Hierarchical Persistence Velocity for Network Anomaly Detection: Theory and Applications to Cryptocurrency Markets

We introduce the Overlap-Weighted Hierarchical Normalized Persistence Velocity (OW-HNPV), a novel topological data analysis method for detecting anomalies in time-varying networks. Unlike existing methods that measure cumulative topological presence, we introduce the first velocity-based perspective on persistence diagrams, measuring the rate at which features appear and disappear, automatically downweighting noise through overlap-based weighting. We also prove that OW-HNPV is mathematically stable. It behaves in a controlled, predictable way, even when comparing persistence diagrams from networks with different feature types. Applied to Ethereum transaction networks (May 2017-May 2018), OW-HNPV demonstrates superior performance for cryptocurrency anomaly detection, achieving up to 10.4% AUC gain over baseline models for 7-day price movement predictions. Compared with established methods, including Vector of Averaged Bettis (VAB), persistence landscapes, and persistence images, velocity-based summaries excel at medium- to long-range forecasting (4-7 days), with OW-HNPV providing the most consistent and stable performance across prediction horizons. Our results show that modeling topological velocity is crucial for detecting structural anomalies in dynamic networks.

💡 Research Summary

The research paper introduces a groundbreaking approach to analyzing time-varying networks through a new Topological Data Analysis (TDA) framework called Overlap-Weighted Hierarchical Normalized Persistence Velocity (OW-HNPV). While traditional TDA methods, such as Persistence Landscapes, Persistence Images, and the Vector of Averaged Betti numbers (VAB), focus on the “cumulative presence” or the duration of topological features (how long a hole or a component persists), this paper shifts the paradigm toward “topological velocity.” This new perspective measures the rate at which topological features appear and disappear within the filtration process, capturing the dynamics of structural changes rather than just their existence.

The core innovation of OW-HNPV lies in its hierarchical and overlap-based mechanism. The authors implement a multi-resolution analysis by partitioning the filtration intervals into main and sub-intervals, allowing the model to simultaneously capture both macro-level trends and micro-level fluctuations. Furthermore, instead of relying on manual thresholding to filter out noise—a common struggle in traditional TDA—the OW-HNPV method utilizes an overlap-based weighting system. By calculating the proportion of a feature’s overlap with specific intervals, the model naturally assigns higher weights to long-lived, significant features and suppresses short-lived, noisy features. This provides an automated, robust way to handle noise without human intervention.

Mathematically, the paper provides a rigorous proof of stability, demonstrating that the OW-HNPV vector maintains Lipschitz continuity with respect to the 1-Wasserstein distance. This ensures that small perturbations in the persistence diagrams do not lead to disproportionately large changes in the output, making the method reliable for comparing networks of varying scales and complexities.

The practical utility of this method was validated using Ethereum transaction networks from May 2017 to May 2018. When applied to a 7-day cryptocurrency price movement prediction task, OW-HNPV demonstrated a significant performance leap, achieving up to a 10.4% increase in AUC compared to established baselines. Notably, the velocity-based summary proved to be exceptionally stable and effective in medium-to-long-range forecasting (4-7 days), outperforming traditional methods that struggle with longer prediction horizons. The results suggest that modeling the “velocity” of topological changes is a crucial component for detecting structural anomalies in dynamic systems. This research opens new avenues for real-time anomaly detection in high-frequency financial markets, cybersecurity, and any domain where the rate of structural reconfiguration is a precursor to significant events.