Adaptive-GraphSketch: Real-time Anomaly Detection

• ADAPTIVE-GRAPHSKETCH is a lightweight framework that employs temporal multi-tensor sketching and CMS-CU to track edge frequency patterns in dynamic graphs.
• It integrates Bayesian inference for probabilistic anomaly scoring with EWMA thresholding to provide adaptive, uncertainty-aware detection in real time.
• Empirical evaluations on intrusion detection datasets show improved ROC-AUC and scalability, processing millions of edges with bounded memory and low latency.

ADAPTIVE-GRAPHSKETCH is a lightweight and scalable framework for real-time anomaly detection in streaming edge data. It is designed for dynamic graphs in which timestamped edges $e=(u,v,t)$ arrive continuously, and it combines temporal multi-tensor sketching with Count-Min Sketch using Conservative Update (CMS-CU), Bayesian inference for probabilistic anomaly scoring, and Exponentially Weighted Moving Average (EWMA) thresholding tuned to burst intensity. The framework is intended to compactly track edge frequency patterns with bounded memory, mitigate hash collision issues, and adapt to evolving traffic patterns in settings such as cybersecurity and power grids (Ekle et al., 15 Sep 2025).

1. Problem setting and detection objective

The framework addresses edge-level anomaly detection in real time. In the stated problem setting, modern systems such as cybersecurity, fraud, social media, and power grids generate massive streams of timestamped edges $e=(u,v,t)$, and the task is to flag every incoming $(u,v,t)$ whose frequency pattern deviates sharply from its recent history. The motivating constraints are throughput, memory, adaptivity, and probabilistic interpretability: the stream may involve tens of millions of edges per second, the full adjacency matrix or long edge histories cannot be stored, network behavior drifts over time, bursts appear and subside, and the detector should provide principled thresholds and uncertainty-aware scores (Ekle et al., 15 Sep 2025).

Within this formulation, the framework is not a batch detector over static graphs. Its basic unit of analysis is the incoming edge event, and its anomaly score is computed online from a compressed temporal summary rather than from explicit per-edge histories. This design aligns bounded-memory graph summarization with online detection, rather than with retrospective graph mining.

2. Multi-layer tensor sketching and CMS-CU integration

The core summary structure is a three-dimensional Count-Min style sketch

$\mathcal{S}\in\mathbb{R}^{d\times w\times W},$

where $d$ is the number of hash functions, $w$ is the number of buckets per hash, and $W$ is the number of time-bins in the sliding window (Ekle et al., 15 Sep 2025).

Time is divided into contiguous intervals of width $\Delta$. For an edge timestamp $t$, the bin index is

$$b_t=\Big\lfloor\tfrac{t}{\Delta}\Big\rfloor,\quad b_t\in\{1,2,\dots,W\}.$$

Given $e=(u,v,t)$0 pairwise-independent hash functions $e=(u,v,t)$1 mapping each unordered pair $e=(u,v,t)$2 into $e=(u,v,t)$3, the arrival of edge $e=(u,v,t)$4 identifies the $e=(u,v,t)$5 candidate cells

$e=(u,v,t)$6

The update rule uses Conservative Update rather than standard Count-Min increments. Standard CMS increments all $e=(u,v,t)$7 counters for an item, which produces overestimates under collisions. In CMS-CU, only those rows whose counter value equals the current minimum are incremented: $e=(u,v,t)$8 or equivalently,

$e=(u,v,t)$9

In ADAPTIVE-GRAPHSKETCH, CMS-CU is applied separately on each time layer $(u,v,t)$0 of the 3D tensor, which reduces per-bin collision bias (Ekle et al., 15 Sep 2025).

The frequency estimators are defined at two temporal scales. The estimated count in the current bin is

$(u,v,t)$1

and the cumulative count up through bin $(u,v,t)$2 is

$(u,v,t)$3

To emphasize recent behavior and bound memory, the framework applies exponential decay and sliding-window pruning before processing bin $(u,v,t)$4. Every cell is decayed as

$(u,v,t)$5

and any bin $(u,v,t)$6 with $(u,v,t)$7 is zeroed out. The resulting memory guarantee is $(u,v,t)$8, while the per-edge update cost is $(u,v,t)$9 (Ekle et al., 15 Sep 2025).

3. Probabilistic anomaly scoring and adaptive thresholding

After computing $\mathcal{S}\in\mathbb{R}^{d\times w\times W},$0 and $\mathcal{S}\in\mathbb{R}^{d\times w\times W},$1, the framework assigns a probabilistic score to the burstiness of the edge. Under the normal model,

$\mathcal{S}\in\mathbb{R}^{d\times w\times W},$2

while under the anomaly model the mean is shifted and the variance is inflated: $\mathcal{S}\in\mathbb{R}^{d\times w\times W},$3 With prior $\mathcal{S}\in\mathbb{R}^{d\times w\times W},$4 and evidence

$\mathcal{S}\in\mathbb{R}^{d\times w\times W},$5

the posterior anomaly probability is

$\mathcal{S}\in\mathbb{R}^{d\times w\times W},$6

This posterior $\mathcal{S}\in\mathbb{R}^{d\times w\times W},$7 is used as the edge’s raw anomaly score $\mathcal{S}\in\mathbb{R}^{d\times w\times W},$8 (Ekle et al., 15 Sep 2025).

Binary alarms are produced by EWMA smoothing together with an adaptive threshold. The EWMA statistic is

$\mathcal{S}\in\mathbb{R}^{d\times w\times W},$9

Smaller $d$0 places more weight on history, while larger $d$1 reacts faster to bursts. In parallel, the running mean and variance of the score stream are maintained as

$d$2

and the threshold is set to

$d$3

By Chebyshev’s inequality,

$d$4

so the parameter $d$5 directly trades off sensitivity against false-alarm rate. The decision rule is to flag edge $d$6 as anomalous if $d$7 (Ekle et al., 15 Sep 2025).

This scoring-and-thresholding stack gives the framework a probabilistic interpretation at two levels. The posterior score encodes the relative support for the anomaly model, while the EWMA–Chebyshev stage converts that score stream into adaptive alarms tuned to burst intensity.

4. Complexity, memory profile, and implementation characteristics

The stated per-edge time complexity is $d$8 hashes plus $d$9 conservative-update checks, which is $w$0 for fixed $w$1. Memory usage is $w$2. In the reported experiments, $w$3, $w$4–$w$5, and $w$6, so the total memory is a few MB. The update cost is one pass over the $w$7 rows per edge, plus a short loop of length $w$8 for decay, which can be amortized or implemented incrementally (Ekle et al., 15 Sep 2025).

These parameters define the practical operating regime of the method. The sketch is fixed-size, the number of hash functions is small, and the temporal dimension is explicit rather than implicit. The design therefore separates three concerns that are often conflated in streaming systems: collision control through CMS-CU, recency weighting through decay and pruning, and decision calibration through posterior scoring and EWMA thresholding.

A plausible implication is that the framework’s bounded-memory behavior is not an auxiliary implementation detail but part of the detection model itself. Older events are attenuated twice: numerically through $w$9-decay and structurally through zeroing of bins older than $W$0. This makes the detector explicitly recent-history centric.

5. Empirical evaluation

The experimental evaluation uses four real-world intrusion detection datasets and reports ROC-AUC, end-to-end processing time, and memory footprint as the primary metrics. The baselines are AnoEdge-G/L, MIDAS-R, F-FADE, PENminer, SedanSpot, and DenseStream (Ekle et al., 15 Sep 2025).

Dataset	Scale	Reported observation
DARPA	4.5 M edges, 25,525 nodes	Included in evaluation
ISCX-IDS2012	1.1 M edges	Included in evaluation
CIC-IDS2018	7.9 M edges	AUC gain of up to 6.5% over the best prior method
CIC-DDoS2019	20.3 M edges	AUC gain of up to 15.6%

Across these datasets, the reported quantitative findings are that ADAPTIVE-GRAPHSKETCH processes 20 million edges in under 3.4 seconds using only $W$1 hash functions, while using a few megabytes of sketch storage. Trade-off plots of AUC versus runtime place the method on the Pareto front, with higher accuracy and lower latency than all baselines. The scalability study reports near-linear runtime growth in the number of edges and in the number of hashes, with slope $W$2 in log–log plots (Ekle et al., 15 Sep 2025).

The empirical profile therefore combines three claims that are often separated in the streaming anomaly-detection literature: real-time throughput, bounded memory, and improved ROC-AUC on large intrusion-detection streams. This suggests that the method is intended as a deployment-oriented streaming detector rather than only as a sketching primitive.

6. Relation to other graph-sketching paradigms and scope of the term “adaptive”

A recurring source of ambiguity is that closely related literatures use the language of sketching and adaptivity for different objectives. In graph-stream query estimation, gSketch partitions a global sketch into localized sketches to estimate edge-frequency and aggregate subgraph queries, emphasizing partitioning based on sampled graph structure and optional workload information (Zhao et al., 2011). In labeled and time-sensitive graph streams, LSketch preserves vertex and edge labels, introduces a sliding window, and supports structure-based and time-sensitive queries in sub-linear storage space (Zeng et al., 2023). In labeled-graph stream summarization under skewed label distributions, SBG-Sketch maintains $W$3 matrices together with a rank-vector eviction mechanism so that labels can borrow and evict cells across matrices, thereby self-balancing memory across time-varying label frequencies (Hassan et al., 2017).

A different branch of work uses sketching for dynamic graph algorithms rather than anomaly detection. HybridSCALE sketches only the dense core of a graph and stores the sparse periphery losslessly for dynamic connectivity, with hybrid algorithms for fully-dynamic and semi-streaming connectivity and space

$W$4

with high probability (Man et al., 14 May 2026). Another distinct direction studies adjacency sketches in adversarial environments, where adaptivity refers to an adversary that may request labels of up to $W$5 vertices before attempting a forgery on two previously unqueried vertices; in that model, label size is tightly related to maximum degree (Naor et al., 2023).

Within this broader landscape, ADAPTIVE-GRAPHSKETCH occupies a narrower and more specific position. Its adaptive behavior is realized through temporal decay, posterior anomaly scoring, and EWMA thresholding tuned to burst intensity, rather than through adaptive adversaries, hybrid core-periphery storage, or label-aware reachability and query processing (Ekle et al., 15 Sep 2025). This suggests that the framework should be read primarily as a real-time streaming detection pipeline built on graph-sketching components, not as a generic theory of adaptive sketches.