A real-time anomaly detection algorithm for dynamic graph streams, identifying intrusions, fraud, and fake ratings with constant memory and update time.
MIDAS is a real-time anomaly detection algorithm for dynamic, time-evolving graphs. It processes streaming edge data to identify microcluster anomalies such as intrusions (DoS/DDoS attacks), financial fraud, and fake ratings. The algorithm provides constant memory usage and update time, making it scalable for high-velocity graph streams.
Data scientists and engineers working on network security, fraud detection, or social media analysis who need real-time anomaly detection in graph-structured data streams.
Developers choose MIDAS for its combination of theoretical guarantees, constant-time performance, and high accuracy—outperforming state-of-the-art methods by up to 55% in accuracy and 929× in speed.
Anomaly Detection on Dynamic (time-evolving) Graphs in Real-time and Streaming manner. Detecting intrusions (DoS and DDoS attacks), frauds, fake rating anomalies.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Processes edge streams with constant update time, achieving up to 929 times faster than state-of-the-art methods, as validated on datasets like DARPA.
Provides bounds on false positive probability, ensuring reliable detection without relying solely on empirical tuning, as cited in the AAAI and TKDD papers.
Memory is independent of graph size, enabling handling of large-scale streams without memory bloat, a key feature for dynamic graphs.
Demonstrates up to 55% more accurate anomaly detection in experiments, using cores like FilteringCore for scenarios like DoS attacks.
Requires C++11, CMake, and platform-specific builds (e.g., Visual Studio for Windows), making it less accessible for teams unfamiliar with compiled languages.
Custom dataset integration demands manual preparation of meta, data, and label files, with utility scripts offering minimal descriptions, as noted in the README.
Lacks built-in deployment or monitoring tools; users must handle streaming sources and score export manually, unlike cloud-based anomaly detection services.