midas-edge 0.1.0 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb70cc5f659dce8abb80867585a61d06fc7bcd0f748beaa46b3a70d50753bae6
-  data.tar.gz: 076cfd4b87e2bf36536c03cc0adf0233761243ca305d2c3e78ef1da67aed0d40
+  metadata.gz: 71b32a1851488ba989ccc792af8922d1148f0c0f4585574821ea1759c908ad41
+  data.tar.gz: a4b9105e96a3407708d8e64a31c33e93dbbb8c9127c1f99f802044cdd4aa6818
 SHA512:
-  metadata.gz: ac16e0d2dc986dc75982cacef948189f032aa9cc660e4f23d0ec2bd9adad1fa1e2aba201df81c9e70efec8e8d6e55715abc5b7cfd55518b46eaf0abdaaa05c32
-  data.tar.gz: d205b4f2ad95d95eb0333967297b686efd6c55cd32e3f5b1f7a89c1dc5f074f555cdda6b55c7734899f317ae32b51444611613b4229b101115cee0d2ebbdcc49
+  metadata.gz: 28149251ec92a2b24e07c7745ad0b759c23ff4d957fa56298d6c6a92384f798e0651086a524b3b95e7911ed5500405929ef6627059429d41f3126381b73e479e
+  data.tar.gz: 2146d83339cd7c466d053f82f937a44ceb16d609d31034cd740b90425601ea12861e9bd1377a8696c5655af929a8dc1201fae6e79bed3addfd96125931e2f674

data/CHANGELOG.md

@@ -1,3 +1,27 @@
+## 0.2.3 (2020-11-17)
+
+- Updated MIDAS to 1.1.2
+
+## 0.2.2 (2020-09-23)
+
+- Updated MIDAS to 1.1.0
+
+## 0.2.1 (2020-06-17)
+
+- Fixed installation (missing header files)
+
+## 0.2.0 (2020-06-17)
+
+- Updated MIDAS to 1.0.0
+- Added `threshold` option
+- Added `seed` option
+- Changed default `alpha` to 0.5
+- Fixed reading data from files with `directed: false`
+
+## 0.1.1 (2020-02-19)
+
+- Fixed installation on Linux
+
 ## 0.1.0 (2020-02-17)
 
 - First release

data/NOTICE.txt

@@ -1,3 +1,4 @@
+Copyright 2020 Rui Liu (liurui39660) and Siddharth Bhatia (bhatiasiddharth)
 Copyright 2020 Andrew Kane
 
 Licensed under the Apache License, Version 2.0 (the "License");

data/README.md

@@ -2,13 +2,14 @@
 
 [MIDAS](https://github.com/bhatiasiddharth/MIDAS) - edge stream anomaly detection - for Ruby
 
+[![Build Status](https://travis-ci.org/ankane/midas.svg?branch=master)](https://travis-ci.org/ankane/midas)
+
 ## Installation
 
-Add this line to your application’s Gemfile:
+Add these lines to your application’s Gemfile:
 
 ```ruby
 gem 'midas-edge'
-gem 'rice', github: 'jasonroelofs/rice' # for now for c++17
 ```
 
 ## Getting Started
@@ -41,9 +42,11 @@ Pass parameters - default values below
 Midas.new(
   rows: 2,           # number of hash functions
   buckets: 769,      # number of buckets
-  alpha: 0.6,        # temporal decay factor
+  alpha: 0.5,        # temporal decay factor
+  threshold: nil,    # todo
   relations: true,   # whether to use MIDAS-R or MIDAS
-  directed: true     # treat the graph as directed or undirected
+  directed: true,    # treat the graph as directed or undirected
+  seed: 0            # random seed
 )
 ```
 
@@ -55,10 +58,10 @@ Data can be an array of arrays
 [[1, 2, 3], [4, 5, 6]]
 ```
 
-Or a Numo NArray
+Or a Numo array
 
 ```ruby
-Numo::Int32.new(3, 2).seq
+Numo::NArray.cast([[1, 2, 3], [4, 5, 6]])
 ```
 
 ## Performance
@@ -89,7 +92,7 @@ Everyone is encouraged to help improve this project. Here are a few ways you can
 To get started with development:
 
 ```sh
-git clone https://github.com/ankane/midas.git
+git clone --recursive https://github.com/ankane/midas.git
 cd midas
 bundle install
 bundle exec rake compile

data/ext/midas/ext.cpp

@@ -3,7 +3,9 @@
 #include <vector>
 
 // midas
-#include <anom.hpp>
+#include <FilteringCore.hpp>
+#include <NormalCore.hpp>
+#include <RelationalCore.hpp>
 
 // rice
 #include <rice/Module.hpp>
@@ -14,7 +16,7 @@ using Rice::String;
 using Rice::define_module;
 using Rice::define_class_under;
 
-void load_str(vector<int>& src, vector<int>& dst, vector<int>& times, std::string input, bool directed) {
+void load_str(std::vector<int>& src, std::vector<int>& dst, std::vector<int>& times, std::string input, bool directed) {
   int* input_ptr = (int*) input.data();
   size_t n = input.size() / sizeof(int);
 
@@ -39,7 +41,7 @@ void load_str(vector<int>& src, vector<int>& dst, vector<int>& times, std::strin
 // load_data from main.cpp
 // modified to throw std::runtime_error when cannot find file
 // instead of exiting
-void load_file(vector<int>& src, vector<int>& dst, vector<int>& times, std::string input_file, bool undirected)
+void load_file(std::vector<int>& src, std::vector<int>& dst, std::vector<int>& times, std::string input_file, bool undirected)
 {
   FILE* infile = fopen(input_file.c_str(), "r");
   if (infile == NULL) {
@@ -56,7 +58,7 @@ void load_file(vector<int>& src, vector<int>& dst, vector<int>& times, std::stri
     }
   }
   else {
-    while (fscanf(infile, "%d:%d:%d", &s, &d, &t) == 3) {
+    while (fscanf(infile, "%d,%d,%d", &s, &d, &t) == 3) {
       src.push_back(s);
       dst.push_back(d);
       times.push_back(t);
@@ -67,14 +69,28 @@ void load_file(vector<int>& src, vector<int>& dst, vector<int>& times, std::stri
   }
 }
 
-std::string fit_predict(vector<int>& src, vector<int>& dst, vector<int>& times, int num_rows, int num_buckets, double factor, bool relations) {
-  vector<double>* result;
-  if (relations) {
-    result = midasR(src, dst, times, num_rows, num_buckets, factor);
+std::string fit_predict(std::vector<int>& src, std::vector<int>& dst, std::vector<int>& times, int num_rows, int num_buckets, float factor, float threshold, bool relations, int seed) {
+  srand(seed);
+  size_t n = src.size();
+  const auto result = new float[n];
+
+  if (!std::isnan(threshold)) {
+    MIDAS::FilteringCore midas(num_rows, num_buckets, threshold, factor);
+    for (size_t i = 0; i < n; i++) {
+      result[i] = midas(src[i], dst[i], times[i]);
+    }
+  } else if (relations) {
+    MIDAS::RelationalCore midas(num_rows, num_buckets, factor);
+    for (size_t i = 0; i < n; i++) {
+      result[i] = midas(src[i], dst[i], times[i]);
+    }
   } else {
-    result = midas(src, dst, times, num_rows, num_buckets);
+    MIDAS::NormalCore midas(num_rows, num_buckets);
+    for (size_t i = 0; i < n; i++) {
+      result[i] = midas(src[i], dst[i], times[i]);
+    }
   }
-  return std::string((char*) result->data(), sizeof(double) / sizeof(char) * result->size());
+  return std::string((char*) result, sizeof(float) / sizeof(char) * n);
 }
 
 extern "C"
@@ -85,16 +101,16 @@ void Init_ext()
   define_class_under(rb_mMidas, "Detector")
     .define_method(
       "_fit_predict_str",
-      *[](std::string input, int num_rows, int num_buckets, double factor, bool relations, bool directed) {
-        vector<int> src, dst, times;
+      *[](std::string input, int num_rows, int num_buckets, float factor, float threshold, bool relations, bool directed, int seed) {
+        std::vector<int> src, dst, times;
         load_str(src, dst, times, input, directed);
-        return fit_predict(src, dst, times, num_rows, num_buckets, factor, relations);
+        return fit_predict(src, dst, times, num_rows, num_buckets, factor, threshold, relations, seed);
       })
     .define_method(
       "_fit_predict_file",
-      *[](std::string input, int num_rows, int num_buckets, double factor, bool relations, bool directed) {
-        vector<int> src, dst, times;
+      *[](std::string input, int num_rows, int num_buckets, float factor, float threshold, bool relations, bool directed, int seed) {
+        std::vector<int> src, dst, times;
         load_file(src, dst, times, input, !directed);
-        return fit_predict(src, dst, times, num_rows, num_buckets, factor, relations);
+        return fit_predict(src, dst, times, num_rows, num_buckets, factor, threshold, relations, seed);
       });
 }

data/ext/midas/extconf.rb

@@ -1,14 +1,8 @@
 require "mkmf-rice"
 
-abort "Missing stdc++" unless have_library("stdc++")
+$CXXFLAGS << " -std=c++11"
 
-$CXXFLAGS << " -std=c++17"
-
-ext = File.expand_path(".", __dir__)
-midas = File.expand_path("../../vendor/midas", __dir__)
-
-$srcs = Dir["{#{ext},#{midas}}/*.{cc,cpp}"]
+midas = File.expand_path("../../vendor/MIDAS/src", __dir__)
 $INCFLAGS << " -I#{midas}"
-$VPATH << midas
 
 create_makefile("midas/ext")

data/lib/midas/detector.rb

@@ -1,25 +1,28 @@
 module Midas
   class Detector
-    def initialize(rows: 2, buckets: 769, alpha: 0.6, relations: true, directed: true)
+    def initialize(rows: 2, buckets: 769, alpha: 0.5, threshold: nil, relations: true, directed: true, seed: 0)
       @rows = rows
       @buckets = buckets
       @alpha = alpha
+      @threshold = threshold
       @relations = relations
       @directed = directed
+      @seed = seed
     end
 
     def fit_predict(x)
+      threshold = @threshold || Float::NAN
       result =
         if x.is_a?(String)
-          _fit_predict_file(x, @rows, @buckets, @alpha, @relations, @directed)
+          _fit_predict_file(x, @rows, @buckets, @alpha, threshold, @relations, @directed, @seed)
         else
           x = Numo::Int32.cast(x) unless x.is_a?(Numo::NArray)
           x = x.cast_to(Numo::Int32) unless x.is_a?(Numo::Int32)
           raise ArgumentError, "Bad shape: #{x.shape}" unless x.rank == 2 && x.shape[1] == 3
-          _fit_predict_str(x.to_binary, @rows, @buckets, @alpha, @relations, @directed)
+          _fit_predict_str(x.to_binary, @rows, @buckets, @alpha, threshold, @relations, @directed, @seed)
         end
 
-      Numo::DFloat.from_binary(result)
+      Numo::SFloat.from_binary(result)
     end
   end
 end

data/lib/midas/version.rb

@@ -1,3 +1,3 @@
 module Midas
-  VERSION = "0.1.0"
+  VERSION = "0.2.3"
 end

data/vendor/MIDAS/LICENSE

@@ -174,28 +174,3 @@
       of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

data/vendor/MIDAS/README.md

@@ -1,66 +1,211 @@
 # MIDAS
-[![Conference](http://img.shields.io/badge/AAAI-2020-red.svg)](https://aaai.org/Conferences/AAAI-20/)
-[![Paper](http://img.shields.io/badge/Paper-pdf-brightgreen.svg)](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf)
-[![Poster](http://img.shields.io/badge/Poster-pdf-blueviolet.svg)](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midasposter.pdf)
-[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/bhatiasiddharth/MIDAS/blob/master/LICENSE)
 
-<p align="center">
-  <img align="center" src="https://www.comp.nus.edu.sg/~sbhatia/assets/img/midasstream.png" alt="...">
+<p>
+  <a href="https://aaai.org/Conferences/AAAI-20/">
+    <img src="http://img.shields.io/badge/AAAI-2020-red.svg">
+  </a>
+  <a href="https://arxiv.org/pdf/2009.08452.pdf"><img src="http://img.shields.io/badge/Paper-PDF-brightgreen.svg"></a>
+  <a href="https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midasslides.pdf">
+      <img src="http://img.shields.io/badge/Slides-PDF-ff9e18.svg">
+  </a>
+  <a href="https://youtu.be/Bd4PyLCHrto">
+    <img src="http://img.shields.io/badge/Talk-Youtube-ff69b4.svg">
+  </a>
+  <a href="https://www.youtube.com/watch?v=DPmN-uPW8qU"> 
+    <img src="https://img.shields.io/badge/Overview-Youtube-orange.svg">
+  </a>
+  <a href="https://github.com/bhatiasiddharth/MIDAS/blob/master/LICENSE">
+    <img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg">
+  </a>
 </p>
 
+C++ implementation of
 
-Anomaly detection in graphs is a critical problem for finding suspicious behavior in innumerable systems, such as intrusion detection, fake ratings, and financial fraud. This has been a well-researched problem with majority of the proposed approaches focusing on static graphs. However, many real-world graphs are dynamic in nature, and methods based on static connections may miss temporal characteristics of the graphs and anomalies.
+- [Real-time Streaming Anomaly Detection in Dynamic Graphs](https://arxiv.org/pdf/2009.08452.pdf). *Siddharth Bhatia, Rui Liu, Bryan Hooi, Minji Yoon, Kijung Shin, Christos Faloutsos*. (Under Review)
+- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](https://arxiv.org/pdf/1911.04464.pdf). *Siddharth Bhatia, Bryan Hooi, Minji Yoon, Kijung Shin, Christos Faloutsos*. AAAI 2020.
 
-Among the methods focusing on dynamic graphs, most of them have edges aggregated into graph snapshots. However, to minimize the effect of malicious activities and start recovery as soon as possible, we need to detect anomalies in real-time or near real-time i.e. to identify whether an incoming edge is anomalous or not, as soon as we receive it. In addition, since the number of vertices can increase as we process the stream of edges, we need an algorithm which uses constant memory in graph size. Moreover, fraudulent or anomalous events in many applications occur in microclusters or suddenly arriving groups of suspiciously similar edges e.g. denial of service attacks in network traffic data and lockstep behavior.
+The old implementation is in another branch `OldImplementation`, it should be considered as being archived and will hardly receive feature updates.
 
-In this work, we propose MIDAS, short for Microcluster-Based Detector of Anomalies in Edge Streams, which detects microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, in edge streams, using constant time and memory. In addition, by using a principled hypothesis testing framework, MIDAS provides theoretical bounds on the false positive probability, which earlier methods do not provide. Also, we are up to 48% more accurate while being up to 644 times faster than state of the art approaches.
+![](asset/Intro.png)
 
-For more details, please read the paper - [MIDAS:Microcluster-Based Detector of Anomalies in Edge Streams](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf). *Siddharth Bhatia, Bryan Hooi, Minji Yoon, Kijung Shin, Christos Faloutsos*. AAAI 2020.
+## Table of Contents
 
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 
-## Getting started
-1. Run `make` to compile code and create the binary.
-2. Run `./midas -i ` followed by the input file path and name.
-3. Run `make clean` to clean binaries.
 
+- [Features](#features)
+- [Demo](#demo)
+- [Customization](#customization)
+- [Other Files](#other-files)
+- [In Other Languages](#in-other-languages)
+- [Online Coverage](#online-coverage)
+- [Citation](#citation)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+## Features
+
+- Finds Anomalies in Dynamic/Time-Evolving Graph: (Intrusion Detection, Fake Ratings, Financial Fraud)
+- Detects Microcluster Anomalies (suddenly arriving groups of suspiciously similar edges e.g. DoS attack)
+- Theoretical Guarantees on False Positive Probability
+- Constant Memory (independent of graph size)
+- Constant Update Time (real-time anomaly detection to minimize harm)
+- Up to 55% more accurate and 929 times faster than the state of the art approaches
+- Experiments are performed using the following datasets: 
+  - [DARPA](https://www.ll.mit.edu/r-d/datasets/1998-darpa-intrusion-detection-evaluation-dataset)
+  - [TwitterWorldCup2014](http://odds.cs.stonybrook.edu/twitterworldcup2014-dataset)
+  - [TwitterSecurity](http://odds.cs.stonybrook.edu/twittersecurity-dataset)
 
 ## Demo
-1. Run `./demo.sh` to compile the code and run it on example dataset.
 
+If you use Windows:
+
+1. Open a Visual Studio developer command prompt, we want their toolchain
+1. `cd` to the project root `MIDAS/`
+1. `cmake -DCMAKE_BUILD_TYPE=Release -GNinja -S . -B build/release`
+1. `cmake --build build/release --target Demo`
+1. `cd` to `MIDAS/build/release/`
+1. `.\Demo.exe`
+
+If you use Linux/macOS:
+
+1. Open a terminal
+1. `cd` to the project root `MIDAS/`
+1. `cmake -DCMAKE_BUILD_TYPE=Release -S . -B build/release`
+1. `cmake --build build/release --target Demo`
+1. `cd` to `MIDAS/build/release/`
+1. `./Demo`
+
+The demo runs on `MIDAS/data/DARPA/darpa_processed.csv`, which has 4.5M records, with the filtering core (MIDAS-F).
+
+The scores will be exported to `MIDAS/temp/Score.txt`, higher means more anomalous.
+
+All file paths are absolute and "hardcoded" by CMake, but it's suggested NOT to run by double clicking on the executable file.
+
+### Requirements
+
+Core
+- C++11
+- C++ standard libraries
+
+Demo
+- Python 3 (`MIDAS/util/EvaluateScore.py`)
+    - `pandas`: I/O 
+    - `scikit-learn`: Compute ROC-AUC
+
+Experiment
+- (Optional) Intel TBB: Parallelization
+- (Optional) OpenMP: Parallelization
+
+Other python utility scripts
+- Python 3
+    - `pandas`
+    - `scikit-learn`
+
+## Customization
+
+### Switch Cores
+
+Cores are instantiated at `MIDAS/example/Demo.cpp:67-69`, uncomment the chosen one.
+
+### Custom Dataset + `Demo.cpp`
+
+You need to prepare three files:
 
-## Command line options
-  * `-h --help`: produce help message
-  * `-i --input`: input file name
-  * `-o --output`: output file name (default: scores.txt)  
-  * `-r --rows`: Number of Hash Functions (default: 2)  
-  * `-b --buckets`: Number of Buckets (default: 769)  
-  * `-a --alpha`: Temporal Decay Factor (default: 0.6)  
-  * `--norelations` : Run MIDAS instead of MIDAS-R
-  * `--undirected` : Treat graph as undirected instead of directed
+- Meta file
+  - Only includes an integer `N`, the number of records in the dataset
+  - Use its path for `pathMeta`
+  - E.g. `MIDAS/data/DARPA/darpa_shape.txt`
+- Data file
+  - A header-less csv format file of shape `[N,3]`
+  - Columns are sources, destinations, timestamps
+  - Use its path for `pathData`
+  - E.g. `MIDAS/data/DARPA/darpa_processed.csv`
+- Label file
+  - A header-less csv format file of shape `[N,1]`
+  - The corresponding label for data records
+    - 0 means normal record
+    - 1 means anomalous record
+  - Use its path for `pathGroundTruth`
+  - E.g. `MIDAS/data/DARPA/darpa_ground_truth.csv`
 
+### Custom Dataset + Custom Runner
 
-## Input file format
-MIDAS expects the input edge stream to be stored in a single file containing the following three columns in order:
-1. `source (int)`: source ID of the edge
-2. `destination (int)`: destination ID of the edge
-3. `time (int)`: time stamp of the edge
+1. Include the header `MIDAS/src/NormalCore.hpp`, `MIDAS/src/RelationalCore.hpp` or `MIDAS/src/FilteringCore.hpp`
+1. Instantiate cores with required parameters
+1. Call `operator()` on individual data records, it returns the anomaly score for the input record
 
-Thus, each line represents an edge. Edges should be sorted in non-decreasing order of their time stamps and the column delimiter should be `,`
+## Other Files
 
+### `example/`
 
-## Datasets
-1. [DARPA](https://www.ll.mit.edu/r-d/datasets/1998-darpa-intrusion-detection-evaluation-dataset)
-2. [TwitterWorldCup2014](http://odds.cs.stonybrook.edu/twitterworldcup2014-dataset)
-3. [TwitterSecurity](http://odds.cs.stonybrook.edu/twittersecurity-dataset)
+#### `Experiment.cpp`
+
+The code we used for experiments.   
+It will try to use Intel TBB or OpenMP for parallelization.  
+You should comment all but only one runner function call in the `main()` as most results are exported to `MIDAS/temp/Experiiment.csv` together with many intermediate files.
+
+#### `Reproducible.cpp`
+
+Similar to `Demo.cpp`, but with all random parameters hardcoded and always produce the same result.  
+It's for other developers and us to test if the implementation in other languages can produce acceptable results.  
+
+### `util/`
+
+`DeleteTempFile.py`, `EvaluateScore.py` and `ReproduceROC.py` will show their usage and a short description when executed without any argument.
+
+#### `PreprocessData.py`
+
+The code to process the raw dataset into an easy-to-read format.
+Datasets are always assumed to be in a folder in `MIDAS/data/`.    
+It can process the following dataset(s)
+
+- `DARPA/darpa_original.csv` -> `DARPA/darpa_processed.csv`, `DARPA/darpa_ground_truth.csv`, `DARPA/darpa_shape.txt`
+
+## In Other Languages
+
+1. Python: [Rui Liu's MIDAS.Python](https://github.com/liurui39660/MIDAS.Python), [Ritesh Kumar's pyMIDAS](https://github.com/ritesh99rakesh/pyMIDAS)
+1. Golang: [Steve Tan's midas](https://github.com/steve0hh/midas)
+1. Ruby: [Andrew Kane's midas](https://github.com/ankane/midas)
+1. Rust: [Scott Steele's midas_rs](https://github.com/scooter-dangle/midas_rs)
+1. R: [Tobias Heidler's MIDASwrappeR](https://github.com/pteridin/MIDASwrappeR)
+1. Java: [Joshua Tokle's MIDAS-Java](https://github.com/jotok/MIDAS-Java)
+1. Julia: [Ashrya Agrawal's MIDAS.jl](https://github.com/ashryaagr/MIDAS.jl)
+
+## Online Coverage
+
+1. [ACM TechNews](https://technews.acm.org/archives.cfm?fo=2020-05-may/may-06-2020.html)
+1. [AIhub](https://aihub.org/2020/05/01/interview-with-siddharth-bhatia-a-new-approach-for-anomaly-detection/)
+1. [Hacker News](https://news.ycombinator.com/item?id=22802604)
+1. [KDnuggets](https://www.kdnuggets.com/2020/04/midas-new-baseline-anomaly-detection-graphs.html)
+1. [Microsoft](https://techcommunity.microsoft.com/t5/azure-sentinel/announcing-the-azure-sentinel-hackathon-winners/ba-p/1548240)
+1. [Towards Data Science](https://towardsdatascience.com/controlling-fake-news-using-graphs-and-statistics-31ed116a986f)
 
 ## Citation
-If you use this code for your research, please consider citing our paper.
+
+If you use this code for your research, please consider citing our arXiv preprint
+
+```bibtex
+@misc{bhatia2020realtime,
+    title={Real-Time Streaming Anomaly Detection in Dynamic Graphs},
+    author={Siddharth Bhatia and Rui Liu and Bryan Hooi and Minji Yoon and Kijung Shin and Christos Faloutsos},
+    year={2020},
+    eprint={2009.08452},
+    archivePrefix={arXiv},
+    primaryClass={cs.LG}
+}
 
 ```
-@article{bhatia2019midas,
-  title={MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams},
-  author={Bhatia, Siddharth and Hooi, Bryan and Yoon, Minji and Shin, Kijung and Faloutsos, Christos},
-  journal={arXiv preprint arXiv:1911.04464},
-  year={2019}
+
+or our AAAI paper
+
+
+```bibtex
+@inproceedings{bhatia2020midas,
+    title="MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams",
+    author="Siddharth {Bhatia} and Bryan {Hooi} and Minji {Yoon} and Kijung {Shin} and Christos {Faloutsos}",
+    booktitle="AAAI 2020 : The Thirty-Fourth AAAI Conference on Artificial Intelligence",
+    year="2020"
 }
 ```