Generating Local Explanations of Network Anomalies via Score Decomposition

An important application in network analysis is the detection of anomalous events in a network time series. These events could merely be times of interest in the network timeline or they could be examples of malicious activity or network malfunction. Once a set of events are identified by the anomaly detection algorithm, a more detailed examination of the graph at these times can reveal important details about the behavior of the network. In this paper we use the score decomposition of the global anomaly score of reported anomalies in several dynamic networks to identify the regions of most anomalous behavior and provide interpretations as to the nature of the anomalous events. We also define a new version of the Graph Edit Distance and Clustering Coefficient statistics which are better at finding the local explanations for anomalous behavior.