# Isconna: Streaming Anomaly Detection with Frequency and Patterns

arXiv: https://arxiv.org/abs/2104.01632 · HTML: https://mlsanity.com/paper/2104.01632/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 60 references that are in the map.
- First posted on arXiv 4 Apr 2021.

## Builds on (most cited first, 10 of 10)

- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [Motifs in Temporal Networks](https://mlsanity.com/paper/1612.09259/) (2016)
- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](https://mlsanity.com/paper/1911.04464/) (2019)
- [F-FADE: Frequency Factorization for Anomaly Detection in Edge Streams](https://mlsanity.com/paper/2011.04723/) (2020)
- [Fast and Accurate Anomaly Detection in Dynamic Graphs with a Two-Pronged Approach](https://mlsanity.com/paper/2011.13085/) (2020)
- [DenseAlert: Incremental Dense-Subtensor Detection in Tensor Streams](https://mlsanity.com/paper/1706.03374/) (2017)
- [Mining Persistent Activity in Continually Evolving Networks](https://mlsanity.com/paper/2006.15410/) (2020)
- [Flow Motifs in Interaction Networks](https://mlsanity.com/paper/1810.08408/) (2018)
- [Mining Frequent Patterns in Evolving Graphs](https://mlsanity.com/paper/1809.00394/) (2018)

## Built on by (most cited first, 1 of 1)

- [Anomaly Detection in Graph Structured Data: A Survey](https://mlsanity.com/paper/2405.06172/) (2024)

## Abstract (arXiv)

An edge stream is a common form of presentation of dynamic networks. It can evolve with time, with new types of nodes or edges being continuously added. Existing methods for anomaly detection rely on edge occurrence counts or compare pattern snippets found in historical records. In this work, we propose Isconna, which focuses on both the frequency and the pattern of edge records. The burst detection component targets anomalies between individual timestamps, while the pattern detection component highlights anomalies across segments of timestamps. These two components together produce three intermediate scores, which are aggregated into the final anomaly score. Isconna does not actively explore or maintain pattern snippets; it instead measures the consecutive presence and absence of edge records. Isconna is an online algorithm, it does not keep the original information of edge records; only statistical values are maintained in a few count-min sketches (CMS). Isconna's space complexity O(rc) is determined by two user-specific parameters, the size of CMSs. In worst case, Isconna's time complexity can be up to O(rc), but it can be amortized in practice. Experiments show that Isconna outperforms five state-of-the-art frequency- and/or pattern-based baselines on six real-world datasets with up to 20 million edge records.