Anomaly Detection in Time Series of Graphs using ARMA Processes

There are many situations in which indicators of changes or anomalies in communication networks can be helpful, e.g. in the identification of faults. A dynamic communication network is characterised as a series of graphs with vertices representing IP addresses and edges representing information exchange between these entities weighted by packets sent. Ten graph distance metrics are used to create time series of network changes by sequentially comparing graphs from adjacent periods. These time series are individually modelled as univariate autoregressive moving average (ARMA) processes. Each time series is assessed on the ability of the best ARMA model of it to identify anomalies through residual thresholding.