{"id":"https://openalex.org/W2284900416","doi":"https://doi.org/10.1145/2939672.2939783","title":"Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphs","display_name":"Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphs","publication_year":2016,"publication_date":"2016-08-08","ids":{"openalex":"https://openalex.org/W2284900416","doi":"https://doi.org/10.1145/2939672.2939783","mag":"2284900416"},"language":"en","primary_location":{"id":"doi:10.1145/2939672.2939783","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2939672.2939783","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2939783&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"http://dl.acm.org/ft_gateway.cfm?id=2939783&type=pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023417624","display_name":"Emaad Manzoor","orcid":"https://orcid.org/0000-0003-3187-9719"},"institutions":[{"id":"https://openalex.org/I59553526","display_name":"Stony Brook University","ror":"https://ror.org/05qghxh33","country_code":"US","type":"education","lineage":["https://openalex.org/I59553526"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Emaad Manzoor","raw_affiliation_strings":["Stony Brook University, Stony Brook, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Stony Brook University, Stony Brook, NY, USA","institution_ids":["https://openalex.org/I59553526"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047323242","display_name":"Sadegh M. Milajerdi","orcid":"https://orcid.org/0000-0002-1236-6275"},"institutions":[{"id":"https://openalex.org/I39422238","display_name":"University of Illinois Chicago","ror":"https://ror.org/02mpq6x41","country_code":"US","type":"education","lineage":["https://openalex.org/I39422238"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sadegh M. Milajerdi","raw_affiliation_strings":["University of Illinois at Chicago, Chicago, IL, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Chicago, Chicago, IL, USA","institution_ids":["https://openalex.org/I39422238"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5001634795","display_name":"Leman Akoglu","orcid":null},"institutions":[{"id":"https://openalex.org/I59553526","display_name":"Stony Brook University","ror":"https://ror.org/05qghxh33","country_code":"US","type":"education","lineage":["https://openalex.org/I59553526"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Leman Akoglu","raw_affiliation_strings":["Stony Brook University, Stony Brook, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Stony Brook University, Stony Brook, NY, USA","institution_ids":["https://openalex.org/I59553526"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":279,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1035","last_page":"1044"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.711269736289978},{"id":"https://openalex.org/keywords/bounded-function","display_name":"Bounded function","score":0.6416854858398438},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6302785277366638},{"id":"https://openalex.org/keywords/streaming-algorithm","display_name":"Streaming algorithm","score":0.6040734648704529},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5873332023620605},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.5187202095985413},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.49502986669540405},{"id":"https://openalex.org/keywords/similarity","display_name":"Similarity (geometry)","score":0.4481675326824188},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.44224315881729126},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.43362870812416077},{"id":"https://openalex.org/keywords/streaming-data","display_name":"Streaming data","score":0.4215397238731384},{"id":"https://openalex.org/keywords/upper-and-lower-bounds","display_name":"Upper and lower bounds","score":0.24193024635314941},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.23092791438102722},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.2044588327407837},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1661854386329651},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.12419933080673218}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.711269736289978},{"id":"https://openalex.org/C34388435","wikidata":"https://www.wikidata.org/wiki/Q2267362","display_name":"Bounded function","level":2,"score":0.6416854858398438},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6302785277366638},{"id":"https://openalex.org/C187166803","wikidata":"https://www.wikidata.org/wiki/Q2835831","display_name":"Streaming algorithm","level":3,"score":0.6040734648704529},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5873332023620605},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.5187202095985413},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.49502986669540405},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.4481675326824188},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.44224315881729126},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.43362870812416077},{"id":"https://openalex.org/C2777611316","wikidata":"https://www.wikidata.org/wiki/Q39045282","display_name":"Streaming data","level":2,"score":0.4215397238731384},{"id":"https://openalex.org/C77553402","wikidata":"https://www.wikidata.org/wiki/Q13222579","display_name":"Upper and lower bounds","level":2,"score":0.24193024635314941},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.23092791438102722},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.2044588327407837},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1661854386329651},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.12419933080673218},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C78458016","wikidata":"https://www.wikidata.org/wiki/Q840400","display_name":"Evolutionary biology","level":1,"score":0.0},{"id":"https://openalex.org/C94625758","wikidata":"https://www.wikidata.org/wiki/Q7163","display_name":"Politics","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2939672.2939783","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2939672.2939783","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2939783&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/2939672.2939783","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2939672.2939783","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2939783&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.4300000071525574,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G4037859840","display_name":null,"funder_award_id":"FA8650-15-C-7561","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G5051192394","display_name":null,"funder_award_id":"FA8650-15-C","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G5512748762","display_name":"CAREER: A General Framework for Methodical and Interpretable Anomaly Mining","funder_award_id":"1452425","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6537471220","display_name":"III: Medium: Collaborative Research: Collective Opinion Fraud Detection: Identifying and Integrating Cues from Language, Behavior, and Networks","funder_award_id":"1408287","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6671297155","display_name":null,"funder_award_id":"CAREER","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320308204","display_name":"Northrop Grumman","ror":"https://ror.org/05kewds18"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2284900416.pdf","grobid_xml":"https://content.openalex.org/works/W2284900416.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W207664590","https://openalex.org/W1585089995","https://openalex.org/W1616338336","https://openalex.org/W1736726159","https://openalex.org/W1769426539","https://openalex.org/W1904633530","https://openalex.org/W1975844474","https://openalex.org/W1976625337","https://openalex.org/W1980331354","https://openalex.org/W1985623009","https://openalex.org/W1987971958","https://openalex.org/W2012833704","https://openalex.org/W2016289973","https://openalex.org/W2032280284","https://openalex.org/W2068888615","https://openalex.org/W2071744657","https://openalex.org/W2089554624","https://openalex.org/W2108077658","https://openalex.org/W2110578405","https://openalex.org/W2112429379","https://openalex.org/W2124387466","https://openalex.org/W2132069633","https://openalex.org/W2133434765","https://openalex.org/W2136997350","https://openalex.org/W2142498761","https://openalex.org/W2147620601","https://openalex.org/W2147717514","https://openalex.org/W2150516767","https://openalex.org/W2150574820","https://openalex.org/W2155640700","https://openalex.org/W2163557584","https://openalex.org/W2296719434","https://openalex.org/W2398390357","https://openalex.org/W2405035562","https://openalex.org/W2911738047","https://openalex.org/W2963486145","https://openalex.org/W3037345322","https://openalex.org/W4206152408","https://openalex.org/W4214926737","https://openalex.org/W4388297583"],"related_works":["https://openalex.org/W2241126753","https://openalex.org/W4297797952","https://openalex.org/W1824789409","https://openalex.org/W4210578014","https://openalex.org/W2991654599","https://openalex.org/W2900687907","https://openalex.org/W201138236","https://openalex.org/W3002138439","https://openalex.org/W3122033752","https://openalex.org/W3111077521"],"abstract_inverted_index":{"Given":[0],"a":[1,47,68,96,100,112],"stream":[2],"of":[3,9,84,99],"heterogeneous":[4,73],"graphs":[5,74,78],"containing":[6],"different":[7],"types":[8],"nodes":[10],"and":[11,30,62,108],"edges,":[12],"how":[13],"can":[14],"we":[15],"spot":[16],"anomalous":[17],"ones":[18],"in":[19,35,56],"real-time":[20],"while":[21],"consuming":[22],"bounded":[23,116],"memory?":[24],"This":[25,91],"problem":[26],"is":[27,103],"motivated":[28],"by":[29],"generalizes":[31],"from":[32],"its":[33],"application":[34],"security":[36],"to":[37,95,106,111],"host-level":[38],"advanced":[39],"persistent":[40],"threat":[41],"(APT)":[42],"detection.":[43],"We":[44,66],"propose":[45],"StreamSpot,":[46],"clustering":[48],"based":[49,79],"anomaly":[50],"detection":[51],"approach":[52],"that":[53,75,118],"addresses":[54],"challenges":[55],"two":[57,77],"key":[58],"fronts:":[59],"(1)":[60],"heterogeneity,":[61],"(2)":[63],"streaming":[64],"nature.":[65],"introduce":[67],"new":[69],"similarity":[70],"function":[71,92],"for":[72],"compares":[76],"on":[80],"their":[81],"relative":[82],"frequency":[83],"local":[85],"substructures,":[86],"represented":[87],"as":[88],"short":[89],"strings.":[90],"lends":[93],"itself":[94],"vector":[97],"representation":[98],"graph,":[101],"which":[102],"(a)":[104],"fast":[105],"compute,":[107],"(b)":[109],"amenable":[110],"sketched":[113],"version":[114],"with":[115],"size":[117],"preserves":[119],"similarity.":[120]},"counts_by_year":[{"year":2026,"cited_by_count":28},{"year":2025,"cited_by_count":63},{"year":2024,"cited_by_count":45},{"year":2023,"cited_by_count":31},{"year":2022,"cited_by_count":29},{"year":2021,"cited_by_count":27},{"year":2020,"cited_by_count":20},{"year":2019,"cited_by_count":16},{"year":2018,"cited_by_count":14},{"year":2017,"cited_by_count":5},{"year":2016,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}