event detection in time series of mobile communication graphs leman akoglu christos faloutsos
TRANSCRIPT
EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS
Leman Akoglu Christos Faloutsos
MOTIVATION
Cyber warfare Network intrusion Epidemic outbreaks Fault detection in
engineering systems
Anomaly and event (change-point) detection, is the building block for many applications:
2 of 20Leman Akoglu
DATA DESCRIPTION
Texting interactions of mobile phone users from a phone service company in a large city in India
who-texts-whom network edge-weighted: #SMS
>2 million customers 50 million SMS interactions Dec. 1, 2007 to May 31,
20083 of 20
Leman Akoglu
PROBLEM STATEMENTGiven a graph that changes over time, can we identify: 1) “change detection”: time points at which
many of the N nodes change their behavior significantly?
2) “attribution”: top k nodes which contribute to the change in behavior the most?
4 of 20Leman Akoglu
PROBLEM STATEMENT
Two main considerations: N is very large (on the order of 106)
monitoring each node independently is not practical.
“Anomaly” is defined in a collective setting a time-point/node is anomalous if
different than “others”
5 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
6 of 20Leman Akoglu
FEATURE EXTRACTION
Extract features from egonets for all nodes 1. Indegree/outdegree2. Inweight/outweight3. Number of neighbors4. Number of edges5. Reciprocal degree6. …
egonet
7 of 20Leman Akoglu
DATA IN 3-DNodes (>2 million)
Time(183 days)
Features (12)
8 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
9 of 20Leman Akoglu
DERIVING “EIGEN-BEHAVIOR”
N
T
F
T
N
T
N
F:inweight
W
principal eigenvector“typical behavior”“eigen-behavior”
active node high scoree.g. nodes 1, 2, 6
N
10 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
11 of 20Leman Akoglu
TRACKING “BEHAVIOR” OVER TIMEN
T
F
T
N
T
N
F:inweight
WW
past pattern
eigen-behavior at tchange metric:
angle θ eigen-behaviors
N
12 of 20Leman Akoglu
DETECTED CHANGE POINTSEX
PER
IMEN
TS
F:inweight
Christian New Year
“back to work”
Hindi New Year
13 of 20Leman Akoglu
DETECTED CHANGE POINTS
F: reciprocal degree
EX
PER
IMEN
TSF: out-degree
Similar behavior for other features
14 of 20Leman Akoglu
PROBLEM STATEMENT
Given a graph that changes over time, can we identify: 1) “change detection”: time points at which
many of the N nodes change their behavior significantly?
2) “attribution”: top k nodes which contribute to the change in behavior the most?
15 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EX
PER
IMEN
TS
F:inweightDEC 26
no change
zone
u(t)
r(t-1)
16 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EX
PER
IMEN
TS
Time series of top 5 nodes marked
26 DEC
26 DEC
time (days)
#
SM
S r
eceiv
ed
17 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EX
PER
IMEN
TS
JAN 2 “back to work”
re
cip
rocal
deg
ree
time (days)
18 of 20Leman Akoglu
CONCLUSION
An algorithm based on tracking “eigenbehavior” patterns over time “change detection”: spot time-points at
which “behavior” changes significantly “attribution”: spot nodes that cause the
most change Experiments: on real, SMS messages,
2M users, over 6 months
19 of 20Leman Akoglu
THANK YOU
www.cs.cmu.edu/~lakogluEmail: [email protected]
26 DECChristian New Year
“back to work”
Hindi New Year
change detection attribution20 of 20
Leman Akoglu