1 / 25

Identifying abnormal patterns in cellular communication flows

Identifying abnormal patterns in cellular communication flows. IPTCOMM 2013 Principles, Systems and Applications of IP Telecommunications October 15 - 17, 2013. David Goergen 1 Veena Mendiratta 2 Radu State 1 Thomas Engel 1. OUTLINE. Introduction Related Work Model / Metric D4D Dataset

eve
Download Presentation

Identifying abnormal patterns in cellular communication flows

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Identifying abnormal patterns in cellular communication flows IPTCOMM 2013 Principles, Systems and Applications of IP Telecommunications October 15 - 17, 2013 David Goergen1 Veena Mendiratta2 Radu State1 Thomas Engel1

  2. OUTLINE • Introduction • Related Work • Model / Metric • D4D Dataset • Evaluation • Future work • Conclusion IPTCOMM 2013

  3. Intro • Analyzing large volumes of cellular communications records • Can help to improve the overall quality it provides to its users • Allows operators to detect abnormal patterns and react accordingly • Definition of model and metric to detectabnormaltraffic • Application on a country-level data set • Correlateddetectedflowswithevents IPTCOMM 2013

  4. D4D Dataset specification • One country • Time Period: 01.12.2011 to 28.04.2012 • 5 million users • 1124 base stations (for mobile communications) • More then 3 billion entries summarizing on a hourly basis the SMS and Voice Calls • 50000 mobile users tracked over these months with GPS and call records IPTCOMM 2013

  5. D4D Dataset specification • Set 1: Base station-to-base station ongoingcalls • Set 2: User movementamong base stations • Set 3: User movementamongregion subdivision • Set 4: Communication sub-graphs IPTCOMM 2013

  6. Related Work • S. van den Elzen, D. H. Jorik Blaas, J.-K. Buenen, J. J. van Wijk, R. Spousta, A. Miao, S. Sala, and S. Chan. Exploration and Analysis of Massive Mobile Phone Data: A Layered Visual Analytics approach. In NetMob, 2013 • M. Cerinsek, J. Bodlaj, and V. Batagelj. Symbolic clustering of users and antennae. In NetMob, 2013. • G. Krings, F. Calabrese, C. Ratti, and V. D. Blondel. Urban Gravity: A Model For Intercity Telecommunication Flows. Journal Of Statistical Mechanics: Theory And Experiment, 2009, 2009 • V. A. Traag, A. Browet, F. Calabrese, and F. Morlot. Social Event Detection in Massive Mobile Phone Data Using Probabilistic Location Inference. In Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on Social Computing (SocialCom), 2011. IPTCOMM 2013

  7. Model / Metric IPTCOMM 2013

  8. Comparison Related Work Our method IPTCOMM 2013

  9. Data processing on Hadoop cluster • Hadoop 2.0.0-cdh 4.3.0 • 4 nodes • hexacore 2.4GHz Xeon • 120 GB RAM • HDFS 27.54 TB • 2 x 1GB Ethernet bonded IPTCOMM 2013

  10. Hadoop job process IIT RTC conference

  11. Metric parameters • Analyzing the impact of α and the window size w • α ↑  dataset ↑ • w ↑  dataset ↓ • Tradeoff between granularity and loss of detail • Chosen w = 10 and α = 0.5 IPTCOMM 2013

  12. Abnormal number of calls • Applying our metric • Circle • Power failures • Square • President appeared at court • Triangle • Rebelious fanatics invasion IPTCOMM 2013

  13. Abnormal duration of calls • Applying our metric • Circle • Power failures • Square • President appeared at court • Triangle • Rebelious fanatics invasion IPTCOMM 2013

  14. Closer look at specific region IPTCOMM 2013

  15. Detecting abnormal situation IPTCOMM 2013

  16. IPTCOMM 2013

  17. Observation of the highlighted period IPTCOMM 2013

  18. IPTCOMM 2013

  19. Clustering: mean duration vs mean number of calls • Group A • Small amount of calls and short to medium duration • Group B • Large amount of calls and short to medium duration •  usual diurnal behaviour of night and day communication • Group C is the outlier • Long duration and global averageamount of calls • All calls occur in the same time slot on differentdays IPTCOMM 2013

  20. Principal Component Analysis PCA on number of calls PCA on the total duration IPTCOMM 2013

  21. PCA result • Cross-referencing the results of both analyses • 10 base stations most affected by PC1 IPTCOMM 2013

  22. Future Work • Further investigate the impact of the chosen parameters • Window size and α • Graph theory analysis • Detect effects on the complete connected graph • Using page-rank or HITS algorithm IPTCOMM 2013

  23. Conclusion • Detection of abnormal traffic is possible by our metric • Large data set analysis in reasonable amount of time IPTCOMM 2013

  24. Thank you for your attentionQUESTIONS? IPTCOMM 2013

  25. Requirements IPTCOMM 2013

More Related