EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS
20
EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS Leman Akoglu Christos Faloutsos
description
EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS. L eman Akoglu Christos Faloutsos. MOTIVATION. Anomaly and event (change-point) detection, is the building block for many applications:. Cyber warfare Network intrusion Epidemic outbreaks - PowerPoint PPT Presentation
Transcript of EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS
EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS Leman Akoglu Christos
Faloutsos
MOTIVATION
Cyber warfare Network intrusion Epidemic outbreaks Fault detection in
engineering systems
Anomaly and event (change-point) detection, is the building block for many applications:
2 of 20Leman Akoglu
DATA DESCRIPTION Texting interactions of
mobile phone users from a phone service company in a large city in India
who-texts-whom network edge-weighted: #SMS
>2 million customers 50 million SMS interactions Dec. 1, 2007 to May 31,
20083 of 20
Leman Akoglu
PROBLEM STATEMENTGiven a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly?2) “attribution”: top k nodes which contribute to the change in behavior the most?
4 of 20Leman Akoglu
PROBLEM STATEMENT
Two main considerations: N is very large (on the order of 106)
monitoring each node independently is not practical.
“Anomaly” is defined in a collective setting a time-point/node is anomalous if
different than “others”
5 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
6 of 20Leman Akoglu
FEATURE EXTRACTIONExtract features from egonets for all nodes 1. Indegree/outdegree2. Inweight/outweight3. Number of neighbors4. Number of edges5. Reciprocal degree6. …
egonet
7 of 20Leman Akoglu
DATA IN 3-DNodes (>2 million)
Time(183 days)
Features (12)
8 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
9 of 20Leman Akoglu
DERIVING “EIGEN-BEHAVIOR”N
T
F
T
N
T
N
F:inweight
W
principal eigenvector“typical behavior”“eigen-behavior”
active node high scoree.g. nodes 1, 2, 6
N
10 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
11 of 20Leman Akoglu
TRACKING “BEHAVIOR” OVER TIMEN
T
F
T
N
T
N
F:inweight
WW
past pattern
eigen-behavior at tchange metric:
angle θ eigen-behaviors
N
12 of 20Leman Akoglu
DETECTED CHANGE POINTSEXPERIM
ENTS
F:inweight
Christian New Year
“back to work”
Hindi New Year
13 of 20Leman Akoglu
DETECTED CHANGE POINTS
F: reciprocal degree
EXPERIMEN
TSF: out-degree
Similar behavior for other features14 of 20
Leman Akoglu
PROBLEM STATEMENTGiven a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly?2) “attribution”: top k nodes which contribute to the change in behavior the most?
15 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EXPERIMEN
TS
F:inweightDEC 26
no chan
ge
zone
u(t)
r(t-1)
16 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EXPERIMEN
TS
Time series of top 5 nodes marked
26 DEC
26 DEC
time (days)
#SM
S re
ceiv
ed
17 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EXPERIMEN
TS
JAN 2 “back to work”
reci
proc
al
degr
ee
time (days)
18 of 20Leman Akoglu
CONCLUSION An algorithm based on tracking
“eigenbehavior” patterns over time “change detection”: spot time-points at
which “behavior” changes significantly “attribution”: spot nodes that cause the
most change Experiments: on real, SMS messages,
2M users, over 6 months
19 of 20Leman Akoglu
THANK YOU
www.cs.cmu.edu/~lakogluEmail: [email protected]
26 DECChristian New Year
“back to work”
Hindi New Year
change detection attribution20 of 20
Leman Akoglu
