Anomaly detection in streaming networks

1. A computer-implemented method for anomaly detection in streaming networks, the method comprising:

receiving, by a processor, a plurality of vertices and edges from a streaming graph;

generating, by the processor, graph codes for the plurality of vertices and edges;

determining, by the processor, edge codes in real-time responsive to the graph codes;

identifying, by the processor, an anomaly based on a closest cluster distance between edge codes and all current cluster centers;

updating a centroid of a particular cluster C using a temporal clustering feature (TCF) vector defined as a triple, TCF=(n, c, t max ) by:

c

=

λ

old

⁢

∑

i

=

1

n

0

⁢

⁢

x

i

+

λnew

⁢

∑

i

=

1

n

′

⁢

⁢

x

i

′

where n is a total number of data points in the cluster C, c represents the centroid of the cluster C, t max represents a latest timestamp of any point in the cluster C, n′ represents a number of new points in the cluster C, x i represents a current vertex input, and x i ′ represents a new vertex input; and

controlling an operation of a processor-based machine to change a state of the processor-based machine, responsive to the anomaly.

2. The computer-implemented method as recited in claim 1 , wherein the generating step transforms the plurality of vertices and edges into vectors utilizing a skip-gram model.

3. The computer-implemented method as recited in claim 1 , wherein the controlling step turns on an air scrubber in a laboratory environment.

4. The computer-implemented method as recited in claim 1 , wherein the generating step limits a number of vectors employed in generating the graph codes by utilizing a hierarchical softmax or a negative sampling.

5. The computer-implemented method as recited in claim 1 , wherein the controlling step activates security measures.

6. The computer-implemented method as recited in claim 1 , wherein the determining step builds a look-up table for determining the edge codes in real-time.

7. The computer-implemented method as recited in claim 1 , wherein the identifying step includes forming cluster centers of existing edge codes.

8. The computer-implemented method as recited in claim 7 , wherein the forming step includes a temporal clustering feature vector.

9. The computer-implemented method as recited in claim 1 , wherein the identifying step identifies the anomaly when the distance is greater than a threshold distance.

10. The computer-implemented method as recited in claim 1 , wherein the identifying step adds the anomaly to a cluster center closest to the anomaly.

11. A computer program product for anomaly detection in streaming networks, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

receiving, by a processor, a plurality of vertices and edges from a streaming graph;

generating, by the processor, graph codes for the plurality of vertices and edges;

determining, by the processor, edge codes in real-time responsive to the graph codes;

identifying, by the processor, an anomaly based on a closest cluster distance between edge codes and all current cluster centers;

updating a centroid of a particular cluster C using a temporal clustering feature (TCF) vector defined as a triple, TCF=(n, c, t max ) by:

c

=

λ

old

⁢

∑

i

=

1

n

0

⁢

⁢

x

i

+

λnew

⁢

∑

i

=

1

n

′

⁢

⁢

x

i

′

where n is a total number of data points in the cluster C, c represents the centroid of the cluster C, t max represents a latest timestamp of any point in the cluster C, n′ represents a number of new points in the cluster C, x i represents a current vertex input, and x i ′ represents a new vertex input; and

controlling an operation of a processor-based machine to change a state of the processor-based machine, responsive to the anomaly.

12. An anomaly detection system for streaming networks, the anomaly detection system comprising:

a processing system including a processor and memory coupled to the processor, the processing system programmed to:

receive a plurality of vertices and edges from a streaming graph;

generate graph codes for the plurality of vertices and edges;

determine edge codes in real-time responsive to the graph codes;

identify an anomaly based on a closest cluster distance between edge codes and all current cluster centers;

update a centroid of a particular cluster C using a temporal clustering feature (TCF) vector defined as a triple, TCF=(n, c, t max ) by:

c

=

λ

old

⁢

∑

i

=

1

n

0

⁢

⁢

x

i

+

λnew

⁢

∑

i

=

1

n

′

⁢

⁢

x

i

′

where n is a total number of data points in the cluster C, c represents the centroid of the cluster C, t max represents a latest timestamp of any point in the cluster C, n′ represents a number of new points in the cluster C, x i represents a current vertex input, and x i ′ represents a new vertex input; and

control an operation of a processor-based machine to change a state of the processor-based machine, responsive to the anomaly.

13. The anomaly detection system as recited in claim 12 , wherein the processing system is further programmed to employ a skip-gram model.

14. The anomaly detection system as recited in claim 13 , wherein the skip-gram model transforms the plurality of vertices and edges into vectors.

15. The anomaly detection system as recited in claim 12 , wherein the processing system is further programmed to employ a hierarchical softmax or a negative sampling.

16. The anomaly detection system as recited in claim 15 , wherein the hierarchical softmax or the negative sampling limit a number of vectors employed in generating the graph codes.

17. The anomaly detection system as recited in claim 12 , wherein the processing system is further programmed to build a look-up table for determining the edge codes in real-time.

18. The anomaly detection system as recited in claim 12 , wherein the processing system is further programmed to form cluster centers of existing edge codes.

19. The anomaly detection system as recited in claim 18 , wherein the processing system is further programmed to employ a temporal clustering feature vector.

20. The anomaly detection system as recited in claim 12 , wherein the processing system is further programmed to identify the anomaly when the distance is greater than a threshold distance.