-
HyperMagNet: A Magnetic Laplacian based Hypergraph Neural Network
Authors:
Tatyana Benko,
Martin Buck,
Ilya Amburg,
Stephen J. Young,
Sinan G. Aksoy
Abstract:
In data science, hypergraphs are natural models for data exhibiting multi-way relations, whereas graphs only capture pairwise. Nonetheless, many proposed hypergraph neural networks effectively reduce hypergraphs to undirected graphs via symmetrized matrix representations, potentially losing important information. We propose an alternative approach to hypergraph neural networks in which the hypergr…
▽ More
In data science, hypergraphs are natural models for data exhibiting multi-way relations, whereas graphs only capture pairwise. Nonetheless, many proposed hypergraph neural networks effectively reduce hypergraphs to undirected graphs via symmetrized matrix representations, potentially losing important information. We propose an alternative approach to hypergraph neural networks in which the hypergraph is represented as a non-reversible Markov chain. We use this Markov chain to construct a complex Hermitian Laplacian matrix - the magnetic Laplacian - which serves as the input to our proposed hypergraph neural network. We study HyperMagNet for the task of node classification, and demonstrate its effectiveness over graph-reduction based hypergraph neural networks.
△ Less
Submitted 14 February, 2024;
originally announced February 2024.
-
Hypergraph Topological Features for Autoencoder-Based Intrusion Detection for Cybersecurity Data
Authors:
Bill Kay,
Sinan G. Aksoy,
Molly Baird,
Daniel M. Best,
Helen Jenne,
Cliff Joslyn,
Christopher Potvin,
Gregory Henselman-Petrusek,
Garret Seppala,
Stephen J. Young,
Emilie Purvine
Abstract:
In this position paper, we argue that when hypergraphs are used to capture multi-way local relations of data, their resulting topological features describe global behaviour. Consequently, these features capture complex correlations that can then serve as high fidelity inputs to autoencoder-driven anomaly detection pipelines. We propose two such potential pipelines for cybersecurity data, one that…
▽ More
In this position paper, we argue that when hypergraphs are used to capture multi-way local relations of data, their resulting topological features describe global behaviour. Consequently, these features capture complex correlations that can then serve as high fidelity inputs to autoencoder-driven anomaly detection pipelines. We propose two such potential pipelines for cybersecurity data, one that uses an autoencoder directly to determine network intrusions, and one that de-noises input data for a persistent homology system, PHANTOM. We provide heuristic justification for the use of the methods described therein for an intrusion detection pipeline for cyber data. We conclude by showing a small example over synthetic cyber attack data.
△ Less
Submitted 9 November, 2023;
originally announced December 2023.
-
Step** out of Flatland: Discovering Behavior Patterns as Topological Structures in Cyber Hypergraphs
Authors:
Helen Jenne,
Sinan G. Aksoy,
Daniel Best,
Alyson Bittner,
Gregory Henselman-Petrusek,
Cliff Joslyn,
Bill Kay,
Audun Myers,
Garret Seppala,
Jackson Warley,
Stephen J. Young,
Emilie Purvine
Abstract:
Data breaches and ransomware attacks occur so often that they have become part of our daily news cycle. This is due to a myriad of factors, including the increasing number of internet-of-things devices, shift to remote work during the pandemic, and advancement in adversarial techniques, which all contribute to the increase in both the complexity of data captured and the challenge of protecting our…
▽ More
Data breaches and ransomware attacks occur so often that they have become part of our daily news cycle. This is due to a myriad of factors, including the increasing number of internet-of-things devices, shift to remote work during the pandemic, and advancement in adversarial techniques, which all contribute to the increase in both the complexity of data captured and the challenge of protecting our networks. At the same time, cyber research has made strides, leveraging advances in machine learning and natural language processing to focus on identifying sophisticated attacks that are known to evade conventional measures. While successful, the shortcomings of these methods, particularly the lack of interpretability, are inherent and difficult to overcome. Consequently, there is an ever-increasing need to develop new tools for analyzing cyber data to enable more effective attack detection. In this paper, we present a novel framework based in the theory of hypergraphs and topology to understand data from cyber networks through topological signatures, which are both flexible and can be traced back to the log data. While our approach's mathematical grounding requires some technical development, this pays off in interpretability, which we will demonstrate with concrete examples in a large-scale cyber network dataset. These examples are an introduction to the broader possibilities that lie ahead; our goal is to demonstrate the value of applying methods from the burgeoning fields of hypernetwork science and applied topology to understand relationships among behaviors in cyber data.
△ Less
Submitted 7 November, 2023;
originally announced November 2023.
-
Fast Parallel Tensor Times Same Vector for Hypergraphs
Authors:
Shruti Shivakumar,
Ilya Amburg,
Sinan G. Aksoy,
Jiajia Li,
Stephen J. Young,
Srinivas Aluru
Abstract:
Hypergraphs are a popular paradigm to represent complex real-world networks exhibiting multi-way relationships of varying sizes. Mining centrality in hypergraphs via symmetric adjacency tensors has only recently become computationally feasible for large and complex datasets. To enable scalable computation of these and related hypergraph analytics, here we focus on the Sparse Symmetric Tensor Times…
▽ More
Hypergraphs are a popular paradigm to represent complex real-world networks exhibiting multi-way relationships of varying sizes. Mining centrality in hypergraphs via symmetric adjacency tensors has only recently become computationally feasible for large and complex datasets. To enable scalable computation of these and related hypergraph analytics, here we focus on the Sparse Symmetric Tensor Times Same Vector (S$^3$TTVc) operation. We introduce the Compound Compressed Sparse Symmetric (CCSS) format, an extension of the compact CSS format for hypergraphs of varying hyperedge sizes and present a shared-memory parallel algorithm to compute S$^3$TTVc. We experimentally show S$^3$TTVc computation using the CCSS format achieves better performance than the naive baseline, and is subsequently more performant for hypergraph $H$-eigenvector centrality.
△ Less
Submitted 14 November, 2023;
originally announced November 2023.
-
Malicious Cyber Activity Detection Using Zigzag Persistence
Authors:
Audun Myers,
Alyson Bittner,
Sinan Aksoy,
Daniel M. Best,
Gregory Henselman-Petrusek,
Helen Jenne,
Cliff Joslyn,
Bill Kay,
Garret Seppala,
Stephen J. Young,
Emilie Purvine
Abstract:
In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. Here we focus on the detection of malicious activity u…
▽ More
In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. Here we focus on the detection of malicious activity using log data. To do this we consider the dynamics of the data by exploring the changing topology of a hypergraph representation gaining insights into the underlying activity. Hypergraphs provide a natural representation of cyber log data by capturing complex interactions between processes. To study the changing topology we use zigzag persistence which captures how topological features persist at multiple dimensions over time. We observe that the resulting barcodes represent malicious activity differently than benign activity. To automate this detection we implement an autoencoder trained on a vectorization of the resulting zigzag persistence barcodes. Our experimental results demonstrate the effectiveness of the autoencoder in detecting malicious activity in comparison to standard summary statistics. Overall, this study highlights the potential of zigzag persistence and its combination with temporal hypergraphs for analyzing cybersecurity log data and detecting malicious behavior.
△ Less
Submitted 14 September, 2023;
originally announced September 2023.
-
Scalable tensor methods for nonuniform hypergraphs
Authors:
Sinan G. Aksoy,
Ilya Amburg,
Stephen J. Young
Abstract:
While multilinear algebra appears natural for studying the multiway interactions modeled by hypergraphs, tensor methods for general hypergraphs have been stymied by theoretical and practical barriers. A recently proposed adjacency tensor is applicable to nonuniform hypergraphs, but is prohibitively costly to form and analyze in practice. We develop tensor times same vector (TTSV) algorithms for th…
▽ More
While multilinear algebra appears natural for studying the multiway interactions modeled by hypergraphs, tensor methods for general hypergraphs have been stymied by theoretical and practical barriers. A recently proposed adjacency tensor is applicable to nonuniform hypergraphs, but is prohibitively costly to form and analyze in practice. We develop tensor times same vector (TTSV) algorithms for this tensor which improve complexity from $O(n^r)$ to a low-degree polynomial in $r$, where $n$ is the number of vertices and $r$ is the maximum hyperedge size. Our algorithms are implicit, avoiding formation of the order $r$ adjacency tensor. We demonstrate the flexibility and utility of our approach in practice by develo** tensor-based hypergraph centrality and clustering algorithms. We also show these tensor measures offer complementary information to analogous graph-reduction approaches on data, and are also able to detect higher-order structure that many existing matrix-based approaches provably cannot.
△ Less
Submitted 3 April, 2024; v1 submitted 30 June, 2023;
originally announced June 2023.
-
Seven open problems in applied combinatorics
Authors:
Sinan G. Aksoy,
Ryan Bennink,
Yuzhou Chen,
José Frías,
Yulia R. Gel,
Bill Kay,
Uwe Naumann,
Carlos Ortiz Marrero,
Anthony V. Petyuk,
Sandip Roy,
Ignacio Segovia-Dominguez,
Nate Veldt,
Stephen J. Young
Abstract:
We present and discuss seven different open problems in applied combinatorics. The application areas relevant to this compilation include quantum computing, algorithmic differentiation, topological data analysis, iterative methods, hypergraph cut algorithms, and power systems.
We present and discuss seven different open problems in applied combinatorics. The application areas relevant to this compilation include quantum computing, algorithmic differentiation, topological data analysis, iterative methods, hypergraph cut algorithms, and power systems.
△ Less
Submitted 20 March, 2023;
originally announced March 2023.
-
Directional Laplacian Centrality for Cyber Situational Awareness
Authors:
Sinan G. Aksoy,
Emilie Purvine,
Stephen J. Young
Abstract:
Cyber operations is drowning in diverse, high-volume, multi-source data. In order to get a full picture of current operations and identify malicious events and actors analysts must see through data generated by a mix of human activity and benign automated processes. Although many monitoring and alert systems exist, they typically use signature-based detection methods. We introduce a general method…
▽ More
Cyber operations is drowning in diverse, high-volume, multi-source data. In order to get a full picture of current operations and identify malicious events and actors analysts must see through data generated by a mix of human activity and benign automated processes. Although many monitoring and alert systems exist, they typically use signature-based detection methods. We introduce a general method rooted in spectral graph theory to discover patterns and anomalies without a priori knowledge of signatures. We derive and propose a new graph-theoretic centrality measure based on the derivative of the graph Laplacian matrix in the direction of a vertex. To build intuition about our measure we show how it identifies the most central vertices in standard network data sets and compare to other graph centrality measures. Finally, we focus our attention on studying its effectiveness in identifying important IP addresses in network flow data. Using both real and synthetic network flow data, we conduct several experiments to test our measure's sensitivity to two types of injected attack profiles, and show that vertices participating in injected attack profiles exhibit noticeable changes in our centrality measures, even when the injected anomalies are relatively small, and in the presence of simulated network dynamics.
△ Less
Submitted 23 March, 2021; v1 submitted 10 August, 2020;
originally announced August 2020.
-
Ramanujan Graphs and the Spectral Gap of Supercomputing Topologies
Authors:
Sinan G. Aksoy,
Paul Bruillard,
Stephen J. Young,
Mark Raugas
Abstract:
Graph eigenvalues play a fundamental role in controlling structural properties, such as bisection bandwidth, diameter, and fault tolerance, which are critical considerations in the design of supercomputing interconnection networks. This motivates considering graphs with optimal spectral expansion, called Ramanujan graphs, as potential candidates for interconnection networks. In this work, we explo…
▽ More
Graph eigenvalues play a fundamental role in controlling structural properties, such as bisection bandwidth, diameter, and fault tolerance, which are critical considerations in the design of supercomputing interconnection networks. This motivates considering graphs with optimal spectral expansion, called Ramanujan graphs, as potential candidates for interconnection networks. In this work, we explore this possibility by comparing Ramanujan graph properties against those of a wide swath of current and proposed supercomputing topologies. We derive analytic expressions for the spectral gap, bisection bandwidth, and diameter of these topologies, some of which were previously unknown. We find the spectral gap of existing topologies are well-separated from the optimal achievable by Ramanujan topologies, suggesting the potential utility of adopting Ramanujan graphs as interconnection networks.
△ Less
Submitted 8 April, 2020; v1 submitted 25 September, 2019;
originally announced September 2019.
-
Relative Hausdorff Distance for Network Analysis
Authors:
Sinan G. Aksoy,
Kathleen E. Nowak,
Emilie Purvine,
Stephen J. Young
Abstract:
Similarity measures are used extensively in machine learning and data science algorithms. The newly proposed graph Relative Hausdorff (RH) distance is a lightweight yet nuanced similarity measure for quantifying the closeness of two graphs. In this work we study the effectiveness of RH distance as a tool for detecting anomalies in time-evolving graph sequences. We apply RH to cyber data with given…
▽ More
Similarity measures are used extensively in machine learning and data science algorithms. The newly proposed graph Relative Hausdorff (RH) distance is a lightweight yet nuanced similarity measure for quantifying the closeness of two graphs. In this work we study the effectiveness of RH distance as a tool for detecting anomalies in time-evolving graph sequences. We apply RH to cyber data with given red team events, as well to synthetically generated sequences of graphs with planted attacks. In our experiments, the performance of RH distance is at times comparable, and sometimes superior, to graph edit distance in detecting anomalous phenomena. Our results suggest that in appropriate contexts, RH distance has advantages over more computationally intensive similarity measures.
△ Less
Submitted 12 June, 2019;
originally announced June 2019.
-
A linear-time algorithm and analysis of graph Relative Hausdorff distance
Authors:
Sinan G. Aksoy,
Kathleen E. Nowak,
Stephen J. Young
Abstract:
Graph similarity metrics serve far-ranging purposes across many domains in data science. As graph datasets grow in size, scientists need comparative tools that capture meaningful differences, yet are lightweight and scalable. Graph Relative Hausdorff (RH) distance is a promising, recently proposed measure for quantifying degree distribution similarity. In spite of recent interest in RH distance, l…
▽ More
Graph similarity metrics serve far-ranging purposes across many domains in data science. As graph datasets grow in size, scientists need comparative tools that capture meaningful differences, yet are lightweight and scalable. Graph Relative Hausdorff (RH) distance is a promising, recently proposed measure for quantifying degree distribution similarity. In spite of recent interest in RH distance, little is known about its properties. Here, we conduct an algorithmic and analytic study of RH distance. In particular, we provide the first linear-time algorithm for computing RH distance, analyze examples of RH distance between pairs of real-world networks as well as structured families of graphs, and prove several analytic results concerning the range, density, and extremal behavior of RH distance values.
△ Less
Submitted 7 August, 2019; v1 submitted 5 March, 2019;
originally announced March 2019.
-
Model of Cognitive Dynamics Predicts Performance on Standardized Tests
Authors:
Nathan O. Hodas,
Jacob Hunter,
Stephen J. Young,
Kristina Lerman
Abstract:
In the modern knowledge economy, success demands sustained focus and high cognitive performance. Research suggests that human cognition is linked to a finite resource, and upon its depletion, cognitive functions such as self-control and decision-making may decline. While fatigue, among other factors, affects human activity, how cognitive performance evolves during extended periods of focus remains…
▽ More
In the modern knowledge economy, success demands sustained focus and high cognitive performance. Research suggests that human cognition is linked to a finite resource, and upon its depletion, cognitive functions such as self-control and decision-making may decline. While fatigue, among other factors, affects human activity, how cognitive performance evolves during extended periods of focus remains poorly understood. By analyzing performance of a large cohort answering practice standardized test questions online, we show that accuracy and learning decline as the test session progresses and recover following prolonged breaks. To explain these findings, we hypothesize that answering questions consumes some finite cognitive resources on which performance depends, but these resources recover during breaks between test questions. We propose a dynamic mechanism of the consumption and recovery of these resources and show that it explains empirical findings and predicts performance better than alternative hypotheses. While further controlled experiments are needed to identify the physiological origin of these phenomena, our work highlights the potential of empirical analysis of large-scale human behavior data to explore cognitive behavior.
△ Less
Submitted 7 September, 2018;
originally announced September 2018.
-
Dimensionality of social networks using motifs and eigenvalues
Authors:
Anthony Bonato,
David F. Gleich,
Myunghwan Kim,
Dieter Mitsche,
Paweł Prałat,
Amanda Tian,
Stephen J. Young
Abstract:
We consider the dimensionality of social networks, and develop experiments aimed at predicting that dimension. We find that a social network model with nodes and links sampled from an $m$-dimensional metric space with power-law distributed influence regions best fits samples from real-world networks when $m$ scales logarithmically with the number of nodes of the network. This supports a logarithmi…
▽ More
We consider the dimensionality of social networks, and develop experiments aimed at predicting that dimension. We find that a social network model with nodes and links sampled from an $m$-dimensional metric space with power-law distributed influence regions best fits samples from real-world networks when $m$ scales logarithmically with the number of nodes of the network. This supports a logarithmic dimension hypothesis, and we provide evidence with two different social networks, Facebook and LinkedIn. Further, we employ two different methods for confirming the hypothesis: the first uses the distribution of motif counts, and the second exploits the eigenvalue distribution.
△ Less
Submitted 1 May, 2014;
originally announced May 2014.
-
Connectivity and Giant Component of Stochastic Kronecker Graphs
Authors:
Mary Radcliffe,
Stephen J. Young
Abstract:
Stochastic Kronecker graphs are a model for complex networks where each edge is present independently according the Kronecker (tensor) product of a fixed matrix k-by-k matrix P with entries in [0,1]. We develop a novel correspondence between the adjacencies in a general stochastic Kronecker graph and the action of a fixed Markov chain. Using this correspondence we are able to generalize the argume…
▽ More
Stochastic Kronecker graphs are a model for complex networks where each edge is present independently according the Kronecker (tensor) product of a fixed matrix k-by-k matrix P with entries in [0,1]. We develop a novel correspondence between the adjacencies in a general stochastic Kronecker graph and the action of a fixed Markov chain. Using this correspondence we are able to generalize the arguments of Horn and Radcliffe on the emergence of the giant component from the case where k = 2 to arbitrary k. We are also able to use this correspondence to completely analyze the connectivity of a general stochastic Kronecker graph.
△ Less
Submitted 1 April, 2015; v1 submitted 28 October, 2013;
originally announced October 2013.
