on community outliers and their efficient detection in information networks

On Community Outliers and their Efficient Detection in Information

NetworksJing Gao1, Feng Liang1, Wei Fan2,

Chi Wang1, Yizhou Sun1, Jiawei Han1

University of Illinois, IBM TJ WatsonDebapriya Basu

2

OBJECTIVES

Determine outliers in information networks Compare various algorithms which does the

same

3

CHARACTERISTICS OF INFORMATION NETWORK

Eg Internet, Social Networking Sites Nodes – characterized by feature values Links - representative of relation between

nodes

4

Outliers – anomalies, novelties Different kinds of outliers

◦ Global◦ Contextual

OUTLIERS

5

OUTLIERS IN INFORMATION NETWORKS

V7

10

V9

V8

30

V10

40 70 100 110 140 160

V6 V1 V4 V5 V3 V2

Global Outlier

Salary (in $1000)

6

COMMUNITY OUTLIER Unified model considering both nodes and

links Community discovery and outlier detection

are related processes

7

SUMMARY OF THE APPROACH Treat each object as a multivariate data point Use K components to describe normal

community behavior and one component to denote outliers

Induce a hidden variable zi at each object indicating community

Treat network information as a graph Model the graph as a Hidden Markov Random

Field on zi Find the local minimum of the posterior

probability potential energy of the model.

8

UNIFIED PROBABILISTIC MODELcommunity

label Zoutlier

node feature

Xlink

structure W

high-income:mean: 116k

std: 35k

low-income:mean: 20k

std: 12k

model parameter

sK: number of communities

9

SYMBOLS IN THE MODEL

Symbol DefinitionI = {1,2,3….i,..M} Indices of the objectsV = {v1,v2….vm} Set of objectsS = {s1,s2,….sm} Given attributes of

objectsWM*M = {wij} Adjacency matrix

containing the weights of the links

Z = {z1,…..,zm} RVs for hidden labels of objects

X = {x1,…..,xm} RVs for observed dataNi (i ∈ I) Neighborhood of object

vi

1,….,k,….K Indices of normal communities

Θ = {Θ1, Θ2,……, Θk} R.Vs for model parameters

10

◦ Set of R.Vs X are conditionally independent given their labelsP(X=S|Z) = ΠP(xi=si|zi)

◦ Kth normal community is characterized by a set of parametersP(xi=si|zi =k) = P(xi=si|Θk)

◦ Outliers are characterized by uniform distribution◦ P(xi=si|zi =0) = ρ0◦ Markov random field is defined over hidden variable Z ◦ P(zi|zI-{i}) = P(zi|zNi)◦ The equivalent Gibbs distribution is P(Z) = exp(-U(Z))*1/H1

H1 = normalizing constant, U(Z) = sum of clique potentials.◦ Goal is to find the configuration of z that maximizes

P(X=S|Z)P(Z) for a given Θ

THE MODEL

11

MODELING DATA Continuous Data

◦ Is modeled as Gaussian distribution◦ Model parameters: mean, standard deviation

Text Data◦ Is modeled as Multinomial distribution◦ Model parameters: probability of a word

appearing in a community

12

COMMUNITY OUTLIER DETECTION ALGORITHM

Given Θ, find Z that maximizes P(Z|X)

Given Z, find Θthat maximizes P(X|Z)

Initialize Z

INFERENCE

PARAMETER ESTIMATION

Θ : model parametersZ: community labels

13

PARAMETER ESTIMATION Calculate model parameters

◦ maximum likelihood estimation Continuous

◦ mean: sample mean of the community◦ standard deviation: square root of the sample

variance of the community Text

◦ probability of a word appearing in the community: empirical probability

14

INFERENCES Calculate Zi values

◦ Given Model parameters,◦ Iteratively update the community labels of nodes at

each timestep◦ Select the label that maximizes P(Z|X,ZN)

Calculate P(Z|X,ZN) values◦ Both the node features and community labels of

neighbors if Z indicates a normal community◦ If the probability of a node belonging to any community

is low enough, label it as an outlier

15

DISCUSSIONS Setting Hyper parameters

◦ a0 = threshold ◦ Λ = confidence in the network◦ K = number of communities

Initialization◦ Group outliers in clusters.◦ It will eventually get corrected.

16

SIMULATED EXPERIMENTS Data Generation

◦ Generate continuous data based on Gaussian distributions and generate labels according to the model

◦ Define r: percentage of outliers, K: number of communities

Baseline models◦ GLODA: global outlier detection (based on node

features only)◦ DNODA: local outlier detection (check the feature

values of direct neighbors)◦ CNA: partition data into communities based on links

and then conduct outlier detection in each community

17

TRUE POSITIVE RATE(Top r% as outliers)

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

r=1% K=5 r=5% K=5 r=1% K=8 r=5% K=8

GLODADNODACNACODA

18

EXPERIMENTS ON DBLP Communities

◦ data mining, artificial intelligence, database, information analysis

Sub network of Conferences Links: percentage of common authors among two

conferences Node features: publication titles in the conference

Sub network of Authors Links: co-authorship relationship Node features: titles of publications by an author

19

RESULTS

Community outliers: CVPR CIKM

20

CONCLUSIONS

Community Outliers

Community Outlier Detection

QUESTIONS

21

REFERENCES

On Community Outliers and their Efficient Detection in Information Networks – Gao, Liang, Fan, Wang, Sun, Han

Outlier detection – Irad Ben-Gal Automated detection of outliers in real-world data –

Last, Kandel Outlier Detection for High Dimensional Data –

Aggarwal, Yu