Using Scan-Statistical Correlations for Network Change Analysis

Abstract

Network change detection is a common prerequisite for identifying anomalous behaviours in computer, telecommunication, enterprise and social networks. Data mining of such networks often focus on the most significant change only. However, inspecting large deviations in isolation can lead to other important and associated network behaviours to be overlooked. This paper proposes that changes within the network graph be examined in conjunction with one another, by employing correlation analysis to supplement network-wide change information. Amongst other use-cases for mining network graph data, the analysis examines if multiple regions of the network graph exhibit similar degrees of change, or is it considered anomalous for a local network change to occur independently. Building upon Scan-Statistics network change detection, we extend the change detection technique to correlate localised network changes. Our correlation inspired techniques have been deployed for use on various networks internally. Using real-world datasets, we demonstrate the benefits of our correlation change analysis.