The derivatives with regard to r **are given by eq.(16).**

$$\begin{array}{r l}{{\frac{\partial L(\mathbf{\theta})}{\partial r_{n m}}}}&{{}=}\\ {}&{{}}\\ {}&{{}}\\ {}&{{}}\end{array}$$
$$\sum_{i=0}^{D-1}[f_{n}\mathbf{d}_{in}(2\mathbf{d}_{im}-1)$$ $$\prod_{k\neq m}\{1-d_{ik}+(2\mathbf{d}_{ik}-1)r_{nk}\}$$ $$\sum_{j=0}^{N-1}\mathbf{d}_{ij}f_{j}\prod_{k=0}^{N-1}\{1-\mathbf{d}_{ik}+(2\mathbf{d}_{ik}-1)r_{jk}\}].\tag{16}$$  $\mathbf{d}_{ij}$\(\mathbf{d}_{
×Y

![0_image_0.png](0_image_0.png)

The derivatives with regard to f **are given by eq.(17).**

$$\frac{\partial L(\theta)}{\partial f_{n}}\quad=\quad$$  $$\frac{\partial L(\theta)}{\partial f_{n}}\quad=\quad$$
$$\sum_{i=0}^{D-1}[\mathbf{d}_{in}\prod_{k=0}^{N-1}\{1-\mathbf{d}_{ik}+(2\mathbf{d}_{ik}-1)r_{nk}\}$$ $$\sum_{j=0}^{N-1}\mathbf{d}_{ij}f_{j}\prod_{k=0}^{N-1}\{1-\mathbf{d}_{ik}+(2\mathbf{d}_{ik}-1)r_{jk}\}].$$

The ranking function s(di) is the inverse of the probability at which di **realizes under the maximal likelihood**
estimator θ**ˆ. According to the anomaly detection technique, it gives a higher return value to the suspicious**
surveillance logs which are less likely to realize without the covert nodes. The ranking function is given by eq.(18).

$$s(d_{i})=\frac{1}{p(d_{i}|\hat{\boldsymbol{\theta}})}.\tag{18}$$

The i-th most suspicious log is given by dσ(i) **by the**
same formula in eq.(6).

## 5 Test Dataset 5.1 Network

Two classes of networks are employed to generate a test dataset for performance evaluation of the two methods. The first class is computationally synthesized networks.

The second class is a real clandestine organization.

The networks [A] in Figure 1 and [B] in Figure 2 are synthesized computationally. They are based on the Barab´asi-Albert model [Barab´asi (1999)] with a cluster structure. The Barab´asi-Albert model grows with preferential attachment. The probability where a newly coming node nk **connects a link to an existing node** nj is proportional to the nodal degree of nj (p(k → j) ∝ K(nj **)). The occurrence frequency of the nodal degree**
tends to be scale-free (F(K) ∝ Ka**). In the Barab´asiAlbert model with a cluster structure, every node** nj is assigned a pre-determined cluster attribute c(nj **) to**
which it belongs. The number of clusters is C**. The** probability p(k → j**) is modified to eq.(19). cluster**
contrast parameter η **is introduced. Links between the**

![0_image_1.png](0_image_1.png)

