1 / 20

EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS. L eman Akoglu Christos Faloutsos. MOTIVATION. Anomaly and event (change-point) detection, is the building block for many applications:. Cyber warfare Network intrusion Epidemic outbreaks

dawn
Download Presentation

EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS Leman Akoglu Christos Faloutsos

  2. MOTIVATION Anomaly and event (change-point) detection, is the building block for many applications: • Cyber warfare • Network intrusion • Epidemic outbreaks • Fault detection in engineering systems

  3. DATA DESCRIPTION • Texting interactions of mobile phone users from a phone service company in a large city in India • who-texts-whom network • edge-weighted: #SMS • >2 million customers • 50 million SMS interactions • Dec. 1, 2007 to May 31, 2008

  4. PROBLEM STATEMENT Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

  5. PROBLEM STATEMENT Two main considerations: • Nis very large (on the order of 106)  monitoring each node independently is not practical. • “Anomaly” is defined in a collective setting  a time-point/node is anomalous if different than “others”

  6. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

  7. FEATURE EXTRACTION egonet Extract features from egonetsfor all nodes • Indegree/outdegree • Inweight/outweight • Number of neighbors • Number of edges • Reciprocal degree • …

  8. DATA IN 3-D Nodes (>2 million) Features (12) Time (183 days)

  9. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

  10. DERIVING “EIGEN-BEHAVIOR” N N W N N T T F F:inweight principal eigenvector “typical behavior” “eigen-behavior” active node  high score e.g. nodes 1, 2, 6 T

  11. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

  12. TRACKING “BEHAVIOR” OVER TIME N N W W N N T T F F:inweight past pattern T change metric: angle θ eigen-behavior at t eigen-behaviors

  13. DETECTED CHANGE POINTS EXPERIMENTS F:inweight Christian New Year Hindi New Year “back to work”

  14. DETECTED CHANGE POINTS EXPERIMENTS F: reciprocal degree F: out-degree Similar behavior for other features

  15. PROBLEM STATEMENT Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

  16. ATTRIBUTING CHANGE TO NODES EXPERIMENTS F:inweight DEC 26 no change zone r(t-1) u(t)

  17. ATTRIBUTING CHANGE TO NODES EXPERIMENTS 26 DEC 26 DEC #SMS received time (days) Time series of top 5 nodes marked

  18. ATTRIBUTING CHANGE TO NODES EXPERIMENTS JAN 2 “back to work” reciprocal degree time (days)

  19. CONCLUSION • An algorithm based on tracking “eigenbehavior” patterns over time • “change detection”: spot time-points at which “behavior” changes significantly • “attribution”: spot nodes that cause the most change • Experiments: on real, SMS messages, 2M users, over 6 months

  20. Christian New Year THANK YOU www.cs.cmu.edu/~lakoglu Email: lakoglu@cs.cmu.edu Hindi New Year “back to work” 26 DEC attribution change detection

More Related