This article examines a collection of assumptions used in the current literature on node anomaly detection in a network. The examination raises the question: What are anomalies in a network? Our attempt to answer this question has provided some interesting findings and led to some open questions. This is the first article which formally defines anomalies in a network and introduces the concept of self-verifiability of a detector without ground-truths in a network. They enable existing detectors to be categorized into two types along the line whether they are self-verifiable or not. We suggest a method to evaluate self-verifiable detectors without ground-truths as an alternative to the existing evaluation method that relies on ground-truths.

Time series is traditionally treated with two main approaches, i.e., the time domain approach and the frequency domain approach. These approaches must rely on a sliding window so that time-shift versions of a periodic subsequence can be measured to be similar. Coupled with the use of a root point-to-point measure, existing methods often have quadratic time complexity. We offer the third R domain approach. It begins with an insight that subsequences in a periodic time series can be treated as sets of independent and identically distributed (iid) points generated from an unknown distribution in R. This R domain treatment enables two new possibilities: (a) the similarity between two subsequences can be computed using a distributional measure such as Wasserstein distance (WD), kernel mean embedding or Isolation Distributional kernel (IDK); and (b) these distributional measures become non-sliding-window-based. Together, they offer an alternative that has more effective similarity measurements and runs significantly faster than the point-to-point and sliding-window-based measures. Our empirical evaluation shows that IDK and WD are effective distributional measures for time series; and IDK-based detectors have better detection accuracy than existing sliding-window-based detectors, and they run faster with linear time complexity.