MIDAS detects microcluster anomalies from an edge stream in constant time and memory, while providing theoretical guarantees about its false positive probability. Microcluster anomalies are suddenly arriving groups of suspiciously similar edges, such as lockstep behavior and denial of service attacks in network traffic data.

Paper: https://www.comp.nus.edu.sg/~sbhatia/assets/pdf/midas.pdf (Accepted at AAAI 2020)

Code: https://github.com/bhatiasiddharth/MIDAS

Feedback is welcome!