges represent hyperlinks

5. Graph To Subgraphs
Data to Graph
Subgraphs Similarities
Clustering

6. There are many tools to convert Data to graphs.
In an advanced level of the research , these tools will be used 1

7. Graph to Subgraph 1 2 3 5 4
Here I am going to explain to explain what is graph and what are the basic elements of graph: Graph , subgraph vertex, edge 2

8. Given Graph G

9. Step 1

11. M S1 A B C D E F G H I J K L M 1 L D K J A E H C B G I F

12. A B C D E F G H I J K L M 1

13. Step 2
Will be repeated for
each link

14. H A B G C I S2 F J D A B C D E F G H I J K L 1 K E L

15. Subgraphs Similarities
Adjacency Matrices 3

16. Subgraphs SimilaritiesW S W L W L W S
Similar matrices have the same eigenvalues
If they are exactly similar … Isomorphisim X W L

20. Remember
That 1 in the matrix means
An extra link or a missing link

22. Find the minimum difference using the XOR
Similarity
1-(number of 1’s in the composed algorithm)
____________________________________
(number of one’s in S1

23. We define similarity
The similarity threshold will be application-dependent; meaning that its value will be determined according to the performance and safety of the application that the algorithm is embedded into.

24. A Link is anomalous A link is not anomalous
If there exist no similarity between its sub graph and any other sub graphs
A link is not anomalous
If there exist at least one sub graph that allows a similarity >= the assigned similarity

25. Something New… Something Borrowed
Algorithm
Something New… Something Borrowed

26. The algorithm

27. Algorithm & Complexity

29. Did we solve the problem?
Experimental Results
Did we solve the problem?

30. 20 nodes 37 edges

31. 15 nodes – 21 edges

32. Future Direction
Experimental results will be provided using real-world network intrusion data.