Anomalous node detection in networks with communities of different size

Based on two simple mechanisms for establishing and removing links, this paper defines an event-driven model for the anomalous node detection problem. This includes a representation for (i) the tendency of regular nodes to connect with similar others (i.e., establish homophilic relationships); and (ii) the tendency of anomalous nodes to connect to random targets (i.e., establish random connections across the network). Our approach is motivated by the desire to design scalable strategies for detecting signatures of anomalous behavior, using a formal representation to take into account the evolution of network properties. In particular, we assume that regular nodes are distributed across two communities (of different size), and propose an algorithm that identifies anomalous nodes based on both geometric and spectral measures. Our focus is on defining the anomalous detection problem in a mathematical framework and to highlight key challenges when certain topological properties dominate the problem (i.e., in terms of the strength of communities and their size).