MIDAS detects microcluster anomalies from an edge stream in constant time and memory, while providing theoretical guarantees about its false positive probability.

Microcluster anomalies are suddenly arriving groups of suspiciously similar edges, such as lockstep behavior and denial of service attacks in network traffic data.

Arxiv paper link: https://arxiv.org/abs/1911.04464