# Multi-Aspect Mining and Anomaly Detection for Heterogeneous Tensor Streams

arXiv: https://arxiv.org/abs/2602.04917 · HTML: https://mlsanity.com/paper/2602.04917/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 62 references that are in the map.
- First posted on arXiv 4 Feb 2026.

## Builds on (most cited first, 21 of 21)

- [Variational Inference with Normalizing Flows](https://mlsanity.com/paper/1505.05770/) (2015)
- [Modeling Tabular data using Conditional GAN](https://mlsanity.com/paper/1907.00503/) (2019)
- [Learning under Concept Drift: A Review](https://mlsanity.com/paper/2004.05785/) (2020)
- [Handling Incomplete Heterogeneous Data using VAEs](https://mlsanity.com/paper/1807.03653/) (2018)
- [River: machine learning for streaming data in Python](https://mlsanity.com/paper/2012.04740/) (2020)
- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](https://mlsanity.com/paper/1911.04464/) (2019)
- [Deep Mixture Point Processes: Spatio-temporal Event Prediction with Rich Contextual Information](https://mlsanity.com/paper/1906.08952/) (2019)
- [Bayesian Poisson Tensor Factorization for Inferring Multilateral Relations from Sparse Dyadic Event Counts](https://mlsanity.com/paper/1506.03493/) (2015)
- [Anomaly Detection in Dynamic Graphs: A Comprehensive Survey](https://mlsanity.com/paper/2406.00134/) (2024)
- [MSTREAM: Fast Anomaly Detection in Multi-Aspect Streams](https://mlsanity.com/paper/2009.08451/) (2020)
- [DenseAlert: Incremental Dense-Subtensor Detection in Tensor Streams](https://mlsanity.com/paper/1706.03374/) (2017)
- [Adaptive Model Pooling for Online Deep Anomaly Detection from a Complex Evolving Data Stream](https://mlsanity.com/paper/2206.04792/) (2022)
- [MemStream: Memory-Based Streaming Anomaly Detection](https://mlsanity.com/paper/2106.03837/) (2021)
- [SSMF: Shifting Seasonal Matrix Factorization](https://mlsanity.com/paper/2110.12763/) (2021)
- [PySAD: A Streaming Anomaly Detection Framework in Python](https://mlsanity.com/paper/2009.02572/) (2020)
- [Sketch-Based Anomaly Detection in Streaming Graphs](https://mlsanity.com/paper/2106.04486/) (2021)
- [Fast and Multi-aspect Mining of Complex Time-stamped Event Streams](https://mlsanity.com/paper/2303.03789/) (2023)
- [SliceNStitch: Continuous CP Decomposition of Sparse Tensor Streams](https://mlsanity.com/paper/2102.11517/) (2021)
- [Nonparametric Embeddings of Sparse High-Order Interaction Events](https://mlsanity.com/paper/2207.03639/) (2022)
- [AugSplicing: Synchronized Behavior Detection in Streaming Tensors](https://mlsanity.com/paper/2012.02006/) (2020)
- [CyberCScope: Mining Skewed Tensor Streams and Online Anomaly Detection in Cybersecurity Systems](https://mlsanity.com/paper/2503.00871/) (2025)

## Built on by (most cited first, 1 of 1)

- [AdaKoop: Efficient Modeling of Nonlinear Dynamics from Nonstationary Data Streams with Koopman Operator Regression](https://mlsanity.com/paper/2606.04930/) (2026)

## Abstract (arXiv)

Analysis and anomaly detection in event tensor streams consisting of timestamps and multiple attributes - such as communication logs(time, IP address, packet length)- are essential tasks in data mining. While existing tensor decomposition and anomaly detection methods provide useful insights, they face the following two limitations. (i) They cannot handle heterogeneous tensor streams, which comprises both categorical attributes(e.g., IP address) and continuous attributes(e.g., packet length). They typically require either discretizing continuous attributes or treating categorical attributes as continuous, both of which distort the underlying statistical properties of the data.Furthermore, incorrect assumptions about the distribution family of continuous attributes often degrade the model's performance. (ii) They discretize timestamps, failing to track the temporal dynamics of streams(e.g., trends, abnormal events), which makes them ineffective for detecting anomalies at the group level, referred to as 'group anomalies' (e.g, DoS attacks). To address these challenges, we propose HeteroComp, a method for continuously summarizing heterogeneous tensor streams into 'components' representing latent groups in each attribute and their temporal dynamics, and detecting group anomalies. Our method employs Gaussian process priors to model unknown distributions of continuous attributes, and temporal dynamics, which directly estimate probability densities from data. Extracted components give concise but effective summarization, enabling accurate group anomaly detection. Extensive experiments on real datasets demonstrate that HeteroComp outperforms the state-of-the-art algorithms for group anomaly detection accuracy, and its computational time does not depend on the data stream length.