{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,20]],"date-time":"2025-09-20T20:28:08Z","timestamp":1758400088568,"version":"3.41.0"},"reference-count":53,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2018,4,16]],"date-time":"2018-04-16T00:00:00Z","timestamp":1523836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100006227","name":"Lawrence Livermore National Laboratory","doi-asserted-by":"crossref","award":["DE-AC52-07NA27344"],"award-info":[{"award-number":["DE-AC52-07NA27344"]}],"id":[{"id":"10.13039\/100006227","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["IIS-1149789, CCF-0939370, IIS-1546488 and IIS-1618690"],"award-info":[{"award-number":["IIS-1149789, CCF-0939370, IIS-1546488 and IIS-1618690"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Knowl. Discov. Data"],"published-print":{"date-parts":[[2018,8,31]]},"abstract":"<jats:p>An important task in network analysis is the detection of anomalous events in a network time series. These events could merely be times of interest in the network timeline or they could be examples of malicious activity or network malfunction. Hypothesis testing using network statistics to summarize the behavior of the network provides a robust framework for the anomaly detection decision process. Unfortunately, choosing network statistics that are dependent on confounding factors like the total number of nodes or edges can lead to incorrect conclusions (e.g., false positives and false negatives). In this article, we describe the challenges that face anomaly detection in dynamic network streams regarding confounding factors. We also provide two solutions to avoiding error due to confounding factors: the first is a randomization testing method that controls for confounding factors, and the second is a set of size-consistent network statistics that avoid confounding due to the most common factors, edge count and node count.<\/jats:p>","DOI":"10.1145\/3185059","type":"journal-article","created":{"date-parts":[[2018,4,18]],"date-time":"2018-04-18T17:21:50Z","timestamp":1524072110000},"page":"1-49","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["Designing Size Consistent Statistics for Accurate Anomaly Detection in Dynamic Networks"],"prefix":"10.1145","volume":"12","author":[{"given":"Timothy La","family":"Fond","sequence":"first","affiliation":[{"name":"Lawrence Livermore National Laboratory"}]},{"given":"Jennifer","family":"Neville","sequence":"additional","affiliation":[{"name":"Purdue University"}]},{"given":"Brian","family":"Gallagher","sequence":"additional","affiliation":[{"name":"Lawrence Livermore National Laboratory"}]}],"member":"320","published-online":{"date-parts":[[2018,4,16]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/335305.335326"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-014-0365-y"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1401890.1401897"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.0908800106"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1150402.1150412"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1080\/0022250X.1996.9990179"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2492517.2492582"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1969.10501069"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1132516.1132556"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.0307625100"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.5555\/1658843.1658862"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.socnet.2005.06.003"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1007\/11790853_45"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0378-8733(99)00015-5"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5465\/amr.2006.21318925"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1541-0072.2012.00459.x"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1002\/ajpa.1330680307"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1080\/10584609.2010.500187"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1111\/1467-9531.00118"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772752"},{"key":"e_1_2_1_21_1","first-page":"45","article-title":"Matching structure and semantics: A survey on graph-based pattern matching","volume":"6","author":"Gallagher B.","year":"2006","unstructured":"B. Gallagher . 2006 . Matching structure and semantics: A survey on graph-based pattern matching . Association for the Advancement of Artificial Intelligence AAAI FS 6 (2006), 45 -- 53 . B. Gallagher. 2006. Matching structure and semantics: A survey on graph-based pattern matching. Association for the Advancement of Artificial Intelligence AAAI FS 6 (2006), 45--53.","journal-title":"Association for the Advancement of Artificial Intelligence AAAI FS"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.5555\/2736754.2736796"},{"key":"e_1_2_1_23_1","unstructured":"C. Gao and J. Lafferty. 2017. Testing for global network structure using small subgraph statistics. arXiv Preprint arXiv:1710.00862 (2017).  C. Gao and J. Lafferty. 2017. Testing for global network structure using small subgraph statistics. arXiv Preprint arXiv:1710.00862 (2017)."},{"key":"e_1_2_1_24_1","first-page":"299","article-title":"Using graph diameter for change detection in dynamic networks","volume":"35","author":"Gaston M.","year":"2006","unstructured":"M. Gaston , M. Kraetzl , and W. Wallis . 2006 . Using graph diameter for change detection in dynamic networks . Australasian Journal of Combinatorics 35 (2006), 299 . M. Gaston, M. Kraetzl, and W. Wallis. 2006. Using graph diameter for change detection in dynamic networks. Australasian Journal of Combinatorics 35 (2006), 299.","journal-title":"Australasian Journal of Combinatorics"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1214\/09-EJS548"},{"key":"e_1_2_1_26_1","unstructured":"R. Hanneman and M. Riddle. 2005. Introduction to Social Network Methods. University of California Riverside.  R. Hanneman and M. Riddle. 2005. Introduction to Social Network Methods. University of California Riverside."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2339530.2339723"},{"key":"e_1_2_1_28_1","doi-asserted-by":"crossref","unstructured":"P. Holme S. Park B. Kim and C. Edling. 2007. Korean university life in a network perspective: Dynamics of a large affiliation network. Physica A: Statistical Mechanics and its Applications 373 (2007) 821--830.  P. Holme S. Park B. Kim and C. Edling. 2007. Korean university life in a network perspective: Dynamics of a large affiliation network. Physica A: Statistical Mechanics and its Applications 373 (2007) 821--830.","DOI":"10.1016\/j.physa.2006.04.066"},{"volume-title":"Proceedings of the SIAM International Conference in Data Mining.","author":"Koutra D.","key":"e_1_2_1_29_1","unstructured":"D. Koutra , J. Vogelstein , and C. Faloutsos . 2013. DELTACON: A principled massive-graph similarity function . In Proceedings of the SIAM International Conference in Data Mining. D. Koutra, J. Vogelstein, and C. Faloutsos. 2013. DELTACON: A principled massive-graph similarity function. In Proceedings of the SIAM International Conference in Data Mining."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/0378-8733(88)90004-4"},{"key":"e_1_2_1_31_1","unstructured":"T. LaFond J. Neville and B. Gallagher. 2014. Anomaly detection in networks with changing trends. In Outlier Detection and Description under Data Diversity at the International Conference on Knowledge Discovery and Data Mining.  T. LaFond J. Neville and B. Gallagher. 2014. Anomaly detection in networks with changing trends. In Outlier Detection and Description under Data Diversity at the International Conference on Knowledge Discovery and Data Mining."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.5555\/3121445.3121464"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1002\/(SICI)1097-0266(199805)19:5<439::AID-DIA952>3.0.CO;2-2"},{"volume-title":"SIAM International Conference on Data Mining.","author":"Mongiov\u0131 M.","key":"e_1_2_1_35_1","unstructured":"M. Mongiov\u0131 , P. Bogdanov , R. Ranca , E. Papalexakis , C. Faloutsos , and A. Singh . 2013. Netspot: Spotting significant anomalous regions on dynamic networks . In SIAM International Conference on Data Mining. M. Mongiov\u0131, P. Bogdanov, R. Ranca, E. Papalexakis, C. Faloutsos, and A. Singh. 2013. Netspot: Spotting significant anomalous regions on dynamic networks. In SIAM International Conference on Data Mining."},{"key":"e_1_2_1_36_1","volume-title":"International Conference on Data Mining","author":"Moreno S.","year":"2013","unstructured":"S. Moreno and J. Neville . 2013. Network hypothesis testing using mixed kronecker product graph models . International Conference on Data Mining ( 2013 ). S. Moreno and J. Neville. 2013. Network hypothesis testing using mixed kronecker product graph models. International Conference on Data Mining (2013)."},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2487575.2487675"},{"key":"e_1_2_1_38_1","first-page":"065103","article-title":"Intensity and coherence of motifs in weighted complex networks","volume":"71","author":"Onnela J.","year":"2005","unstructured":"J. Onnela , J. Saram\u00e4ki , J. Kert\u00e9sz , and K. Kaski . 2005 . Intensity and coherence of motifs in weighted complex networks . Physical Review 71 , 6 (2005), 065103 . J. Onnela, J. Saram\u00e4ki, J. Kert\u00e9sz, and K. Kaski. 2005. Intensity and coherence of motifs in weighted complex networks. Physical Review 71, 6 (2005), 065103.","journal-title":"Physical Review"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1007\/s13174-010-0003-x"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/SocialCom-PASSAT.2012.130"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10588-005-5378-z"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1016\/0378-8733(94)00249-A"},{"key":"e_1_2_1_43_1","doi-asserted-by":"crossref","unstructured":"J. Saram\u00e4ki M. Kivel\u00e4 J.-P. Onnela K. Kaski and J. Kertesz. 2007. Generalizations of the clustering coefficient to weighted complex networks. Physical Review (2007).  J. Saram\u00e4ki M. Kivel\u00e4 J.-P. Onnela K. Kaski and J. Kertesz. 2007. Generalizations of the clustering coefficient to weighted complex networks. Physical Review (2007).","DOI":"10.1103\/PhysRevE.75.027105"},{"key":"e_1_2_1_44_1","unstructured":"P. Shoubridge M. Kraetzl and D. Ray. 1999. Detection of abnormal change in dynamic networks. In Information Decision and Control. 22 2 (1999) 161--170.  P. Shoubridge M. Kraetzl and D. Ray. 1999. Detection of abnormal change in dynamic networks. In Information Decision and Control. 22 2 (1999) 161--170."},{"key":"e_1_2_1_45_1","volume-title":"Non-parametric standard errors and tests for network statistics. Connections","author":"Snijders S.","year":"1999","unstructured":"S. Snijders . 1999. Non-parametric standard errors and tests for network statistics. Connections ( 1999 ), 215--247. S. Snijders. 1999. Non-parametric standard errors and tests for network statistics. Connections (1999), 215--247."},{"key":"e_1_2_1_46_1","volume-title":"Models for longitudinal network data. Models and Methods in Social Network Analysis","author":"Snijders T.","year":"2005","unstructured":"T. Snijders . 2005. Models for longitudinal network data. Models and Methods in Social Network Analysis ( 2005 ). T. Snijders. 2005. Models for longitudinal network data. Models and Methods in Social Network Analysis (2005)."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-9531.2006.00176.x"},{"key":"e_1_2_1_48_1","first-page":"397","article-title":"Modeling the co-evolution of networks and behavior","volume":"31","author":"Snijders T.","year":"2007","unstructured":"T. Snijders , C. Steglich , and M. Schweinberger . 2007 . Modeling the co-evolution of networks and behavior . Longitudinal Models in the Behavioral and Related Sciences 31 , 4 (2007), 397 -- 404 . T. Snijders, C. Steglich, and M. Schweinberger. 2007. Modeling the co-evolution of networks and behavior. Longitudinal Models in the Behavioral and Related Sciences 31, 4 (2007), 397--404.","journal-title":"Longitudinal Models in the Behavioral and Related Sciences"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.socnet.2009.02.004"},{"key":"e_1_2_1_50_1","unstructured":"J. Wang and C. Q. Chiu. 2005. Detecting online auction inflated-reputation behaviors using social network analysis. North American Association for Computational Social and Organizational Sciences (2005).  J. Wang and C. Q. Chiu. 2005. Detecting online auction inflated-reputation behaviors using social network analysis. North American Association for Computational Social and Organizational Sciences (2005)."},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2016.11.010"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1186\/1471-2105-14-94"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10940-010-9105-7"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368161"}],"container-title":["ACM Transactions on Knowledge Discovery from Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3185059","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3185059","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3185059","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:11:25Z","timestamp":1750212685000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3185059"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,4,16]]},"references-count":53,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2018,8,31]]}},"alternative-id":["10.1145\/3185059"],"URL":"https:\/\/doi.org\/10.1145\/3185059","relation":{},"ISSN":["1556-4681","1556-472X"],"issn-type":[{"type":"print","value":"1556-4681"},{"type":"electronic","value":"1556-472X"}],"subject":[],"published":{"date-parts":[[2018,4,16]]},"assertion":[{"value":"2017-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-02-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-04-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}