# A source separation approach to temporal graph modelling for computer networks

arXiv: https://arxiv.org/abs/2303.15950 · HTML: https://mlsanity.com/paper/2303.15950/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 42 references that are in the map.
- First posted on arXiv 28 Mar 2023.

## Builds on (most cited first, 12 of 12)

- [Neural Message Passing for Quantum Chemistry](https://mlsanity.com/paper/1704.01212/) (2017)
- [Convex optimization](https://mlsanity.com/paper/2106.01946/) (2021)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [DeepWalk: Online Learning of Social Representations](https://mlsanity.com/paper/1403.6652/) (2014)
- [Variational Graph Auto-Encoders](https://mlsanity.com/paper/1611.07308/) (2016)
- [Towards Better Evaluation for Dynamic Link Prediction](https://mlsanity.com/paper/2207.10128/) (2022)
- [Scalable Link Prediction in Dynamic Networks via Non-Negative Matrix Factorization](https://mlsanity.com/paper/1411.3675/) (2014)
- [Mutually exciting point process graphs for modelling dynamic networks](https://mlsanity.com/paper/2102.06527/) (2021)
- [Temporal anomaly detection: calibrating the surprise](https://mlsanity.com/paper/1705.10085/) (2017)
- [Anomaly Detection in Large Scale Networks with Latent Space Models](https://mlsanity.com/paper/1911.05522/) (2019)
- [Graph link prediction in computer networks using Poisson matrix factorisation](https://mlsanity.com/paper/2001.09456/) (2020)
- [A Collaborative Kalman Filter for Time-Evolving Dyadic Processes](https://mlsanity.com/paper/1501.05624/) (2015)

## Abstract (arXiv)

Detecting malicious activity within an enterprise computer network can be framed as a temporal link prediction task: given a sequence of graphs representing communications between hosts over time, the goal is to predict which edges should--or should not--occur in the future. However, standard temporal link prediction algorithms are ill-suited for computer network monitoring as they do not take account of the peculiar short-term dynamics of computer network activity, which exhibits sharp seasonal variations. In order to build a better model, we propose a source separation-inspired description of computer network activity: at each time step, the observed graph is a mixture of subgraphs representing various sources of activity, and short-term dynamics result from changes in the mixing coefficients. Both qualitative and quantitative experiments demonstrate the validity of our approach.