EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

1
EVENT DETECTION IN TIME SERIES OF MOBILE
COMMUNICATION GRAPHS

• Leman Akoglu Christos Faloutsos

2
MOTIVATION
Anomaly and event (change-point) detection, is
the building block for many applications

• Cyber warfare
• Network intrusion
• Epidemic outbreaks
• Fault detection in engineering systems

3
DATA DESCRIPTION

• Texting interactions of mobile phone users from a
  phone service company in a large city in India
• who-texts-whom network
• edge-weighted SMS
• gt2 million customers
• 50 million SMS interactions
• Dec. 1, 2007 to May 31, 2008

4
PROBLEM STATEMENT

• Given a graph that changes over time,
• can we identify
• 1) change detection time points at which
  many of the N nodes change their behavior
  significantly?
• 2) attribution top k nodes which contribute
  to the change in behavior the most?

5
PROBLEM STATEMENT

• Two main considerations
• N is very large (on the order of 106)
• ? monitoring each node independently is not
  practical.
• Anomaly is defined in a collective setting
• ? a time-point/node is anomalous if
  different than others

6
OVERVIEW OF OUR METHOD

1. Extract features for nodes
2. Derive the typical behavior (eigen-behavior) of
   nodes
3. Compare eigenbehaviors over time

7
FEATURE EXTRACTION

• Extract features from
• egonets for all nodes
• Indegree/outdegree
• Inweight/outweight
• Number of neighbors
• Number of edges
• Reciprocal degree

8
DATA IN 3-D
Nodes (gt2 million)
Features (12)
Time (183 days)
9
OVERVIEW OF OUR METHOD

1. Extract features for nodes
2. Derive the typical behavior (eigen-behavior) of
   nodes
3. Compare eigenbehaviors over time

10
DERIVING EIGEN-BEHAVIOR
W
N
Finweight
principal eigenvector ?typical
behavior ?eigen-behavior
active node ? high score e.g. nodes 1, 2, 6
11
OVERVIEW OF OUR METHOD

1. Extract features for nodes
2. Derive the typical behavior (eigen-behavior) of
   nodes
3. Compare eigenbehaviors over time

12
TRACKING BEHAVIOR OVER TIME
W
W
N
Finweight

past pattern
change metric angle ?
eigen-behavior at t
eigen-behaviors
13
DETECTED CHANGE POINTS
EXPERIMENTS
Finweight
Christian New Year
Hindi New Year
back to work
14
DETECTED CHANGE POINTS
EXPERIMENTS
F reciprocal degree
F out-degree
Similar behavior for other features
15
PROBLEM STATEMENT

• Given a graph that changes over time,
• can we identify
• 1) change detection time points at which
  many of the N nodes change their behavior
  significantly?
• 2) attribution top k nodes which contribute
  to the change in behavior the most?

16
ATTRIBUTING CHANGE TO NODES
EXPERIMENTS
Finweight
DEC 26
no change zone
r(t-1)
u(t)
17
ATTRIBUTING CHANGE TO NODES
EXPERIMENTS
26 DEC
26 DEC
SMS received
time (days)
Time series of top 5 nodes marked
18
ATTRIBUTING CHANGE TO NODES
EXPERIMENTS
JAN 2
back to work
reciprocal degree
time (days)
19
CONCLUSION

• An algorithm based on tracking eigenbehavior
  patterns over time
• change detection spot time-points at which
  behavior changes significantly
• attribution spot nodes that cause the most
  change
• Experiments on real, SMS messages, 2M users,
  over 6 months

20
THANK YOU www.cs.cmu.edu/lakoglu Email
lakoglu_at_cs.cmu.edu
attribution
change detection