OW-HNPV: Velocity for Anomaly Detection

• The paper introduces a novel velocity-based TDA method that quantifies the rate at which topological features appear and disappear to enhance anomaly detection.
• It applies overlap weighting to reduce noise and short-lived features, ensuring mathematical stability under perturbations as measured by the 1-Wasserstein distance.
• Empirical evaluations on Ethereum transaction networks show that OW-HNPV achieves up to a 10.4% AUC gain over static TDA summaries for medium-range forecasting.

The Overlap-Weighted Hierarchical Normalized Persistence Velocity (OW-HNPV) is a vectorized, velocity-based topological data analysis (TDA) method tailored for anomaly detection in time-varying networks. Unlike traditional presence-based TDA summaries, OW-HNPV models the rate at which topological features appear and disappear, while applying overlap-based weighting to downweight noise and short-lived structures. The method yields a stable, interpretable summary of evolving network topology and demonstrates enhanced performance for detecting structural anomalies, especially in financial network contexts such as cryptocurrency markets (Khormali, 16 Dec 2025).

1. Mathematical Foundations and Definitions

OW-HNPV operates on a sequence of weighted graphs $\{G_t\}_{t=1}^T$, representing temporal snapshots of networks (e.g., blockchain transaction graphs). For each $G_t$, a lower-star filtration is constructed using a node-weight function $g_t$, from which persistence diagrams $D^t_k = \{(b_i^t, d_i^t)\}_{i=1}^{n_t}$ are computed in homological dimension $k$. Each $(b_i^t, d_i^t)$ encodes the birth and death scales of topological features.

For feature $i$ at time $t$, instantaneous persistence is defined as

$\mathrm{pers}_i(t) = d_i^t - b_i^t$

and velocity is

$v_i(t) = \frac{d}{dt} \mathrm{pers}_i(t)$

Empirically, with daily data, finite differences are used: $$v_i(t) \approx \frac{\mathrm{pers}_i(t + 1) - \mathrm{pers}_i(t)}{1}$$

The filtration parameter range $[\alpha, \beta]$ is partitioned into $m$ main intervals $I_j = [s_j, s_{j+1})$, which are further subdivided into $n_{\rm sub}$ equal subintervals $[t^j_\ell, t^j_{\ell+1})$. Each feature $i$ receives an overlap weight for subinterval $(j, \ell)$: $$w_i^{j,\ell} = \max\{0, \min(d_i, t^j_{\ell+1}) - \max(b_i, t^j_\ell)\}$$ Subinterval-wise velocity is then

$$V^{j,\ell} = \frac{1}{\Delta t^j_\ell} \sum_{i=1}^n w_i^{j,\ell},\quad \Delta t^j_\ell = t^j_{\ell+1} - t^j_\ell$$

Averaging yields $$V^j = \frac{1}{n_{\rm sub}} \sum_{\ell=1}^{n_{\rm sub}} V^{j,\ell}$$, which is normalized by the total persistence $P(D^t) = \sum_{i=1}^n (d_i^t - b_i^t)$ to produce the OW-HNPV vector: $$H^j(t) = \frac{V^j}{P(D^t)},\qquad \mathbf{H}(t) = (H^1(t), \dotsc, H^m(t)) \in \mathbb{R}^m$$

2. Stability and Theoretical Guarantees

OW-HNPV is provably stable under perturbations in the input data, specifically with respect to the 1-Wasserstein distance $d_{1,1}$ on persistence diagrams. For diagrams $D_1$, $D_2$ with total persistences $P(D_1), P(D_2) > 0$ and OW-HNPV vectors $\mathbf{H}_1$ and $\mathbf{H}_2$, the method satisfies: $$\|\mathbf{H}_1 - \mathbf{H}_2\|_\infty \le \frac{3\,n_{\rm sub}\,m}{(\beta-\alpha)\,\min\{P(D_1),P(D_2)\}}\, d_{1,1}(D_1, D_2)$$ The proof leverages optimal matchings between features, overlap-difference bounds, and the normalization property of total persistence. This ensures that OW-HNPV behaves predictably under both network noise and the naturally fluctuating topology of dynamic systems (Khormali, 16 Dec 2025).

3. Computational Workflow and Algorithm

OW-HNPV consists of the following steps for each graph $G_t$:

1. Compute the node-weighted lower-star filtration; extract persistence diagram $D^t$.
2. Compute total persistence $P(D^t)$.
3. Partition $[\alpha,\beta]$ into $m$ main intervals and then subdivide each into $n_{\rm sub}$ subintervals.
4. For each $(j, \ell)$, calculate subinterval-wise velocity $V^{j,\ell}$ via weighted overlaps $w_i^{j,\ell}$.
5. Aggregate and average $V^j = \frac{1}{n_{\rm sub}} \sum_\ell V^{j,\ell}$ for each main interval.
6. Normalize by total persistence: $H^j(t) = V^j/P(D^t)$.
7. The final output is the $m$-dimensional vector $\mathbf{H}(t)$.

Typical recommendations are $m=30$ main intervals and $3 \le n_{\rm sub} \le 10$ subintervals.

4. Empirical Evaluation in Dynamic Cryptocurrency Networks

OW-HNPV was evaluated on daily Ethereum transaction networks generated from May 2017 to May 2018. Each daily graph comprises the 250 most active addresses, with edge and node weights determined by transaction amounts. The anomaly detection task targets forecasting of large price jump days ($|\mathrm{return}| \ge 5\%$) up to $h=7$ days ahead.

The method was benchmarked against baseline graph features (degree, closeness, betweenness, clustering coefficient) and multiple TDA vectorizations: velocity-based (HNAV, HWNAV, OW-HNPV) and static (Vector of Averaged Bettis (VAB), persistence landscapes, persistence images). All vectors were standardized to dimension 30.

Performance was assessed using a random forest classifier (500 trees), evaluated via 10-fold cross-validation with 10 repeats, and measured as AUC gain relative to the baseline. The following patterns emerged:

Forecast Horizon	OW-HNPV AUC Gain	Best Static	Notes
$h \le 3$	$\le 0$	None	All TDA methods struggle
$h=4$	$\approx$4.2%	-	OW-HNPV is stable
$h=7$	$\approx$10.4%	VAB~7–8%	Only velocity/vector-based methods perform strongly at $h\ge4$

OW-HNPV exhibited the most robust performance across $h=4$–7, outperforming or matching static TDA summaries for medium- and long-range forecasting (Khormali, 16 Dec 2025).

5. Methodological Insights and Practical Considerations

Velocity-based topological summaries capture the dynamical aspects of network evolution—specifically, the emergence and disappearance rates of features—yielding increased sensitivity to sudden changes. This property aligns OW-HNPV with medium- to long-term anomaly detection, where abrupt system reconfigurations are statistically meaningful.

Key methodological insights include:

• Overlap weighting ensures noise resilience, automatically downweighting short-lived, potentially spurious features and conferring greater stability with respect to the subinterval parameter $n_{\rm sub}$.
• Presence-based summaries (e.g., VAB) are less effective for short forecasting horizons ($h\le3$).
• Including topological features from both dimension-0 (components) and dimension-1 (loops) improves predictive performance.
• Relative AUC gains for OW-HNPV over VAB can reach 38% for medium-range tasks; HWNAV achieves up to 100% relative gain for long-range prediction.

Recommended hyperparameters for routine application are $m=30$, $3\le n_{\rm sub}\le10$.

6. Relationship to Existing TDA Methods and Applicability

OW-HNPV extends the TDA toolkit beyond static, cumulative summaries by formalizing the temporal “velocity” of topological features, a perspective absent in prior descriptors such as VAB, persistence landscapes, and persistence images. This shift is empirically justified by increased anomaly detection performance in evolving networks, with clear mathematical stability guarantees.

The method is applicable wherever dynamic networks are subject to abrupt structural transitions, particularly in financial, biological, and infrastructure systems where topological change rates are more informative than aggregate presence. The mathematical stability and noise-filtering characteristics of OW-HNPV distinguish it as a robust choice for practitioners aiming to extract predictive temporal topological signatures (Khormali, 16 Dec 2025).