Multiresolution Analysis and Statistical Thresholding on Dynamic Networks

2025-06-01

AI Summary

Detecting structural changes in dynamic networks faces a fundamental trade-off between temporal resolution and statistical stability—particularly challenging in cybersecurity, where anomalies often manifest across multiple time scales. To address this, we propose the Adaptive Network Intensity Estimation (ANIE) framework, which overcomes the limitations of fixed-resolution approaches by jointly modeling both rapid bursts and gradual evolution. ANIE innovatively employs a Poisson process to define event-driven, multi-scale temporal segmentation; introduces an empirical affinity coefficient for cross-scale statistical significance testing; and provides theoretical guarantees for latent factor subspace estimation and asymptotic properties of estimated coefficients. Experiments demonstrate that ANIE achieves adaptive resolution and robustness to noise on synthetic data, and significantly outperforms state-of-the-art fixed-resolution methods on real-world cybersecurity datasets.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Reasoning under Uncertainty: Relational Probabilistic Models
• Machine Learning: Time-Series/Data Streams

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Models for Web evolution

Abstract

Detecting structural change in dynamic network data has wide-ranging applications. Existing approaches typically divide the data into time bins, extract network features within each bin, and then compare these features over time. This introduces an inherent tradeoff between temporal resolution and the statistical stability of the extracted features. Despite this tradeoff, reminiscent of time-frequency tradeoffs in signal processing, most methods rely on a fixed temporal resolution. Choosing an appropriate resolution parameter is typically difficult and can be especially problematic in domains like cybersecurity, where anomalous behavior may emerge at multiple time scales. We address this challenge by proposing ANIE (Adaptive Network Intensity Estimation), a multi-resolution framework designed to automatically identify the time scales at which network structure evolves, enabling the joint detection of both rapid and gradual changes. Modeling interactions as Poisson processes, our method proceeds in two steps: (1) estimating a low-dimensional subspace of node behavior, and (2) deriving a set of novel empirical affinity coefficients that quantify change in interaction intensity between latent factors and support statistical testing for structural change across time scales. We provide theoretical guarantees for subspace estimation and the asymptotic behavior of the affinity coefficients, enabling model-based change detection. Experiments on synthetic networks show that ANIE adapts to the appropriate time resolution and is able to capture sharp structural changes while remaining robust to noise. Furthermore, applications to real-world data showcase the practical benefits of ANIE's multiresolution approach to detecting structural change over fixed resolution methods.

Problem

• Detecting structural changes in dynamic networks across varying time scales
• Overcoming tradeoff between temporal resolution and statistical stability
• Identifying rapid and gradual network changes adaptively without fixed resolution

Innovation

• Adaptive multi-resolution framework for dynamic networks
• Poisson process modeling with low-dimensional subspace estimation
• Novel empirical affinity coefficients for change detection