Multi-Aspect Mining and Anomaly Detection for Heterogeneous Tensor Streams

2026-02-04

AI Summary

Existing approaches struggle to effectively model heterogeneous tensor streams comprising both categorical and continuous attributes, and often fail to capture the temporal dynamics of group anomalies due to timestamp discretization. This work proposes HeteroComp, a novel method that, for the first time, unifies the modeling of heterogeneous tensor streams without discretizing timestamps or attributes. By employing a Gaussian process prior, HeteroComp jointly characterizes the distribution of continuous attributes and their temporal evolution, enabling direct probabilistic density estimation. This framework continuously refines latent components that represent underlying groups and their dynamics. Evaluated on real-world datasets, HeteroComp significantly outperforms state-of-the-art methods in group anomaly detection accuracy while maintaining computational complexity independent of the data stream length.

Technology Category

• Machine Learning: Time-Series/Data Streams
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Search and Optimization: Mixed Discrete/Continuous Search

Application Category

• Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Economics, Online Markets and Human Computation: Data quality aspects of human-annotated datasets

Abstract

Analysis and anomaly detection in event tensor streams consisting of timestamps and multiple attributes - such as communication logs(time, IP address, packet length)- are essential tasks in data mining. While existing tensor decomposition and anomaly detection methods provide useful insights, they face the following two limitations. (i) They cannot handle heterogeneous tensor streams, which comprises both categorical attributes(e.g., IP address) and continuous attributes(e.g., packet length). They typically require either discretizing continuous attributes or treating categorical attributes as continuous, both of which distort the underlying statistical properties of the data.Furthermore, incorrect assumptions about the distribution family of continuous attributes often degrade the model's performance. (ii) They discretize timestamps, failing to track the temporal dynamics of streams(e.g., trends, abnormal events), which makes them ineffective for detecting anomalies at the group level, referred to as'group anomalies'(e.g, DoS attacks). To address these challenges, we propose HeteroComp, a method for continuously summarizing heterogeneous tensor streams into'components'representing latent groups in each attribute and their temporal dynamics, and detecting group anomalies. Our method employs Gaussian process priors to model unknown distributions of continuous attributes, and temporal dynamics, which directly estimate probability densities from data. Extracted components give concise but effective summarization, enabling accurate group anomaly detection. Extensive experiments on real datasets demonstrate that HeteroComp outperforms the state-of-the-art algorithms for group anomaly detection accuracy, and its computational time does not depend on the data stream length.

Problem

• heterogeneous tensor streams
• anomaly detection
• group anomalies
• categorical and continuous attributes
• temporal dynamics

Innovation

• heterogeneous tensor streams
• group anomaly detection
• Gaussian process priors
• temporal dynamics
• tensor decomposition