# Anomaly Detection in Large Scale Networks with Latent Space Models

arXiv: https://arxiv.org/abs/1911.05522 · HTML: https://mlsanity.com/paper/1911.05522/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Nov 2019.

## Built on by (most cited first, 4 of 4)

- [Mutually exciting point process graphs for modelling dynamic networks](https://mlsanity.com/paper/2102.06527/) (2021)
- [Designing a reliable lateral movement detector using a graph foundation model](https://mlsanity.com/paper/2504.13527/) (2025)
- [A source separation approach to temporal graph modelling for computer networks](https://mlsanity.com/paper/2303.15950/) (2023)
- [Hybrid Latent-Structural Fusion (HLSF) for Cyber Anomaly Detection](https://mlsanity.com/paper/2607.18479/) (2026)

## Abstract (arXiv)

We develop a real-time anomaly detection algorithm for directed activity on large, sparse networks. We model the propensity for future activity using a dynamic logistic model with interaction terms for sender- and receiver-specific latent factors in addition to sender- and receiver-specific popularity scores; deviations from this underlying model constitute potential anomalies. Latent nodal attributes are estimated via a variational Bayesian approach and may change over time, representing natural shifts in network activity. Estimation is augmented with a case-control approximation to take advantage of the sparsity of the network and reduces computational complexity from O(N2) to O(E), where N is the number of nodes and E is the number of observed edges. We run our algorithm on network event records collected from an enterprise network of over 25,000 computers and are able to identify a red team attack with half the detection rate required of the model without latent interaction terms.