It is interesting to mix EVT and GANs. Importance Splitting, a statistical tool that estimates probability of rare events and generates some of them, may also be closely related.
Ah alright, that makes sense. But it works only when the destination is the same. In a setting where there are multiple web-hosting servers, you would need to treat a group of source and destination points as micro-clusters themselves.
1) Do you use sliding window approach or exponential decay?
2) When you say groups of similar edges, do they have to be spatially close to each other? or can they be equally distributed in the graph?
3) Can an attacker figure out the optimum time difference between his attacks such that MIDAS doesn't detect it as an anomaly? The time gap is just sufficient enough for the algorithm to weed out the potentially malicious micro-cluster as obsolete.
Seems like an interesting extension to your work. Best of luck!