{"title": "Subgraph Detection Using Eigenvector L1 Norms", "book": "Advances in Neural Information Processing Systems", "page_first": 1633, "page_last": 1641, "abstract": "When working with network datasets, the theoretical framework of detection theory for Euclidean vector spaces no longer applies. Nevertheless, it is desirable to determine the detectability of small, anomalous graphs embedded into background networks with known statistical properties. Casting the problem of subgraph detection in a signal processing context, this article provides a framework and empirical results that elucidate a detection theory\" for graph-valued data. Its focus is the detection of anomalies in unweighted, undirected graphs through L1 properties of the eigenvectors of the graph\u2019s so-called modularity matrix. This metric is observed to have relatively low variance for certain categories of randomly-generated graphs, and to reveal the presence of an anomalous subgraph with reasonable reliability when the anomaly is not well-correlated with stronger portions of the background graph. An analysis of subgraphs in real network datasets confirms the efficacy of this approach.\"", "full_text": "Subgraph Detection Using Eigenvector L1 Norms\n\nMassachusetts Institute of Technology\n\nMassachusetts Institute of Technology\n\nNadya T. Bliss\n\nLincoln Laboratory\n\nLexington, MA 02420\nnt@ll.mit.edu\n\nBenjamin A. Miller\nLincoln Laboratory\n\nLexington, MA 02420\n\nbamiller@ll.mit.edu\n\nPatrick J. Wolfe\n\nStatistics and Information Sciences Laboratory\n\nHarvard University\n\nCambridge, MA 02138\n\nwolfe@stat.harvard.edu\n\nAbstract\n\nWhen working with network datasets, the theoretical framework of detection the-\nory for Euclidean vector spaces no longer applies. Nevertheless, it is desirable to\ndetermine the detectability of small, anomalous graphs embedded into background\nnetworks with known statistical properties. Casting the problem of subgraph de-\ntection in a signal processing context, this article provides a framework and empir-\nical results that elucidate a \u201cdetection theory\u201d for graph-valued data. Its focus is\nthe detection of anomalies in unweighted, undirected graphs through L1 properties\nof the eigenvectors of the graph\u2019s so-called modularity matrix. This metric is ob-\nserved to have relatively low variance for certain categories of randomly-generated\ngraphs, and to reveal the presence of an anomalous subgraph with reasonable re-\nliability when the anomaly is not well-correlated with stronger portions of the\nbackground graph. An analysis of subgraphs in real network datasets con\ufb01rms the\nef\ufb01cacy of this approach.\n\n1\n\nIntroduction\n\nA graph G = (V, E) denotes a collection of entities, represented by vertices V , along with some\nrelationship between pairs, represented by edges E. Due to this ubiquitous structure, graphs are used\nin a variety of applications, including the natural sciences, social network analysis, and engineering.\nWhile this is a useful and popular way to represent data, it is dif\ufb01cult to analyze graphs in the\ntraditional statistical framework of Euclidean vector spaces.\nIn this article we investigate the problem of detecting a small, dense subgraph embedded into an\nunweighted, undirected background. We use L1 properties of the eigenvectors of the graph\u2019s modu-\nlarity matrix to determine the presence of an anomaly, and show empirically that this technique has\nreasonable power to detect a dense subgraph where lower connectivity would be expected.\nIn Section 2 we brie\ufb02y review previous work in the area of graph-based anomaly detection.\nIn\nSection 3 we formalize our notion of graph anomalies, and describe our experimental regime. In\nSection 4 we give an overview of the modularity matrix and observe how its eigenstructure plays\na role in anomaly detection. Sections 5 and 6 respectively detail subgraph detection results on\nsimulated and actual network data, and in Section 7 we summarize and outline future research.\n\n1\n\n\f2 Related Work\n\nThe area of anomaly detection has, in recent years, expanded to graph-based data [1, 2]. The work of\nNoble and Cook [3] focuses on \ufb01nding a subgraph that is dissimilar to a common substructure in the\nnetwork. Eberle and Holder [4] extend this work using the minimum description length heuristic to\ndetermine a \u201cnormative pattern\u201d in the graph from which the anomalous subgraph deviates, basing\n3 detection algorithms on this property. This work, however, does not address the kind of anomaly\nwe describe in Section 3; our background graphs may not have such a \u201cnormative pattern\u201d that\noccurs over a signi\ufb01cant amount of the graph. Research into anomaly detection in dynamic graphs\nby Priebe et al [5] uses the history of a node\u2019s neighborhood to detect anomalous behavior, but this\nis not directly applicable to our detection of anomalies in static graphs.\nThere has been research on the use of eigenvectors of matrices derived from the graphs of interest\nto detect anomalies. In [6] the angle of the principal eigenvector is tracked in a graph representing\na computer system, and if the angle changes by more than some threshold, an anomaly is declared\npresent. Network anomalies are also dealt with in [7], but here it is assumed that each node in the\nnetwork has some highly correlated time-domain input. Since we are dealing with simple graphs,\nthis method is not general enough for our purposes. Also, we want to determine the detectability of\nsmall anomalies that may not have a signi\ufb01cant impact on one or two principal eigenvectors.\nThere has been a signi\ufb01cant amount of work on community detection through spectral properties of\ngraphs [8, 9, 10]. Here we speci\ufb01cally aim to detect small, dense communities by exploiting these\nsame properties. The approach taken here is similar to that of [11], in which graph anomalies are\ndetected by way of eigenspace projections. We here focus on smaller and more subtle subgraph\nanomalies that are not immediately revealed in a graph\u2019s principal components.\n\n3 Graph Anomalies\n\nAs in [12, 11], we cast the problem of detecting a subgraph embedded in a background as one of\ndetecting a signal in noise. Let GB = (V, E) denote the background graph; a network in which\nthere exists no anomaly. This functions as the \u201cnoise\u201d in our system. We then de\ufb01ne the anoma-\nlous subgraph (the \u201csignal\u201d) GS = (VS, ES) with VS \u2282 V . The objective is then to evaluate the\nfollowing binary hypothesis test; to decide between the null hypothesis H0 and alternate hypothesis\nH1:\n\n(cid:26)H0 : The observed graph is \u201cnoise\u201d GB\n\nH1 : The observed graph is \u201csignal+noise\u201d GB \u222a GS.\n\nHere the union of the two graphs GB \u222a GS is de\ufb01ned as GB \u222a GS = (V, E \u222a ES).\nIn our simulations, we formulate our noise and signal graphs as follows. The background graph GB\nis created by a graph generator, such as those outlined in [13], with a certain set of parameters. We\nthen create an anomalous \u201csignal\u201d graph GS to embed into the background. We select the vertex\nsubset VS from the set of vertices in the network and embed GS into GB by updating the edge set\nto be E \u222a ES. We apply our detection algorithm to graphs with and without the embedding present\nto evaluate its performance.\n\n4 The Modularity Matrix and its Eigenvectors\n\nNewman\u2019s notion of the modularity matrix [8] associated with an unweighted, undirected graph G\nis given by\n\nB := A \u2212 1\n\n(1)\nHere A = {aij} is the adjacency matrix of G, where aij is 1 if there is an edge between vertex i\nand vertex j and is 0 otherwise; and K is the degree vector of G, where the ith component of K\nis the number of edges adjacent to vertex i. If we assume that edges from one vertex are equally\nlikely to be shared with all other vertices, then the modularity matrix is the difference between the\n\u201cactual\u201d and \u201cexpected\u201d number of edges between each pair of vertices. This is also very similar to\n\n2|E| KK T .\n\n2\n\n\f(a)\n\n(b)\n\n(c)\n\nFigure 1: Scatterplots of an R-MAT generated graph projected into spaces spanned by two eigenvec-\ntors of its modularity matrix, with each point representing a vertex. The graph with no embedding\n(a) and with an embedded 8-vertex clique (b) look the same in the principal components, but the\nembedding is visible in the eigenvectors corresponding to the 18th and 21st largest eigenvalues (c).\n\nthe matrix used as an \u201cobserved-minus-expected\u201d model in [14] to analyze the spectral properties of\nrandom graphs.\nSince B is real and symmetric, it admits the eigendecomposition B = U\u039bU T , where U \u2208 R|V |\u00d7|V |\nis a matrix where each column is an eigenvector of B, and \u039b is a diagonal matrix of eigenvalues.\nWe denote by \u03bbi, 1 \u2264 i \u2264 |V |, the eigenvalues of B, where \u03bbi \u2265 \u03bbi+1 for all i, and by ui the\nunit-magnitude eigenvector corresponding to \u03bbi.\nNewman analyzed the eigenvalues of the modularity matrix to determine if the graph can be split\ninto two separate communities. As demonstrated in [11], analysis of the principal eigenvectors of\nB can also reveal the presence of a small, tightly-connected component embedded in a large graph.\nThis is done by projecting B into the space of its two principal eigenvectors, calculating a Chi-\nsquared test statistic, and comparing this to a threshold. Figure 1(a) demonstrates the projection of\nan R-MAT Kronecker graph [15] into the principal components of its modularity matrix.\nSmall graph anomalies, however, may not reveal themselves in this subspace. Figure 1(b) demon-\nstrates an 8-vertex clique embedded into the same background graph. In the space of the two prin-\ncipal eigenvectors, the symmetry of the projection looks the same as in Figure 1(a). The foreground\nvertices are not at all separated from the background vertices, and the symmetry of the projection has\nnot changed (implying no change in the test statistic). Considering only this subspace, the subgraph\nof interest cannot be detected reliably; its inward connectivity is not strong enough to stand out in\nthe two principal eigenvectors.\nThe fact that the subgraph is absorbed into the background in the space of u1 and u2, however, does\nnot imply that it is inseparable in general; only in the subspace with the highest variance. Borrowing\nlanguage from signal processing, there may be another \u201cchannel\u201d in which the anomalous signal\nsubgraph can be separated from the background noise. There is in fact a space spanned by two\neigenvectors in which the 8-vertex clique stands out:\nin the space of the u18 and u21, the two\neigenvectors with the largest components in the rows corresponding to VS, the subgraph is clearly\nseparable from the background, as shown in Figure 1(c).\n\n4.1 Eigenvector L1 Norms\n\nPN\nThe subgraph detection technique we propose here is based on L1 properties of the eigenvectors\nof the graph\u2019s modularity matrix, where the L1 norm of a vector x = [x1 \u00b7\u00b7\u00b7 xN ]T is kxk1 :=\ni=1 |xi|. When a vector is closely aligned with a small number of axes, i.e., if |xi| is only large for\na few values of i, then its L1 norm will be smaller than that of a vector of the same magnitude where\nthis is not the case. For example, if x \u2208 R1024 has unit magnitude and only has nonzero components\nalong two of the 1024 axes, then kxk1 \u2264 \u221a\n2. If it has a component of equal magnitude along all\naxes, then kxk1 = 32. This property has been exploited in the past in a graph-theoretic setting, for\n\ufb01nding maximal cliques [16, 17].\nThis property can also be useful when detecting anomalous clustering behavior. If there is a subgraph\nGS that is signi\ufb01cantly different from its expectation, this will manifest itself in the modularity\n\n3\n\n\f(a)\n\n(b)\n\nFigure 2: L1 analysis of modularity matrix eigenvectors. Under the null model, ku18k has the\ndistribution in (a). With an 8-vertex clique embedded, ku18k1 falls far from its average value, as\nshown in (b).\n\nmatrix as follows. The subgraph GS has a set of vertices VS, which is associated with a set of indices\ncorresponding to rows and columns of the adjacency matrix A. Consider the vector x \u2208 {0, 1}N ,\nwhere xi is 1 if vi \u2208 VS and xi = 0 otherwise. For any S \u2286 V and v \u2208 V , let dS(v) denote the\nv\u2208S0 dS(v) and\n\nnumber of edges between the vertex v and the vertex set S. Also, let dS(S0) :=P\n\nd(v) := dV (v). We then have\n\n(cid:18)\n\n2 = X\n\nv\u2208V\n\nkBxk2\n\n(cid:19)2\n\ndVS (v) \u2212 d(v) d(VS)\nd(V )\n\n,\n\n(2)\n\n(3)\n\nxT Bx = dVS (VS) \u2212 d2(VS)\nd(V ) ,\n\nand kxk2 = p|VS|. Note that d(V ) = 2|E|. A natural interpretation of (2) is that Bx repre-\nsents the difference between the actual and expected connectivity to VS across the entire graph,\nexternal degree, this ratio approaches 1 asP\nand likewise (3) represents this difference within the subgraph. If x is an eigenvector of B, then\nof course xT Bx/(kBxk2kxk2) = 1. Letting each subgraph vertex have uniform internal and\nP\n(dVS (v) \u2212 d(v)d(VS)/d(V ))2 is dominated by\n(dVS (v) \u2212 d(v)d(VS)/d(V ))2. This suggests that if VS is much more dense than a typical\nsubset of background vertices, x is likely to be well-correlated with an eigenvector of B. (This be-\ncomes more complicated when there are several eigenvalues that are approximately dVS (VS)/|VS|,\nbut this typically occurs for smaller graphs than are of interest.) Newman made a similar observa-\ntion: that the magnitude of a vertex\u2019s component in an eigenvector is related to the \u201cstrength\u201d with\nwhich it is a member of the associated community. Thus if a small set of vertices forms a commu-\nnity, with few belonging to other communities, there will be an eigenvector well aligned with this\nset, and this implies that the L1 norm of this eigenvector would be smaller than that of an eigenvector\nwith a similar eigenvalue when there is no anomalously dense subgraph.\n\nv /\u2208VS\n\nv\u2208VS\n\n4.2 Null Model Characterization\n\nTo examine the L1 behavior of the modularity matrix\u2019s eigenvectors, we performed the following\nexperiment. Using the R-MAT generator we created 10,000 graphs with 1024 vertices, an average\ndegree of 6 (the result being an average degree of about 12 since we make the graph undirected),\nand a probability matrix\n\n(cid:20) 0.5\n\n0.125\n\nP =\n\n(cid:21)\n\n.\n\n0.125\n0.25\n\nFor each graph, we compute the modularity matrix B and its eigendecomposition. We then compute\nkuik1 for each i and store this value as part of our background statistics. Figure 2(a) demonstrates\nthe distribution of ku18k1. The distribution has a slight left skew, but has a tight variance (a standard\ndeviation of 0.35) and no large deviations from the mean under the null (H0) model.\nAfter compiling background data, we computed the mean and standard deviation of the L1 norms\nfor each ui. Let \u00b5i be the average of kuik1 and \u03c3i be its standard deviation. Using the R-MAT graph\nwith the embedded 8-vertex clique, we observed eigenvector L1 norms as shown in Figure 2(b). In\n\n4\n\n\fthe \ufb01gure we plot kuik1 as well as \u00b5i, \u00b5i + 3\u03c3i and \u00b5i \u2212 3\u03c3i. The vast majority of eigenvectors\nhave L1 norms close to the mean for the associated index. There are very few cases with a deviation\nfrom the mean of greater than 3\u03c3. Note also that \u00b5i decreases with decreasing i. This suggests that\nthe community formation inherent in the R-MAT generator creates components strongly associated\nwith the eigenvectors with larger eigenvalues.\nThe one outlier is u18, which has an L1 norm that is over 10 standard deviations away from the mean.\nNote that u18 is the horizontal axis in Figure 1(c), which by itself provides signi\ufb01cant separation\nbetween the subgraph and the background. Simple L1 analysis would certainly reveal the presence\nof this particular embedding.\n\n5 Embedded Subgraph Detection\n\nWith the L1 properties detailed in Section 4 in mind, we propose the following method to determine\nthe presence of an embedding. Given a graph G, compute the eigendecomposition of its modularity\nmatrix. For each eigenvector, calculate its L1 norm, subtract its expected value (computed from the\nbackground statistics), and normalize by its standard deviation. If any of these modi\ufb01ed L1 norms\nis less than a certain threshold (since the embedding makes the L1 norm smaller), H1 is declared,\nand H0 is declared otherwise. Pseudocode for this detection algorithm is provided in Algorithm 1.\n\nAlgorithm 1 L1SUBGRAPHDETECTION\nInput: Graph G = (V, E), Integer k, Numbers \u20181MIN, \u00b5[1..k], \u03c3[1..k]\n\nB \u2190 MODMAT(G)\nU \u2190 EIGENVECTORS(B, k) hhk eigenvectors of Bii\nfor i \u2190 1 to k do\n\nm[i] \u2190 (kuik1 \u2212 \u00b5[i])/\u03c3[i]\nif m[i] < \u20181MIN then\n\nreturn H1 hhdeclare the presence of an embeddingii\n\nend if\nend for\nreturn H0 hhno embedding foundii\n\nWe compute the eigenvectors of B using eigs in MATLAB, which has running time O(|E|kh +\n|V |k2h + k3h), where h is the number of iterations required for eigs to converge [10]. While\nthe modularity matrix is not sparse, it is the sum of a sparse matrix and a rank-one matrix, so we\ncan still compute its eigenvalues ef\ufb01ciently, as mentioned in [8]. Computing the modi\ufb01ed L1 norms\nand comparing them to the threshold takes O(|V |k) time, so the complexity is dominated by the\neigendecomposition.\nThe signal subgraphs are created as follows. In all simulations in this section, |VS| = 8. For each\nsimulation, a subgraph density of 70%, 80%, 90% or 100% is chosen. For subraphs of this size and\ndensity, the method of [11] does not yield detection performance better than chance. The subgraph\n\nis created by, uniformly at random, selecting the chosen proportion of the(cid:0)8\n\ndetermine where to embed the subgraph into the background, we \ufb01nd all vertices with at most 1, 3\nor 5 edges and select 8 of these at random. The subgraph is then induced on these vertices.\nFor each density/external degree pair, we performed a 10,000-trial Monte Carlo simulation in which\nwe create an R-MAT background with the same parameters as the null model, embed an anomalous\nsubgraph as described above, and run Algorithm 1 with k = 100 to determine whether the embed-\nding is detected. Figure 3 demonstrates detection performance in this experiment. In the receiver\noperating characteristic (ROC), changing the L1 threshold (\u20181MIN in Algorithm 1) changes the po-\nsition on the curve. Each curve corresponds to a different subgraph density. In Figure 3(a), each\nvertex of the subgraph has 1 edge adjacent to the background. In this case the subgraph connectivity\nis overwhelmingly inward, and the ROC curve re\ufb02ects this. Also, the more dense subgraphs are\nmore detectable. When the external degree is increased so that a subgraph vertex may have up to\n3 edges adjacent to the background, we see a decline in detection performance as shown in Figure\n3(b). Figure 3(c) demonstrates the additional decrease in detection performance when the external\nsubgraph connectivity is increased again, to as much as 5 edges per vertex.\n\n(cid:1) possible edges. To\n\n2\n\n5\n\n\f(a)\n\n(b)\n\n(c)\n\nFigure 3: ROC curves for the detection of 8-vertex subgraphs in a 1024-vertex R-MAT background.\nPerformance is shown for subgraphs of varying density when each foreground vertex is connected\nto the background by up to 1, 3 and 5 edges in (a), (b) and (c), respectively.\n\n6 Subgraph Detection in Real-World Networks\n\nTo verify that we see similar properties in real graphs that we do in simulated ones, we analyzed\n\ufb01ve data sets available in the Stanford Network Analysis Package (SNAP) database [18]. Each net-\nwork is made undirected before we perform our analysis. The data sets used here are the Epinions\nwho-trusts-whom graph (Epinions, |V | = 75,879, |E| = 405,740) [19], the arXiv.org collaboration\nnetworks on astrophysics (AstroPh, |V | = 18,722, |E| = 198,050) and condensed matter (CondMat,\n|V |=23,133, |E|=93,439) [20], an autonomous system graph (asOregon, |V |=11,461, |E|=32,730)\n[21] and the Slashdot social network (Slashdot, |V |=82,168, |E|=504,230) [22]. For each graph, we\ncompute the top 110 eigenvectors of the modularity matrix and the L1 norm of each. Comparing\neach L1 sequence to a \u201csmoothed\u201d (i.e., low-pass \ufb01ltered) version, we choose the two eigenvec-\ntors that deviate the most from this trend, except in the case of Slashdot, where there is only one\nsigni\ufb01cant deviation.\nPlots of the L1 norms and scatterplots in the space of the two eigenvectors that deviate most are\nshown in Figure 4. The eigenvectors declared are highlighted. Note that, with the exception of the\nasOregon, we see as similar trend in these networks that we did in the R-MAT simulations, with\nthe L1 norms decreasing as the eigenvalues increase (the L1 trend in asOregon is fairly \ufb02at). Also,\nwith the exception of Slashdot, each dataset has a few eigenvectors with much smaller norms than\nthose with similar eigenvalues (Slashdot decreases gradually, with one sharp drop at the maximum\neigenvalue).\nThe subgraphs detected by L1 analysis are presented in Table 1. Two subgraphs are chosen for each\ndataset, corresponding to the highlighted points in the scatterplots in Figure 4. For each subgraph\nwe list the size (number of vertices), density (internal degree divided by the maximum number of\nedges), external degree, and the eigenvector that separates it from the background. The subgraphs\nare quite dense, at least 80% in each case.\nTo determine whether a detected subgraph is anomalous with respect to the rest of the graph, we\nsample the network and compare the sample graphs to the detected subgraphs in terms of density\nand external degree. For each detected subgraph, we take 1 million samples with the same number\nof vertices. Our sampling method consists of doing a random walk and adding all neighbors of each\nvertex in the path. We then count the number of samples with density above a certain threshold\nand external degree below another threshold. These thresholds are the parenthetical values in the\n4th and 5th columns of Table 1. Note that the thresholds are set so that the detected subgraphs\ncomfortably meet them. The 6th column lists the number of samples out of 1 million that satisfy\nboth thresholds. In each case, far less than 1% of the samples meet the criteria. For the Slashdot\ndataset, no sample was nearly as dense as the two subgraphs we selected by thresholding along the\nprincipal eigenvector. After removing samples that are predominantly correlated with the selected\neigenvectors, we get the parenthetical values in the same column. In most cases, all of the samples\nmeeting the thresholds are correlated with the detected eigenvectors. Upon further inspection, those\nremaining are either correlated with another eigenvector that deviates from the overall L1 trend, or\ncorrelated with multiple eigenvectors, as we discuss in the next section.\n\n6\n\n\f(a) Epinions L1 norms\n\n(b) Epinions scatterplot\n\n(c) AstroPh L1 norms\n\n(d) AstroPh scatterplot\n\n(e) CondMat L1 norms\n\n(f) CondMat scatterplot\n\n(g) asOregon L1 norms\n\n(h) asOregon scatterplot\n\n(i) Slashdot L1 norms\n\n(j) Slashdot scatterplot\n\nFigure 4: Eigenvector L1 norms in real-world network data (left column), and scatterplots of the\nprojection into the subspace de\ufb01ned by the indicated eigenvectors (right column).\n\n7\n\n\fdataset\n\neigenvector\n\nEpinions\nEpinions\nAstroPh\nAstroPh\nCondMat\nCondMat\nasOregon\nasOregon\nSlashdot\nSlashdot\n\nu36\nu45\nu57\nu106\nu29\nu36\nu6\nu32\n\nu1 > 0.08\nu1 > 0.07\n\nsubgraph\n\nsize\n34\n27\n30\n24\n19\n20\n15\n6\n36\n51\n\nsubgraph\n(sample)\ndensity\n\n80% (70%)\n83% (75%)\n100% (90%)\n100% (90%)\n100% (90%)\n83% (75%)\n96% (85%)\n93% (80%)\n95% (90%)\n89% (80%)\n\nsubgraph\n(sample)\n\nexternal degree\n\n721 (1000)\n869 (1200)\n93 (125)\n73 (100)\n2 (50)\n70 (120)\n\n1089 (1500)\n177 (200)\n10570 (\u221e)\n12713 (\u221e)\n\n# samples\nthat meet\nthreshold\n\n46 (0)\n261 (6)\n853 (0)\n944 (0)\n866 (0)\n1596 (0)\n23 (0)\n\n762 (393)\n\n0 (0)\n0 (0)\n\nTable 1: Subgraphs detected by L1 analysis, and a comparison with randomly-sampled subgraphs\nin the same network.\n\nFigure 5: An 8-vertex clique that does not create an anomalously small L1 norm in any eigenvector.\nThe scatterplot looks similar to one in which the subgraph is detectable, but is rotated.\n\n7 Conclusion\n\nIn this article we have demonstrated the ef\ufb01cacy of using eigenvector L1 norms of a graph\u2019s mod-\nularity matrix to detect small, dense anomalous subgraphs embedded in a background. Casting the\nproblem of subgraph detection in a signal processing context, we have provided the intuition behind\nthe utility of this approach, and empirically demonstrated its effectiveness on a concrete example:\ndetection of a dense subgraph embedded into a graph generated using known parameters. In real\nnetwork data we see trends similar to those we see in simulation, and examine outliers to see what\nsubgraphs are detected in real-world datasets.\nFuture research will include the expansion of this technique to reliably detect subgraphs that can be\nseparated from the background in the space of a small number of eigenvectors, but not necessarily\none. While the L1 norm itself can indicate the presence of an embedding, it requires the subgraph to\nbe highly correlated with a single eigenvector. Figure 5 demonstrates a case where considering mul-\ntiple eigenvectors at once would likely improve detection performance. The scatterplot in this \ufb01gure\nlooks similar to the one in Figure 1(c), but is rotated such that the subgraph is equally aligned with\nthe two eigenvectors into which the matrix has been projected. There is not signi\ufb01cant separation in\nany one eigenvector, so it is dif\ufb01cult to detect using the method presented in this paper. Minimizing\nthe L1 norm with respect to rotation in the plane will likely make the test more powerful, but could\nprove computationally expensive. Other future work will focus on developing detectability bounds,\nthe application of which would be useful when developing detection methods like the algorithm\noutlined here.\n\nAcknowledgments\nThis work is sponsored by the Department of the Air Force under Air Force Contract FA8721-05-C-\n0002. Opinions, interpretations, conclusions and recommendations are those of the author and are\nnot necessarily endorsed by the United States Government.\n\n8\n\n\fReferences\n[1] J. Sun, J. Qu, D. Chakrabarti, and C. Faloutsos, \u201cNeighborhood formation and anomaly detec-\n\ntion in bipartite graphs,\u201d in Proc. IEEE Int\u2019l. Conf. on Data Mining, Nov. 2005.\n\n[2] J. Sun, Y. Xie, H. Zhang, and C. Faloutsos, \u201cLess is more: Compact matrix decomposition for\n\nlarge sparse graphs,\u201d in Proc. SIAM Int\u2019l. Conf. on Data Mining, 2007.\n\n[3] C. C. Noble and D. J. Cook, \u201cGraph-based anomaly detection,\u201d in Proc. ACM SIGKDD Int\u2019l.\n\nConf. on Knowledge Discovery and Data Mining, pp. 631\u2013636, 2003.\n\n[4] W. Eberle and L. Holder, \u201cAnomaly detection in data represented as graphs,\u201d Intelligent Data\n\nAnalysis, vol. 11, pp. 663\u2013689, December 2007.\n\n[5] C. E. Priebe, J. M. Conroy, D. J. Marchette, and Y. Park, \u201cScan statistics on enron graphs,\u201d\n\nComputational & Mathematical Organization Theory, vol. 11, no. 3, pp. 229\u2013247, 2005.\n\n[6] T. Id\u00b4e and H. Kashima, \u201cEigenspace-based anomaly detection in computer systems,\u201d in Proc.\n\nKDD \u201904, pp. 440\u2013449, 2004.\n\n[7] S. Hirose, K. Yamanishi, T. Nakata, and R. Fujimaki, \u201cNetwork anomaly detection based on\n\neigen equation compression,\u201d in Proc. KDD \u201909, pp. 1185\u20131193, 2009.\n\n[8] M. E. J. Newman, \u201cFinding community structure in networks using the eigenvectors of matri-\n\nces,\u201d Phys. Rev. E, vol. 74, no. 3, 2006.\n\n[9] J. Ruan and W. Zhang, \u201cAn ef\ufb01cient spectral algorithm for network community discovery and\nits applications to biological and social networks,\u201d in Proc. IEEE Int\u2019l Conf. on Data Mining,\npp. 643\u2013648, 2007.\n\n[10] S. White and P. Smyth, \u201cA spectral clustering approach to \ufb01nding communities in graphs,\u201d in\n\nProc. SIAM Data Mining Conf., 2005.\n\n[11] B. A. Miller, N. T. Bliss, and P. J. Wolfe, \u201cToward signal processing theory for graphs and other\nnon-Euclidean data,\u201d in Proc. IEEE Int\u2019l Conf. on Acoustics, Speech and Signal Processing,\npp. 5414\u20135417, 2010.\n\n[12] T. Mif\ufb02in, \u201cDetection theory on random graphs,\u201d in Proc. Int\u2019l Conf. on Information Fusion,\n\npp. 954\u2013959, 2009.\n\n[13] D. Chakrabarti and C. Faloutsos, \u201cGraph mining: Laws, generators, and algorithms,\u201d ACM\n\nComputing Surveys, vol. 38, no. 1, 2006.\n\n[14] F. Chung, L. Lu, and V. Vu, \u201cThe spectra of random graphs with given expected degrees,\u201d Proc.\n\nof National Academy of Sciences of the USA, vol. 100, no. 11, pp. 6313\u20136318, 2003.\n\n[15] D. Chakrabarti, Y. Zhan, and C. Faloutsos, \u201cR-MAT: A recursive model for graph mining,\u201d in\n\nProc. Fourth SIAM Int\u2019l Conference on Data Mining, vol. 6, pp. 442\u2013446, 2004.\n\n[16] T. S. Motzkin and E. G. Straus, \u201cMaxima for graphs and a new proof of a theorem of Tur\u00b4an,\u201d\n\nCanad. J. Math., vol. 17, pp. 533\u2013540, 1965.\n\n[17] C. Ding, T. Li, and M. I. Jordan, \u201cNonnegative matrix factorization for combinatorial opti-\nmization: Spectral clustering, graph matching, and clique \ufb01nding,\u201d in Proc. IEEE Int\u2019l Conf.\non Data Mining, pp. 183\u2013192, 2008.\n\n[18] J. Leskovec, \u201cStanford network analysis package.\u201d http://snap.stanford.edu.\n[19] M. Richardson, R. Agrawal, and P. Domingos, \u201cTrust management for the semantic web,\u201d in\n\nProc. ISWC, 2003.\n\n[20] J. Leskovec, J. Kleinberg, and C. Faloutsos, \u201cGraph evolution: Densi\ufb01cation and shinking\n\ndiameters,\u201d ACM Trans. on Knowledge Discovery from Data, vol. 1, no. 1, 2007.\n\n[21] J. Leskovec, J. Kleinberg, and C. Faloutsos, \u201cGraphs over time: Densi\ufb01cation laws, shinking\n\ndiameters and possible explanations,\u201d in Proc. KDD \u201905, 2005.\n\n[22] J. Leskovec, K. Lang, A. Dasgupta, and M. Mahoney, \u201cCommunity structure in large networks:\nNatural cluster sizes and the absence of large well-de\ufb01ned clusters.\u201d arXiv.org:0810.1355,\n2008.\n\n9\n\n\f", "award": [], "sourceid": 954, "authors": [{"given_name": "Benjamin", "family_name": "Miller", "institution": null}, {"given_name": "Nadya", "family_name": "Bliss", "institution": null}, {"given_name": "Patrick", "family_name": "Wolfe", "institution": null}]}