EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

Leman Akoglu Christos Faloutsos

MOTIVATION

Cyber warfare Network intrusion Epidemic outbreaks Fault detection in

engineering systems

Anomaly and event (change-point) detection, is the building block for many applications:

2 of 20Leman Akoglu

DATA DESCRIPTION

Texting interactions of mobile phone users from a phone service company in a large city in India

who-texts-whom network edge-weighted: #SMS

>2 million customers 50 million SMS interactions Dec. 1, 2007 to May 31,

20083 of 20

Leman Akoglu

PROBLEM STATEMENTGiven a graph that changes over time, can we identify: 1) “change detection”: time points at which

many of the N nodes change their behavior significantly?

2) “attribution”: top k nodes which contribute to the change in behavior the most?

4 of 20Leman Akoglu

PROBLEM STATEMENT

Two main considerations: N is very large (on the order of 106)

monitoring each node independently is not practical.

“Anomaly” is defined in a collective setting a time-point/node is anomalous if

different than “others”

5 of 20Leman Akoglu

OVERVIEW OF OUR METHOD

1. Extract features for nodes2. Derive the typical behavior

(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over

time

6 of 20Leman Akoglu

FEATURE EXTRACTION

Extract features from egonets for all nodes 1. Indegree/outdegree2. Inweight/outweight3. Number of neighbors4. Number of edges5. Reciprocal degree6. …

egonet

7 of 20Leman Akoglu

DATA IN 3-DNodes (>2 million)

Time(183 days)

Features (12)

8 of 20Leman Akoglu

OVERVIEW OF OUR METHOD

1. Extract features for nodes2. Derive the typical behavior

(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over

time

9 of 20Leman Akoglu

DERIVING “EIGEN-BEHAVIOR”

N

T

F

T

N

T

N

F:inweight

W

principal eigenvector“typical behavior”“eigen-behavior”

active node high scoree.g. nodes 1, 2, 6

N

10 of 20Leman Akoglu

OVERVIEW OF OUR METHOD

1. Extract features for nodes2. Derive the typical behavior

(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over

time

11 of 20Leman Akoglu

TRACKING “BEHAVIOR” OVER TIMEN

T

F

T

N

T

N

F:inweight

WW

past pattern

eigen-behavior at tchange metric:

angle θ eigen-behaviors

N

12 of 20Leman Akoglu

DETECTED CHANGE POINTSEX

PER

IMEN

TS

F:inweight

Christian New Year

“back to work”

Hindi New Year

13 of 20Leman Akoglu

DETECTED CHANGE POINTS

F: reciprocal degree

EX

PER

IMEN

TSF: out-degree

Similar behavior for other features

14 of 20Leman Akoglu

PROBLEM STATEMENT

Given a graph that changes over time, can we identify: 1) “change detection”: time points at which

many of the N nodes change their behavior significantly?

2) “attribution”: top k nodes which contribute to the change in behavior the most?

15 of 20Leman Akoglu

ATTRIBUTING CHANGE TO NODES

EX

PER

IMEN

TS

F:inweightDEC 26

no change

zone

u(t)

r(t-1)

16 of 20Leman Akoglu

ATTRIBUTING CHANGE TO NODES

EX

PER

IMEN

TS

Time series of top 5 nodes marked

26 DEC

26 DEC

time (days)

#

SM

S r

eceiv

ed

17 of 20Leman Akoglu

ATTRIBUTING CHANGE TO NODES

EX

PER

IMEN

TS

JAN 2 “back to work”

re

cip

rocal

deg

ree

time (days)

18 of 20Leman Akoglu

CONCLUSION

An algorithm based on tracking “eigenbehavior” patterns over time “change detection”: spot time-points at

which “behavior” changes significantly “attribution”: spot nodes that cause the

most change Experiments: on real, SMS messages,

2M users, over 6 months

19 of 20Leman Akoglu

THANK YOU

www.cs.cmu.edu/~lakogluEmail: lakoglu@cs.cmu.edu

26 DECChristian New Year

“back to work”

Hindi New Year

change detection attribution20 of 20

Leman Akoglu