Detection of Abnormal Change in a Time Series of Graphs

In the management of large enterprise communication networks, it becomes difficult to detect and identify causes of abnormal change in traffic distributions when the underlying logical topology is dynamic. This paper describes a novel approach to abnormal network change detection by representing periodic observations of logical communications within a network as a time series of graphs. A number of graph distance measures are proposed to assess the difference between successive graphs and identify abnormal behaviour. Localisation techniques have also been described to show where in the network most change occurred.