midas-edge 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51024d37d243a503b528b846e60e46b36b52e4b77a70b14d71feb262a00372d7
-  data.tar.gz: e2fce29bba281e179123bb558a8deeba5808f9e27dbb2d24cf2ee4423c3632c9
+  metadata.gz: 9e4c7b4cac2e7a9dac3a6085b40d79a48b9f14dad32834e0d267f7bb667d86b9
+  data.tar.gz: abd0836d284e7a9c34c7733f2f195e38faca2fb1ac6ab01687c3790bc96d3cfa
 SHA512:
-  metadata.gz: 39ee7a3b1228fb63838a121c180b9b9edd2f9a207da18810dbdb24a4335879872c6d265c2706154fa40dcb7414b3cb49b7b6a98efeb34ed0dde0379206a4d131
-  data.tar.gz: 68c43621d46cc1a4fc6ccdad3f4d24a95428a68da59837f55377556d9a60f20f878a8db83a7e74c6ec35ac869e49aa19810c791db8a4b09c2ed18039dc2d00bd
+  metadata.gz: 48c92dbdbff039a514ca99207a88276fada4a1391497a1fd4595176f90bec0ac46f0fc89126d36c7ccfc3a1afe212aa11f2142fb7d3d836734f64ab912a88ffb
+  data.tar.gz: 9a2a140ed5d5a120969ee5fc0a599cccc6d590755c9eddf949c2e0a5897aaf39b6f8fe8137c9dde3fd418c78f04cdd8801d1353ca61009d4fbae5a610ad2edc5

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.2.0 (2020-06-17)
+
+- Updated MIDAS to 1.0.0
+- Added `threshold` option
+- Added `seed` option
+- Changed default `alpha` to 0.5
+- Fixed reading data from files with `directed: false`
+
 ## 0.1.1 (2020-02-19)
 
 - Fixed installation on Linux

data/README.md

@@ -43,9 +43,11 @@ Pass parameters - default values below
 Midas.new(
   rows: 2,           # number of hash functions
   buckets: 769,      # number of buckets
-  alpha: 0.6,        # temporal decay factor
+  alpha: 0.5,        # temporal decay factor
+  threshold: nil,    # todo
   relations: true,   # whether to use MIDAS-R or MIDAS
-  directed: true     # treat the graph as directed or undirected
+  directed: true,    # treat the graph as directed or undirected
+  seed: 0            # random seed
 )
 ```
 
@@ -57,10 +59,10 @@ Data can be an array of arrays
 [[1, 2, 3], [4, 5, 6]]
 ```
 
-Or a Numo NArray
+Or a Numo array
 
 ```ruby
-Numo::Int32.new(3, 2).seq
+Numo::NArray.cast([[1, 2, 3], [4, 5, 6]])
 ```
 
 ## Performance

data/ext/midas/ext.cpp

@@ -3,7 +3,9 @@
 #include <vector>
 
 // midas
-#include <anom.hpp>
+#include <FilteringCore.hpp>
+#include <NormalCore.hpp>
+#include <RelationalCore.hpp>
 
 // rice
 #include <rice/Module.hpp>
@@ -14,7 +16,7 @@ using Rice::String;
 using Rice::define_module;
 using Rice::define_class_under;
 
-void load_str(vector<int>& src, vector<int>& dst, vector<int>& times, std::string input, bool directed) {
+void load_str(std::vector<int>& src, std::vector<int>& dst, std::vector<int>& times, std::string input, bool directed) {
   int* input_ptr = (int*) input.data();
   size_t n = input.size() / sizeof(int);
 
@@ -39,7 +41,7 @@ void load_str(vector& src, vector& dst, vector& times, std::strin
 // load_data from main.cpp
 // modified to throw std::runtime_error when cannot find file
 // instead of exiting
-void load_file(vector<int>& src, vector<int>& dst, vector<int>& times, std::string input_file, bool undirected)
+void load_file(std::vector<int>& src, std::vector<int>& dst, std::vector<int>& times, std::string input_file, bool undirected)
 {
   FILE* infile = fopen(input_file.c_str(), "r");
   if (infile == NULL) {
@@ -56,7 +58,7 @@ void load_file(vector& src, vector& dst, vector& times, std::stri
     }
   }
   else {
-    while (fscanf(infile, "%d:%d:%d", &s, &d, &t) == 3) {
+    while (fscanf(infile, "%d,%d,%d", &s, &d, &t) == 3) {
       src.push_back(s);
       dst.push_back(d);
       times.push_back(t);
@@ -67,14 +69,28 @@ void load_file(vector& src, vector& dst, vector& times, std::stri
   }
 }
 
-std::string fit_predict(vector<int>& src, vector<int>& dst, vector<int>& times, int num_rows, int num_buckets, double factor, bool relations) {
-  vector<double>* result;
-  if (relations) {
-    result = midasR(src, dst, times, num_rows, num_buckets, factor);
+std::string fit_predict(std::vector<int>& src, std::vector<int>& dst, std::vector<int>& times, int num_rows, int num_buckets, float factor, float threshold, bool relations, int seed) {
+  srand(seed);
+  size_t n = src.size();
+  const auto result = new float[n];
+
+  if (!std::isnan(threshold)) {
+    MIDAS::FilteringCore midas(num_rows, num_buckets, threshold, factor);
+    for (size_t i = 0; i < n; i++) {
+      result[i] = midas(src[i], dst[i], times[i]);
+    }
+  } else if (relations) {
+    MIDAS::RelationalCore midas(num_rows, num_buckets, factor);
+    for (size_t i = 0; i < n; i++) {
+      result[i] = midas(src[i], dst[i], times[i]);
+    }
   } else {
-    result = midas(src, dst, times, num_rows, num_buckets);
+    MIDAS::NormalCore midas(num_rows, num_buckets);
+    for (size_t i = 0; i < n; i++) {
+      result[i] = midas(src[i], dst[i], times[i]);
+    }
   }
-  return std::string((char*) result->data(), sizeof(double) / sizeof(char) * result->size());
+  return std::string((char*) result, sizeof(float) / sizeof(char) * n);
 }
 
 extern "C"
@@ -85,16 +101,16 @@ void Init_ext()
   define_class_under(rb_mMidas, "Detector")
     .define_method(
       "_fit_predict_str",
-      *[](std::string input, int num_rows, int num_buckets, double factor, bool relations, bool directed) {
-        vector<int> src, dst, times;
+      *[](std::string input, int num_rows, int num_buckets, float factor, float threshold, bool relations, bool directed, int seed) {
+        std::vector<int> src, dst, times;
         load_str(src, dst, times, input, directed);
-        return fit_predict(src, dst, times, num_rows, num_buckets, factor, relations);
+        return fit_predict(src, dst, times, num_rows, num_buckets, factor, threshold, relations, seed);
       })
     .define_method(
       "_fit_predict_file",
-      *[](std::string input, int num_rows, int num_buckets, double factor, bool relations, bool directed) {
-        vector<int> src, dst, times;
+      *[](std::string input, int num_rows, int num_buckets, float factor, float threshold, bool relations, bool directed, int seed) {
+        std::vector<int> src, dst, times;
         load_file(src, dst, times, input, !directed);
-        return fit_predict(src, dst, times, num_rows, num_buckets, factor, relations);
+        return fit_predict(src, dst, times, num_rows, num_buckets, factor, threshold, relations, seed);
       });
 }

data/ext/midas/extconf.rb

@@ -2,11 +2,7 @@ require "mkmf-rice"
 
 $CXXFLAGS << " -std=c++17"
 
-ext = File.expand_path(".", __dir__)
-midas = File.expand_path("../../vendor/MIDAS", __dir__)
-
-$srcs = Dir["{#{ext},#{midas}}/*.{cc,cpp}"]
+midas = File.expand_path("../../vendor/MIDAS/src", __dir__)
 $INCFLAGS << " -I#{midas}"
-$VPATH << midas
 
 create_makefile("midas/ext")

data/lib/midas/detector.rb

@@ -1,25 +1,28 @@
 module Midas
   class Detector
-    def initialize(rows: 2, buckets: 769, alpha: 0.6, relations: true, directed: true)
+    def initialize(rows: 2, buckets: 769, alpha: 0.5, threshold: nil, relations: true, directed: true, seed: 0)
       @rows = rows
       @buckets = buckets
       @alpha = alpha
+      @threshold = threshold
       @relations = relations
       @directed = directed
+      @seed = seed
     end
 
     def fit_predict(x)
+      threshold = @threshold || Float::NAN
       result =
         if x.is_a?(String)
-          _fit_predict_file(x, @rows, @buckets, @alpha, @relations, @directed)
+          _fit_predict_file(x, @rows, @buckets, @alpha, threshold, @relations, @directed, @seed)
         else
           x = Numo::Int32.cast(x) unless x.is_a?(Numo::NArray)
           x = x.cast_to(Numo::Int32) unless x.is_a?(Numo::Int32)
           raise ArgumentError, "Bad shape: #{x.shape}" unless x.rank == 2 && x.shape[1] == 3
-          _fit_predict_str(x.to_binary, @rows, @buckets, @alpha, @relations, @directed)
+          _fit_predict_str(x.to_binary, @rows, @buckets, @alpha, threshold, @relations, @directed, @seed)
         end
 
-      Numo::DFloat.from_binary(result)
+      Numo::SFloat.from_binary(result)
     end
   end
 end

data/lib/midas/version.rb

@@ -1,3 +1,3 @@
 module Midas
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/vendor/MIDAS/LICENSE

@@ -174,28 +174,3 @@
       of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

data/vendor/MIDAS/README.md

@@ -1,66 +1,136 @@
 # MIDAS
-[![Conference](http://img.shields.io/badge/AAAI-2020-red.svg)](https://aaai.org/Conferences/AAAI-20/)
-[![Paper](http://img.shields.io/badge/Paper-pdf-brightgreen.svg)](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf)
-[![Poster](http://img.shields.io/badge/Poster-pdf-blueviolet.svg)](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midasposter.pdf)
-[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/bhatiasiddharth/MIDAS/blob/master/LICENSE)
 
-<p align="center">
-  <img align="center" src="https://www.comp.nus.edu.sg/~sbhatia/assets/img/midasstream.png" alt="...">
+<p>
+  <a href="https://aaai.org/Conferences/AAAI-20/">
+    <img src="http://img.shields.io/badge/AAAI-2020-red.svg">
+  </a>
+  <a href="https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf"><img src="http://img.shields.io/badge/Paper-PDF-brightgreen.svg"></a>
+  <a href="https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midasslides.pdf">
+      <img src="http://img.shields.io/badge/Slides-PDF-ff9e18.svg">
+  </a>
+  <a href="https://youtu.be/Bd4PyLCHrto">
+    <img src="http://img.shields.io/badge/Talk-Youtube-ff69b4.svg">
+  </a>
+  <a href="https://www.kdnuggets.com/2020/04/midas-new-baseline-anomaly-detection-graphs.html"> 
+    <img src="https://img.shields.io/badge/Press-KDnuggets-orange.svg">
+  </a>
+  <a href="https://github.com/bhatiasiddharth/MIDAS/blob/master/LICENSE">
+    <img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg">
+  </a>
 </p>
 
+C++ implementation of
 
-Anomaly detection in graphs is a critical problem for finding suspicious behavior in innumerable systems, such as intrusion detection, fake ratings, and financial fraud. This has been a well-researched problem with majority of the proposed approaches focusing on static graphs. However, many real-world graphs are dynamic in nature, and methods based on static connections may miss temporal characteristics of the graphs and anomalies.
+- Real-time Streaming Anomaly Detection in Dynamic Graphs. *Siddharth Bhatia, Rui Liu, Bryan Hooi, Minji Yoon, Kijung Shin, Christos Faloutsos*. (Under Review)
+- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](asset/Conference.pdf). *Siddharth Bhatia, Bryan Hooi, Minji Yoon, Kijung Shin, Christos Faloutsos*. AAAI 2020.
 
-Among the methods focusing on dynamic graphs, most of them have edges aggregated into graph snapshots. However, to minimize the effect of malicious activities and start recovery as soon as possible, we need to detect anomalies in real-time or near real-time i.e. to identify whether an incoming edge is anomalous or not, as soon as we receive it. In addition, since the number of vertices can increase as we process the stream of edges, we need an algorithm which uses constant memory in graph size. Moreover, fraudulent or anomalous events in many applications occur in microclusters or suddenly arriving groups of suspiciously similar edges e.g. denial of service attacks in network traffic data and lockstep behavior.
+The old implementation is in another branch `OldImplementation`, it should be considered as being archived and will hardly receive feature updates.
 
-In this work, we propose MIDAS, short for Microcluster-Based Detector of Anomalies in Edge Streams, which detects microcluster anomalies, or suddenly arriving groups of suspiciously similar edges, in edge streams, using constant time and memory. In addition, by using a principled hypothesis testing framework, MIDAS provides theoretical bounds on the false positive probability, which earlier methods do not provide. Also, we are up to 48% more accurate while being up to 644 times faster than state of the art approaches.
+![](asset/Intro.png)
 
-For more details, please read the paper - [MIDAS:Microcluster-Based Detector of Anomalies in Edge Streams](https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf). *Siddharth Bhatia, Bryan Hooi, Minji Yoon, Kijung Shin, Christos Faloutsos*. AAAI 2020.
+## Table of Contents
 
+- [Features](#features)
+- [Demo](#demo)
+- [Customization](#customization)
+- [Online Articles](#online-articles)
+- [MIDAS in other Languages](#midas-in-other-languages)
+- [Citation](#citation)
 
-## Getting started
-1. Run `make` to compile code and create the binary.
-2. Run `./midas -i ` followed by the input file path and name.
-3. Run `make clean` to clean binaries.
+## Features
 
+- Finds Anomalies in Dynamic/Time-Evolving Graph: (Intrusion Detection, Fake Ratings, Financial Fraud)
+- Detects Microcluster Anomalies (suddenly arriving groups of suspiciously similar edges e.g. DoS attack)
+- Theoretical Guarantees on False Positive Probability
+- Constant Memory (independent of graph size)
+- Constant Update Time (real-time anomaly detection to minimize harm)
+- Up to 55% more accurate and 929 times faster than the state of the art approaches
+- Some experiments are performed on the following datasets: 
+  - [DARPA](https://www.ll.mit.edu/r-d/datasets/1998-darpa-intrusion-detection-evaluation-dataset)
+  - [TwitterWorldCup2014](http://odds.cs.stonybrook.edu/twitterworldcup2014-dataset)
+  - [TwitterSecurity](http://odds.cs.stonybrook.edu/twittersecurity-dataset)
 
 ## Demo
-1. Run `./demo.sh` to compile the code and run it on example dataset.
 
+If you use Windows:
 
-## Command line options
-  * `-h --help`: produce help message
-  * `-i --input`: input file name
-  * `-o --output`: output file name (default: scores.txt)  
-  * `-r --rows`: Number of Hash Functions (default: 2)  
-  * `-b --buckets`: Number of Buckets (default: 769)  
-  * `-a --alpha`: Temporal Decay Factor (default: 0.6)  
-  * `--norelations` : Run MIDAS instead of MIDAS-R
-  * `--undirected` : Treat graph as undirected instead of directed
+1. Open a Visual Studio developer command prompt, we want their toolchain
+1. `cd` to the project root `MIDAS/`
+1. `cmake -DCMAKE_BUILD_TYPE=Release -G "NMake Makefiles" -S . -B build/release`
+1. `cmake --build build/release --target Demo`
+1. `cd` to `MIDAS/build/release/src`
+1. `.\Demo.exe`
 
+If you use Linux/macOS systems:
 
-## Input file format
-MIDAS expects the input edge stream to be stored in a single file containing the following three columns in order:
-1. `source (int)`: source ID of the edge
-2. `destination (int)`: destination ID of the edge
-3. `time (int)`: time stamp of the edge
+1. Open a terminal
+1. `cd` to the project root `MIDAS/`
+1. `cmake -DCMAKE_BUILD_TYPE=Release -S . -B build/release`
+1. `cmake --build build/release --target Demo`
+1. `cd` to `MIDAS/build/release/src`
+1. `./Demo`
 
-Thus, each line represents an edge. Edges should be sorted in non-decreasing order of their time stamps and the column delimiter should be `,`
+The demo runs on `MIDAS/data/DARPA/darpa_processed.csv`, which has 4.5M records, with the filtering core.
 
+The scores will be exported to `MIDAS/temp/Score.txt`, higher means more anomalous.
 
-## Datasets
-1. [DARPA](https://www.ll.mit.edu/r-d/datasets/1998-darpa-intrusion-detection-evaluation-dataset)
-2. [TwitterWorldCup2014](http://odds.cs.stonybrook.edu/twitterworldcup2014-dataset)
-3. [TwitterSecurity](http://odds.cs.stonybrook.edu/twittersecurity-dataset)
+All file paths are absolute and "hardcoded" by CMake, but it's suggested NOT to run by double-click on the executable file.
+
+## Customization
+
+### Switch Cores
+
+Cores are instantiated at `MIDAS/example/Demo.cpp:64-66`, uncomment the chosen one.
+
+### Custom Dataset + `Demo.cpp`
+
+You need to prepare three files:
+
+- Meta file
+  - Only includes an integer `N`, the number of records in the dataset
+  - Use its path for `pathMeta`
+- Data file
+  - A header-less csv format file of shape `[N,3]`
+  - Columns are sources, destinations, timestamps
+  - Use its path for `pathData`
+- Label file
+  - A header-less csv format file of shape `[N,1]`
+  - The corresponding label for data records
+    - 0 means normal record
+    - 1 means anomalous record
+  - Use its path for `pathGroundTruth` 
+
+### Custom Dataset + Custom Runner
+
+1. Include the header `MIDAS/CPU/NormalCore.hpp`, `MIDAS/CPU/RelationalCore.hpp` or `MIDAS/CPU/FilteringCore.hpp`
+1. Instantiate cores with required parameters
+1. Call `operator()` on individual data records, it returns the anomaly score for the input record.
+
+## Online Articles
+
+1. KDnuggets: [Introducing MIDAS: A New Baseline for Anomaly Detection in Graphs](https://www.kdnuggets.com/2020/04/midas-new-baseline-anomaly-detection-graphs.html)
+2. Towards Data Science: [Controlling Fake News using Graphs and Statistics](https://towardsdatascience.com/controlling-fake-news-using-graphs-and-statistics-31ed116a986f)
+2. Towards Data Science: [Anomaly detection in dynamic graphs using MIDAS](https://towardsdatascience.com/anomaly-detection-in-dynamic-graphs-using-midas-e4f8d0b1db45)
+4. Towards AI: [Anomaly Detection with MIDAS](https://medium.com/towards-artificial-intelligence/anomaly-detection-with-midas-2735a2e6dce8)
+5. [AIhub Interview](https://aihub.org/2020/05/01/interview-with-siddharth-bhatia-a-new-approach-for-anomaly-detection/)
+
+## MIDAS in Other Languages
+
+1. [Golang](https://github.com/steve0hh/midas) by [Steve Tan](https://github.com/steve0hh)
+2. [Ruby](https://github.com/ankane/midas) by [Andrew Kane](https://github.com/ankane)
+3. [Rust](https://github.com/scooter-dangle/midas_rs) by [Scott Steele](https://github.com/scooter-dangle)
+4. [R](https://github.com/pteridin/MIDASwrappeR) by [Tobias Heidler](https://github.com/pteridin)
+5. [Python](https://github.com/ritesh99rakesh/pyMIDAS) by [Ritesh Kumar](https://github.com/ritesh99rakesh)
 
 ## Citation
+
 If you use this code for your research, please consider citing our paper.
 
 ```
-@article{bhatia2019midas,
-  title={MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams},
-  author={Bhatia, Siddharth and Hooi, Bryan and Yoon, Minji and Shin, Kijung and Faloutsos, Christos},
-  journal={arXiv preprint arXiv:1911.04464},
-  year={2019}
+@inproceedings{bhatia2020midas,
+    title="MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams",
+    author="Siddharth {Bhatia} and Bryan {Hooi} and Minji {Yoon} and Kijung {Shin} and Christos {Faloutsos}",
+    booktitle="AAAI 2020 : The Thirty-Fourth AAAI Conference on Artificial Intelligence",
+    year="2020"
 }
-```
+```

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: midas-edge
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-19 00:00:00.000000000 Z
+date: 2020-06-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rice
@@ -112,14 +112,6 @@ files:
 - lib/midas/version.rb
 - vendor/MIDAS/LICENSE
 - vendor/MIDAS/README.md
-- vendor/MIDAS/anom.cpp
-- vendor/MIDAS/anom.hpp
-- vendor/MIDAS/argparse.hpp
-- vendor/MIDAS/edgehash.cpp
-- vendor/MIDAS/edgehash.hpp
-- vendor/MIDAS/main.cpp
-- vendor/MIDAS/nodehash.cpp
-- vendor/MIDAS/nodehash.hpp
 homepage: https://github.com/ankane/midas
 licenses:
 - MIT

data/vendor/MIDAS/anom.cpp

@@ -1,88 +0,0 @@
-#define MIN(X, Y) (((X) < (Y)) ? (X) : (Y))
-#define MAX(X, Y) (((X) > (Y)) ? (X) : (Y))
-
-#include <iostream>
-#include <math.h>
-#include <algorithm>
-#include <vector>
-#include "anom.hpp"
-#include "edgehash.hpp"
-#include "nodehash.hpp"
-
-vector<double>* midas(vector<int>& src, vector<int>& dst, vector<int>& times, int num_rows, int num_buckets)
-{
-    int m = *max_element(src.begin(), src.end());
-    Edgehash cur_count(num_rows, num_buckets, m);
-    Edgehash total_count(num_rows, num_buckets, m);
-    vector<double>* anom_score = new vector<double>(src.size());
-    int cur_t = 1, size = src.size(), cur_src, cur_dst;
-    double cur_mean, sqerr, cur_score;
-    for (int i = 0; i < size; i++) {
-
-        if (i == 0 || times[i] > cur_t) {
-            cur_count.clear();
-            cur_t = times[i];
-        }
-
-        cur_src = src[i];
-        cur_dst = dst[i];
-        cur_count.insert(cur_src, cur_dst, 1);
-        total_count.insert(cur_src, cur_dst, 1);
-        cur_mean = total_count.get_count(cur_src, cur_dst) / cur_t;
-        sqerr = pow(cur_count.get_count(cur_src, cur_dst) - cur_mean, 2);
-        if (cur_t == 1) cur_score = 0;
-        else cur_score = sqerr / cur_mean + sqerr / (cur_mean * (cur_t - 1));
-        (*anom_score)[i] = cur_score;
-    }
-
-    return anom_score;
-}
-
-double counts_to_anom(double tot, double cur, int cur_t)
-{
-    double cur_mean = tot / cur_t;
-    double sqerr = pow(MAX(0, cur - cur_mean), 2);
-    return sqerr / cur_mean + sqerr / (cur_mean * MAX(1, cur_t - 1));
-}
-
-vector<double>* midasR(vector<int>& src, vector<int>& dst, vector<int>& times, int num_rows, int num_buckets, double factor)
-{
-    int m = *max_element(src.begin(), src.end());
-    Edgehash cur_count(num_rows, num_buckets, m);
-    Edgehash total_count(num_rows, num_buckets, m);
-    Nodehash src_score(num_rows, num_buckets);
-    Nodehash dst_score(num_rows, num_buckets);
-    Nodehash src_total(num_rows, num_buckets);
-    Nodehash dst_total(num_rows, num_buckets);
-    vector<double>* anom_score = new vector<double>(src.size());
-    int cur_t = 1, size = src.size(), cur_src, cur_dst;
-    double cur_score, cur_score_src, cur_score_dst, combined_score;
-
-    for (int i = 0; i < size; i++) {
-    	
-        if (i == 0 || times[i] > cur_t) {
-            cur_count.lower(factor);
-            src_score.lower(factor);
-            dst_score.lower(factor);
-            cur_t = times[i];
-        }
-
-        cur_src = src[i];
-        cur_dst = dst[i];
-        cur_count.insert(cur_src, cur_dst, 1);
-        total_count.insert(cur_src, cur_dst, 1);
-        src_score.insert(cur_src, 1);
-        dst_score.insert(cur_dst, 1);
-        src_total.insert(cur_src, 1);
-        dst_total.insert(cur_dst, 1);
-        cur_score = counts_to_anom(total_count.get_count(cur_src, cur_dst), cur_count.get_count(cur_src, cur_dst), cur_t);
-        cur_score_src = counts_to_anom(src_total.get_count(cur_src), src_score.get_count(cur_src), cur_t);
-        cur_score_dst = counts_to_anom(dst_total.get_count(cur_dst), dst_score.get_count(cur_dst), cur_t);
-        //combined_score = MAX(cur_score_src, cur_score_dst) + cur_score;
-        //combined_score = cur_score_src + cur_score_dst + cur_score;
-        combined_score = MAX(MAX(cur_score_src, cur_score_dst), cur_score);
-        (*anom_score)[i] = log(1 + combined_score);
-    }
-
-    return anom_score;
-}