Pith. sign in

REVIEW 3 major objections 5 minor 55 references

ARES: Anomaly Recognition Model For Edge Streams

T0 review · 3 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ARES combines a frozen graph embedding with half-space tree scoring to catch anomalous edges in live streams.

desk verdict Plausible engineering combination with a load-bearing formula problem: Eq. (3) looks inverted, and the empirical results hinge on that scoring rule. read the letter →

arxiv 2511.22078 v2 pith:QCRAI67S submitted 2025-11-27 cs.LG

Simone Mungari , Albert Bifet , Giuseppe Manco , Bernhard Pfahringer This is my paper · ORCID
classification cs.LG
keywords anomalydetectionedgestreamstemporalgraphsgraphneuralnetworkshalf-spacetreesunsupervisedlearningcyber-attackstreaming
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that edge anomalies in streaming temporal graphs can be recognized without retraining and without labels by pairing a Graph Neural Network encoder, trained once on an initial snapshot, with Half-Space Trees that partition the encoder's latent space. The resulting model, ARES, is designed to score each incoming edge in bounded (effectively constant) time, and its two variants are evaluated on seven cyber-attack datasets. The claim is that this combination outperforms prior stream-anomaly detectors on almost all of those benchmarks while also giving a simple supervised Gini-index thresholding rule that turns raw scores into decisions. A sympathetic reader would care because cyber-defenses need per-edge decisions on high-volume streams, with neither fresh labels nor expensive retraining.

What carries the argument

The machinery is a two-stage scoring loop. A graph autoencoder built with GraphSAGE, trained once on the initial snapshot, projects nodes into a latent space; edge embeddings are either the average or the difference of the endpoint embeddings. Two Half-Space Trees then randomly partition that latent space and maintain per-leaf counters with a sliding-window update, and the stated anomaly score combines leaf depth and counter mass (Eq. 3), with the final score in Eq. 4 a weighted blend of source, destination, and edge tree responses. This loop is what lets rare latent regions define 'anomalous' without any retraining or labels at scoring time.

What would settle it

Feed a fixed embedding space to the HST so that one leaf receives thousands of points and a neighboring leaf receives one, then compare the anomaly scores assigned to points in each leaf: the claim predicts the sparse leaf scores higher, while a literal reading of Eq. (3) predicts the crowded leaf does. A streaming experiment that introduces a new class of nodes after training would similarly test whether frozen embeddings still separate anomalies.

Watch

Extended reading notes

Core claim

The central claim is that a GraphSAGE autoencoder trained once on the starting graph produces node and edge embeddings that remain useful as the graph evolves, and that two Half-Space Trees—one over node embeddings, one over edge embeddings—can turn those embeddings into reliable anomaly scores for both spike and burst edge anomalies. The final score is a weighted combination of source-node, destination-node, and edge tree scores, and the paper reports that ARES-Static and ARES-Dynamic rank first or second in ROC-AUC and AP on six of seven datasets, with the largest gains on CTU-13 scenarios. The thresholding mechanism selects a cut by minimizing Gini impurity on a small labeled validation s

Load-bearing premise

The results stand only if (a) an HST leaf's score is higher when its region is sparser and (b) embeddings produced by a GNN trained on the initial snapshot remain informative as the stream evolves; the first is contradicted by the formula as printed, and the second is asserted without direct evidence.

Editorial extensions

If this is right

  • Each edge can be scored in bounded time once tree depth, tree count, window size, and GNN hyperparameters are fixed, making the scheme viable for high-volume streaming logs.
  • An encoder trained only on an initial snapshot can, in principle, drive drift-adaptive anomaly scores as long as the graph itself keeps updating the context around each edge.
  • A single architecture covers both spike anomalies (rare individual connections) and burst anomalies (coordinated floods), where earlier methods specialized in one or the other.
  • The Gini-based thresholding rule gives a concrete, small-label way to separate normal from anomalous edges, improving F1 and balanced accuracy relative to tuned competitor thresholds.
  • A static variant that never updates tree counters remains competitive even on DARPA, where nearly sixty percent of edges are anomalous—a regime where simple sparsity-based scoring should struggle.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If Eq. (3) is read literally, a leaf with a larger counter receives a higher score, contradicting the stated principle that sparse leaves are anomalous; the reported rankings therefore depend on the intended or implemented definition of that formula rather than the printed one.
  • The claim that frozen embeddings stay informative under concept drift is plausible but rests on a citation, not on a controlled experiment; testing on streams that introduce entirely new node populations or shifted feature distributions would settle it.
  • The thresholding method is adaptive only within the validation window; the paper's own ISCX2012 example shows the validation and test anomaly rates can differ by orders of magnitude, so the threshold is exposed to exactly the drift the detector is meant to survive.
  • A natural extension, left implicit in the paper, is to make the threshold unsupervised—using the score distribution's dispersion rather than labels—which would bring the whole pipeline back to the no-labels setting the title promises.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. ARES is an unsupervised streaming edge-anomaly detection framework that combines a GraphSAGE autoencoder (trained once on an initial snapshot) with Half-Space Tree (HST) scoring over node/edge embeddings. A weighted score (Eq. 4) merges source-node, destination-node, and edge HST scores; a Gini-based supervised thresholding rule (Eq. 5) is added for F1/B-Accuracy evaluation. The paper reports ROC-AUC/AP results on seven cyber-attack datasets and two trust networks, an ablation study, timing experiments, and a complexity argument that per-edge cost is constant when hyperparameters are bounded.

Significance. If the method is sound, the contribution is practically relevant: it offers a largely unsupervised, streaming-capable edge anomaly detector that reports strong AUC/AP across heterogeneous benchmarks, with publicly available code, multi-seed experiments, ablations, and a stated complexity analysis. The architectural combination of a lightweight GNN encoder with HST is plausible and worth investigating. However, the central scoring formula in Eq. (3) is internally inconsistent with the described sparse-leaf anomaly rule, and this issue is load-bearing for every reported result.

major comments (3)
  1. [§3.2, Eq. (3)] Eq. (3) defines HST(X) = (1/Z) Node.r × 2^{Node.h}, and the text says Node.r is the counter of instances in the leaf. The same paragraph states that data points in sparsely populated subregions are anomalous. These statements are contradictory: a sparse leaf has small Node.r, so Eq. (3) assigns it a lower score, while dense leaves receive higher scores. Taken literally, the anomaly ranking is inverted and the mechanism cannot yield the reported near-perfect AUCs; the problem propagates through Eq. (4). The authors must clarify whether the formula is missing a reciprocal, whether Node.r is not a raw count, or whether the implementation differs from the paper. This is not a presentation issue: Table 1 and all downstream claims depend on the correct sign of the scoring function.
  2. [§3.3 and Section 4] The paper assumes that a GNN trained only on the initial snapshot remains representative for the entire evolving stream. This is asserted with one citation (Coppolillo et al.) and a qualitative argument that G_t is continuously updated, but no experiment demonstrates that the frozen encoder continues to produce embeddings that separate anomalies over time. Since HST scores are computed in this fixed embedding space, drift in the embedding distribution directly affects detection. A controlled experiment (e.g., retraining periodically versus freezing, or measuring embedding drift against anomaly performance) would substantiate the claim.
  3. [Appendix D and §5.1] The thresholding mechanism is acknowledged in Appendix D to be unstable under distribution shift between validation and test: for ISCX2012 the validation set has 99.962% normal edges while the test set has 2.4% anomalous edges, and the paper states this can result in a poor threshold. This materially weakens the RQ2 claims and the F1/B-Accuracy comparisons in Table 2. The authors should quantify how often the Gini threshold degrades performance versus an oracle threshold, and should temper the claim that the thresholding method is 'simple yet effective' in the presence of concept drift.
minor comments (5)
  1. [§3.2] The phrase 'score(e_t) encodes the probability P(l_e_t=1 | e_t, G_t)' is unsupported: HST scores are not calibrated probabilities, and no calibration analysis is provided. Please rephrase as an anomaly score or add calibration evidence.
  2. [§3.2 and Eq. (4)] The notation for weights is inconsistent: the text mentions w_1, w_2, w_3 while Eq. (4) uses w_s, w_d, w_e. Also, the relation to the normalized weights is not defined precisely.
  3. [§5.1 and Table 4] Timing results are reported in seconds but without stating hardware/software configuration in the table caption or the number of repeated runs beyond the main seed setup. Please clarify.
  4. [General] Typos include 'extention' (Section 3.2), 'GraphSage' in Table 15 vs 'GraphSAGE' elsewhere, and 'the author propose' in Section 2. Please proofread.
  5. [Appendix A, Eq. (5)] The hyperparameter list includes 'Weights (1.0, 0.0, 0.0), (0.33, 0.33, 0.33)'; the first tuple appears to place all weight on the edge term, which is inconsistent with Eq. (4) if w_s and w_d correspond to source/destination. Please clarify the intended mapping.

Circularity Check

0 steps flagged · score 2.0 of 10

No material circularity: label-free HST scoring and disclosed thresholding; only a non-load-bearing self-citation.

full rationale

ARES's derivation chain is not circular. The anomaly scores driving the main ROC-AUC/AP results are produced by feeding GraphSAGE embeddings into HSTs (Eqs. 3-4); HST counters are initialized from unlabeled training embeddings and updated without label information, and no target label or test metric appears in those equations. The supervised Gini threshold in Eq. 5 is explicitly confined to the threshold-dependent F1/B-Accuracy analysis, while the primary AUC/AP comparisons are threshold-free, so no fitted parameter is renamed as a prediction. Hyperparameter selection on the validation split is disclosed and is standard model selection, not a circular reduction. The only self-citation (Coppolillo et al. 2025, Section 3.3) supports a design choice—freezing the GNN after the initial snapshot—with an independent intuitive explanation and external references; it is not load-bearing. The apparent inversion in Eq. (3), where larger leaf counters receive larger scores despite the text stating sparse regions are anomalous, is a correctness/reproducibility concern rather than circularity: the scorer is not fitted to labels, so even a sign error would not make the output equivalent to the input.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The paper's contribution is architectural: it combines existing GAE/GraphSAGE, HST, and Gini thresholding. All listed free parameters are tuned on a validation split, so reported test numbers are selected rather than predicted. No new unobserved entities are postulated.

free parameters (5)
  • GNN hyperparameters (layers, hidden channels, output dim, learning rate) = layers 2–6; hidden 16; output 4/8/16; lr 0.001
    Tuned on the validation set; listed in Table 7 and not derived from first principles.
  • HST hyperparameters (number of trees, depth, window size, cache size) = trees 8–64; depth 3–12; window 8–1e6; cache 4–64
    Selected via validation; Tables 9–10 show performance varies substantially with these settings.
  • Score weights w_s, w_d, w_e in Eq. (4) = (1,0,0) or (1/3,1/3,1/3)
    Chosen by validation; Table 11 shows large swings (e.g., UNSW ROC-AUC 0.985 vs 0.657).
  • Edge embedding strategy (Eq. 1 vs Eq. 2) = selected per dataset
    Validation-based; Table 12 shows either strategy can collapse performance (e.g., UNSW Eq. 1 AUC 0.109).
  • Threshold tau* in Eq. (5) = minimizer of weighted Gini impurity on validation labels
    Fit to validation labels; Appendix D acknowledges instability when validation and test anomaly rates differ.
assumptions (4)
  • domain assumption GraphSAGE with node identifiers as features produces meaningful structural embeddings (Hamilton et al. 2017, Corollary 2).
    Invoked in Section 4 to justify the GNN encoder; not re-derived in this paper.
  • domain assumption HST anomaly scores are meaningful only when anomalies are relatively rare.
    Stated in Section 4 following Tan et al. (2011); the authors argue empirically that ARES still works in dense-anomaly settings.
  • ad hoc to paper A GNN trained once on the initial snapshot remains representative for the entire evolving stream.
    Section 3.3 asserts this without direct empirical demonstration, supported only by a heuristic argument and one citation (Coppolillo et al. 2025).
  • domain assumption Each edge can be represented by combining frozen end-node embeddings via averaging or difference.
    Section 3.1; this choice may lose edge-specific temporal information, yet it underlies both HST_e scoring and the final score.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ARES: Anomaly Recognition Model For Edge Streams." pith.science (2026). https://pith.science/paper/QCRAI67S

@misc{pith2026251122078,
  author       = {Pith},
  title        = {Pith review of: ARES: Anomaly Recognition Model For Edge Streams},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QCRAI67S}},
  note         = {Machine review of arXiv:2511.22078}
}
read the original abstract

Many real-world scenarios involving streaming information can be represented as temporal graphs, where data flows through dynamic changes in edges over time. Anomaly detection in this context has the objective of identifying unusual temporal connections within the graph structure. Detecting edge anomalies in real time is crucial for mitigating potential risks. Unlike traditional anomaly detection, this task is particularly challenging due to concept drifts, large data volumes, and the need for real-time response. To face these challenges, we introduce ARES, an unsupervised anomaly detection framework for edge streams. ARES combines Graph Neural Networks (GNNs) for feature extraction with Half-Space Trees (HST) for anomaly scoring. GNNs capture both spike and burst anomalous behaviors within streams by embedding node and edge properties in a latent space, while HST partitions this space to isolate anomalies efficiently. ARES operates in an unsupervised way without the need for prior data labeling. To further validate its detection capabilities, we additionally incorporate a simple yet effective supervised thresholding mechanism. This approach leverages statistical dispersion among anomaly scores to determine the optimal threshold using a minimal set of labeled data, ensuring adaptability across different domains. We validate ARES through extensive evaluations across several real-world cyber-attack scenarios, comparing its performance against existing methods while analyzing its space and time complexity.

Figures

Figures reproduced from arXiv: 2511.22078 by the authors.

Figure 1
Figure 1. Connections among endpoints over time (T1, T2, T3). Fig (a) and (b) depict the typical behavior of connec [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Framework overview. Given a streaming of edges denoted as [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Comparisons of ROC-AUC scores over time among [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: ARES-Static timings on CIC-IDS2017 dataset as the number of edges increases [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 3 linked inside Pith

  1. [1]

    [Ahmed et al.(2016a)] Mohiuddin Ahmed, Abdun Naser Mahmood, and Jiankun Hu. 2016a. A survey of network anomaly detection techniques.J. Netw. Comput. Appl.60 (2016), 19–31. [Ahmed et al.(2016b)] Mohiuddin Ahmed, Abdun Naser Mahmood, and Md. Rafiqul Islam. 2016b. A survey of anomaly detection techniques in financial domain.Future Gener. Comput. Syst.55 (201...

    2016

  2. [5]

    InProcs of the 34th AAAI Conf

    Midas: Microcluster-Based Detector of Anomalies in Edge Streams. InProcs of the 34th AAAI Conf. (AAAI 2020). 3242–3249. [Bhatia et al.(2022)] Siddharth Bhatia, Rui Liu, Bryan Hooi, Minji Yoon, et al

    2020

  3. [7]

    GNN Training Layers 2–6 Channels Hidden: 16; Output: 4, 8, 16 Learning Rate 0.001 Sampling Uniform Aggregation Mean Anomaly Scoring Edge Embedding Eq. 1, Eq. 2 Weights (1.0, 0.0, 0.0), (0.33, 0.33, 0.33) Cache Size 64, 32, 16, 8, 4 Trees 8, 16, 32, 64 Depth 3, 6, 9, 12 HST Window 8, 64, 512, 1024, 2048, 4096, 8192,10 5,10 6 Table 7: Hyperparameters and se...

  4. [12]

    Trees DARPA UNSW-NB15 ISCX2012 CIC-IDS2017 CTU-13Scenario 1 Scenario 10 Scenario 13ROC-AUC AP ROC-AUC AP ROC-AUC AP ROC-AUC AP ROC-AUC AP ROC-AUC AP ROC-AUC AP80.985±0.008 0.991±0.005 0.985±0.002 0.891±0.014 0.992±0.009 0.701±0.247 0.984±0.001 0.806±0.025 0.969±0.004 0.290±0.015 0.938±0.029 0.661±0.101 0.668±0.267 0.118±0.126160.988±0.003 0.993±0.001 0.98...

    2023

  5. [13]

    [Garc´ıa et al.(2014)] Sebasti ´an Garc´ıa, Martin Grill, Jan Stiborek, and Alejandro Zunino

    Fast Graph Representation Learning with PyTorch Geometric.CoRRabs/1903.02428 (2019). [Garc´ıa et al.(2014)] Sebasti ´an Garc´ıa, Martin Grill, Jan Stiborek, and Alejandro Zunino

    arXiv 1903

  6. [16]

    ACM, 855–864.https://doi.org/10.1145/ 2939672.2939754 [Guha et al.(2016)] Sudipto Guha, Nina Mishra, Gourav Roy, and Okke Schrijvers

    arXiv 2016

  7. [17]

    InProceedings of the 33nd International Conference on Machine Learn- ing, ICML 2016, New York City, NY, USA, June 19-24, 2016 (JMLR Workshop and Conference Proceedings, Vol

    Robust Random Cut Forest Based Anomaly Detection on Streams. InProceedings of the 33nd International Conference on Machine Learn- ing, ICML 2016, New York City, NY, USA, June 19-24, 2016 (JMLR Workshop and Conference Proceedings, Vol. 48). 2712–2721. [Hamilton et al.(2017)] William L. Hamilton, Zhitao Ying, and Jure Leskovec

    2016

  8. [19]

    [Kipf and Welling(2016)] Thomas N

    Graph Anomaly Detection With Graph Neural Networks: Current Status and Challenges.IEEE Access10 (2022), 111820–111829. [Kipf and Welling(2016)] Thomas N. Kipf and Max Welling

    2022

Show all 55 references
  1. [20]

    http://arxiv.org/abs/1611.07308 [Komadina et al.(2024)] Adrian Komadina, Mislav Martinic, Stjepan Gros, and Zeljka Mihajlovic

    Variational Graph Auto-Encoders.CoRR(2016). http://arxiv.org/abs/1611.07308 [Komadina et al.(2024)] Adrian Komadina, Mislav Martinic, Stjepan Gros, and Zeljka Mihajlovic

    2016 arXiv

  2. [22]

    SLADE: Detecting Dynamic Anomalies in Edge Streams without Labels via Self-Supervised Learning. InProcs. of the 30th ACM SIGKDD Conf. (KDD 2024). 1506–1517. 13 ARES: Anomaly Recognition Model For Edge StreamsA PREPRINT [Lippmann et al.(1999)] Richard Lippmann, Robert K. Cunnin...

    2024

  3. [24]

    [Liu et al.(2012)] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou

    2012

  4. [26]

    Towards Self-Interpretable Graph-Level Anomaly Detection. InProcs. of the 36th NeurIPS Conf. (NeurIPS 2023).http://papers.nips.cc/paper_files/ paper/2023/hash/1c6f06863df46de009a7a41b41c95cad-Abstract-Conference.html [Ma et al.(2023)] Xiaoxiao Ma, Jia Wu, Shan Xue, et al

    2023

  5. [27]

    A Comprehensive Survey on Graph Anomaly Detec- tion With Deep Learning.IEEE Trans. Knowl. Data Eng.35, 12 (2023), 12012–12038. [Mahoney(2003)] Matthew V . Mahoney

    2023

  6. [29]

    River: machine learning for streaming data in Python.J. Mach. Learn. Res.22 (2021), 110:1–110:8. [Moustafa and Slay(2015)] Nour Moustafa and Jill Slay

    2021

  7. [30]

    InProcs of MilCIS Conf

    UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). InProcs of MilCIS Conf. (MilCIS 2015). 1–6. [Papalexakis et al.(2012)] Evangelos E. Papalexakis, Alex Beutel, and Peter Steenkiste

    2015

  8. [31]

    Network Anomaly Detection Using Co-clustering. InProcs. of the ASONAM Conf. (ASONAM 2012). [Ranshous et al.(2016)] Stephen Ranshous, Steve Harenberg, Kshitij Sharma, and Nagiza F. Samatova

    2012

  9. [32]

    A Scalable Approach for Outlier Detection in Edge Streams Using Sketch-based Approximations. InProcs. of the 2016 SIAM SDM Conf. (SDM 2016). 189–197. [Ranshous et al.(2015)] Stephen Ranshous, Shitian Shen, Danai Koutra, Steve Harenberg, Christos Faloutsos, and Nagiza F. Samatova

    2016

  10. [33]

    [Rida et al.(2021)] Amani Abou Rida, Rabih Amhaz, and Pierre Parrend

    Anomaly detection in dynamic networks: a survey.WIREs Computational Statistics 7, 3 (2015), 223–247. [Rida et al.(2021)] Amani Abou Rida, Rabih Amhaz, and Pierre Parrend

    2015

  11. [34]

    Evaluation of Anomaly Detection for Cybersecurity Using Inductive Node Embedding with Convolutional Graph Neural Networks. InProcs. of the 10th COMPLEX NETWORKS Conf. (COMPLEX NETWORKS 2021, Vol. 1016). 563–574. [Rossi et al.(2020)] Emanuele Rossi, Ben Chamberlain, Fabrizio Fr...

    2021

  12. [35]

    InICML 2020 Workshop on Graph Representation Learning

    Temporal Graph Networks for Deep Learning on Dynamic Graphs. InICML 2020 Workshop on Graph Representation Learning. [Samariya and Thakkar(2023)] Durgesh Samariya and Amit Thakkar

    2020

  13. [36]

    [Sharafaldin et al.(2018)] Iman Sharafaldin, Arash Habibi Lashkari, and Ali A

    A comprehensive survey of anomaly detection algorithms.Annals of Data Science10, 3 (2023), 829–850. [Sharafaldin et al.(2018)] Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani

    2023

  14. [37]

    Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. InProcs. of the 4th ICISSP Conf. (ICISSP 2018). 108–116. [Shiravi et al.(2012)] Ali Shiravi, Hadi Shiravi, Mahbod Tavallaee, and Ali A. Ghorbani

    2018

  15. [38]

    Secur.31, 3 (2012), 357–374

    Toward developing a systematic approach to generate benchmark datasets for intrusion detection.Comput. Secur.31, 3 (2012), 357–374. [Siffer et al.(2017)] Alban Siffer, Pierre-Alain Fouque, Alexandre Termier, and Christine Largou ¨et

    2012

  16. [39]

    Anomaly Detection in Streams with Extreme Value Theory. InProcs. of the 23rd ACM SIGKDD Conf. (KDD 2017). 1067–1075. [Tan et al.(2011)] Swee Chuan Tan, Kai Ming Ting, and Fei Tony Liu

    2017

  17. [41]

    Rethinking Graph Neural Networks for Anomaly Detection. InProcs. of the 39th ICML Conf.21076–21089. [Wang et al.(2017)] Chun Wang, Shirui Pan, Guodong Long, et al

    2017

  18. [42]

    MGAE: Marginalized Graph Autoencoder for Graph Clustering. InProcs. of the ACM CIKM Conf. (CIKM 2017). 889–898. [Wu et al.(2021)] Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S. Yu

    2017

  19. [43]

    [Xie et al.(2011)] Miao Xie, Song Han, Biming Tian, and Sazia Parvin

    A Comprehensive Survey on Graph Neural Networks.IEEE Transactions on Neural Networks and Learning Systems32, 1 (2021), 4–24. [Xie et al.(2011)] Miao Xie, Song Han, Biming Tian, and Sazia Parvin

    2021

  20. [44]

    Anomaly detection in wireless sensor networks: A survey.J. Netw. Comput. Appl.(2011). 14 ARES: Anomaly Recognition Model For Edge StreamsA PREPRINT [Xu et al.(2023)] Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang

    2011

  21. [45]

    Deep Isolation Forest for Anomaly Detection.IEEE Trans. Knowl. Data Eng.35, 12 (2023), 12591–12604. [Yang et al.(2023)] Xue Yang, Enda Howley, and Michael Schukat

    2023

  22. [46]

    [Yu et al.(2018)] Wenchao Yu, Wei Cheng, Charu C

    ADT: Agent-based Dynamic Thresholding for Anomaly Detection.CoRRabs/2312.01488 (2023). [Yu et al.(2018)] Wenchao Yu, Wei Cheng, Charu C. Aggarwal, et al

    2023 arXiv

  23. [47]

    NetWalk: A Flexible Deep Embedding Approach for Anomaly Detection in Dynamic Networks. InProcs. of the 24th ACM SIGKDD (KDD 2018). 2672–2681. [Zambon et al.(2022)] Daniele Zambon, Lorenzo Livi, and Cesare Alippi

    2018

  24. [48]

    Graph iForest: Isolation of anoma- lous and outlier graphs. InProcs. of the IJCNN Conf. (IJCNN 2022). 1–8. [Zhang et al.(2022)] Zikai Zhang, Yidong Li, Wei Wang, Haifeng Song, and Hairong Dong

    2022

  25. [49]

    Malware detection with dynamic evolving graph convolutional networks.Int. J. Intell. Syst.37, 10 (2022), 7261–7280. [Zheng et al.(2019)] Li Zheng, Zhenpeng Li, Jian Li, et al

    2022

  26. [50]

    AddGraph: Anomaly Detection in Dynamic Graph Using Attention-based Temporal GCN. InProcs. of the 28th IJCAI Conf. (IJCAI 2019). 4419–4425. [Zhu et al.(2020)] Dali Zhu, Yuchen Ma, and Yinlong Liu

    2019

  27. [51]

    Anomaly Detection with Deep Graph Autoencoders on Attributed Networks. InProcs. of the IEEE ISCC Conf. (ISCC 2020). 1–6. [Zola et al.(2022)] Francesco Zola, Lander Segurola-Gil, Jan Lukas Bruse, Mikel Galar, and Raul Orduna Urrutia

    2020

  28. [52]

    Secur.115 (2022), 102632

    Network traffic analysis through node behaviour classification: a graph-based approach with temporal dissection and data-level preprocessing.Comput. Secur.115 (2022), 102632. doi:10.1016/J.COSE.2022. 102632 15 ARES: Anomaly Recognition Model For Edge StreamsA PREPRINT A Traini...

    2022 doi

  29. [55]

    Different Node/Edge embedders.GraphSAGE has been shown to produce meaningful representations of nodes and edges that effectively capture the underlying graph structure

    These results further validate HST as a robust and efficient choice for real-time anomaly detection in streaming graph environments. Different Node/Edge embedders.GraphSAGE has been shown to produce meaningful representations of nodes and edges that effectively capture the und...

    1940

  30. [1999]

    InRecent Advances in Intrusion Detection, Second In- ternational Workshop, RAID 1999, West Lafayette, Indiana, USA, September 7-9,

    Results of the DARPA 1998 Offline Intrusion Detection Evaluation. InRecent Advances in Intrusion Detection, Second In- ternational Workshop, RAID 1999, West Lafayette, Indiana, USA, September 7-9,

    1998

  31. [2003]

    Network Traffic Anomaly Detection Based on Packet Bytes. InProcs. of the ACM SAC Conf.SAC Conf., 346–350. [Montiel et al.(2021)] Jacob Montiel, Max Halford, Saulo Martiello Mastelini, et al

    2021

  32. [2005]

    Algorithms55, 1 (2005), 58–75

    An improved data stream sum- mary: the count-min sketch and its applications.J. Algorithms55, 1 (2005), 58–75. [Eswaran and Faloutsos(2018)] Dhivya Eswaran and Christos Faloutsos

    2005

  33. [2011]

    Fast Anomaly Detection for Streaming Data. InProcs. of the 22nd IJCAI Conf. (IJCAI 2011). 1511–1516. [Tang et al.(2022)] Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li

    2011

  34. [2012]

    Isolation-Based Anomaly Detection.ACM Trans. Knowl. Discov. Data(2012). doi:10.1145/2133360.2133363 [Liu et al.(2023)] Yixin Liu, Kaize Ding, Qinghua Lu, et al

    2012

  35. [2013]

    Automated Anomaly Detector Adaptation using Adaptive Threshold Tuning.ACM Trans. Inf. Syst. Secur.15, 4 (2013), 17:1–17:30. 12 ARES: Anomaly Recognition Model For Edge StreamsA PREPRINT [Belth et al.(2020)] Caleb Belth, Xinyi Zheng, and Danai Koutra

    2013

  36. [2014]

    Secur.45 (2014), 100–123

    An empirical com- parison of botnet detection methods.Comput. Secur.45 (2014), 100–123. [Ghafouri et al.(2016)] Amin Ghafouri, Waseem Abbas, Aron Laszka, Yevgeniy V orobeychik, and Xenofon D. Kout- soukos

    2014

  37. [2015]

    Graph based anomaly detection and description: a survey.Data Min. Knowl. Discov.29, 3 (2015), 626–688. [Ali et al.(2013)] Muhammad Qasim Ali, Ehab Al-Shaer, Hassan Khan, and Syed Ali Khayam

    2015

  38. [2016]

    In Procs

    Optimal Thresholds for Anomaly-Based Intrusion Detection in Dynamical Environments. In Procs. of the 7th GameSec Conf. (Lecture Notes in Computer Science, Vol. 9996). 415–434. [Grover and Leskovec(2016)] Aditya Grover and Jure Leskovec

    2016

  39. [2017]

    Inductive Representation Learn- ing on Large Graphs. InProcs. of the 30th NeurIP Conf. (NeurIPS 2017). 1024–1034.https://proceedings. neurips.cc/paper/2017/hash/5dd9db5e033da9c6fb5ba83c7a7ebea9-Abstract.html [Kim et al.(2022)] Hwan Kim, Byung Suk Lee, Won-Yong Shin, and Sungsu Lim

    2017

  40. [2018]

    SedanSpot: Detecting Anomalies in Edge Streams. InProcs. of the IEEE ICDM Conf. (ICDM 2018). 953–958. [Fey and Lenssen(2019)] Matthias Fey and Jan Eric Lenssen

    2018

  41. [2019]

    In2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing (COMITCon)

    Anomaly Detection using Graph Neural Networks. In2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing (COMITCon). 346–350. [Coppolillo et al.(2025)] Erica Coppolillo, Simone Mungari, and et al. Ettore Ritacco

    2025

  42. [2020]

    Mining Persistent Activity in Continually Evolving Networks. InProcs. of the 26th ACM SIGKDD Conf.KDD 2020, 934–944. [Bhatia et al.(2020)] Siddharth Bhatia, Bryan Hooi, Minji Yoon, Kijung Shin, and Christos Faloutsos

    2020

  43. [2021]

    F-FADE: Frequency Factorization for Anomaly Detection in Edge Streams. InProcs. of the 14th ACM WSDM Conf. (WSDM 2021). [Chaudhary et al.(2019)] Anshika Chaudhary, Himangi Mittal, and Anuja Arora

    2021

  44. [2022]

    Real-Time Anomaly Detection in Edge Streams.ACM Trans. Knowl. Discov. Data16, 4 (2022), 75:1–75:22. [Bhatia et al.(2023)] Siddharth Bhatia, Mohit Wadhwa, Kenji Kawaguchi, et al

    2022

  45. [2023]

    Sketch-Based Anomaly Detec- tion in Streaming Graphs. InProcs. of the 29th ACM SIGKDD Conf. (KDD 2023). 93–104. [Breiman et al.(1984)] Leo Breiman, Jerome Friedman, Charles J. Stone, and R.A. Olshen. 1984.Classification and Regression Trees. Chapman and Hall/CRC. [Chang et al....

    2023

  46. [2024]

    [Lee et al.(2024)] Jongha Lee, Sunwoo Kim, and Kijung Shin

    Comparing Threshold Selection Methods for Network Anomaly Detection.IEEE Access12 (2024), 124943–124973. [Lee et al.(2024)] Jongha Lee, Sunwoo Kim, and Kijung Shin

    2024

  47. [2025]

    Algorithmic Drift: A simulation framework to study the effects of recommender systems on user preferences.Inf. Process. Manag. 62, 5 (2025), 104125.https://doi.org/10.1016/j.ipm.2025.104125 [Cormode and Muthukrishnan(2005)] Graham Cormode and S. Muthukrishnan

    2025

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.