Using a Graph-Based Approach for Discovering Cybercrime

The ability to mine data represented as a graph has become important in several domains for detecting various structural patterns. One important area of data mining is anomaly detection, but little work has been done in terms of detecting anomalies in graph-based data. While there has been some work that has used statistical metrics and conditional entropy measurements, the results have been limited to certain types of anomalies. In this paper we present a graph-based approach to uncovering anomalies in applications containing information representing possible cybercrime activity: network activity and employee movements. We use three algorithms for the purpose of detecting anomalies in all three types of possible graph changes: label modifications, vertex/edge insertions and vertex/edge deletions. Each of our algorithms focuses on one of these anomalous types and uses the minimum description length principle to discover those substructure instances that contain anomalous entities and ...

• Type: Conference
• Year: 2010
• Where: FLAIRS
• Authors: William Eberle, Lawrence B. Holder, Jeffrey Graves
• Keywords: Artificial Intelligence, Conditional Entropy Measurements, FLAIRS 2010, Possible Cybercrime Activity, Possible Graph Changes