1. EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS Leman Akoglu Christos Faloutsos

2. MOTIVATION Anomaly and event (change-point) detection, is the building block for many applications: • Cyber warfare • Network intrusion • Epidemic outbreaks • Fault detection in engineering systems

3. DATA DESCRIPTION • Texting interactions of mobile phone users from a phone service company in a large city in India • who-texts-whom network • edge-weighted: #SMS • >2 million customers • 50 million SMS interactions • Dec. 1, 2007 to May 31, 2008

4. PROBLEM STATEMENT Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

5. PROBLEM STATEMENT Two main considerations: • Nis very large (on the order of 106)  monitoring each node independently is not practical. • “Anomaly” is defined in a collective setting  a time-point/node is anomalous if different than “others”

6. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

7. FEATURE EXTRACTION egonet Extract features from egonetsfor all nodes • Indegree/outdegree • Inweight/outweight • Number of neighbors • Number of edges • Reciprocal degree • …

8. DATA IN 3-D Nodes (>2 million) Features (12) Time (183 days)

9. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

10. DERIVING “EIGEN-BEHAVIOR” N N W N N T T F F:inweight principal eigenvector “typical behavior” “eigen-behavior” active node  high score e.g. nodes 1, 2, 6 T

11. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

12. TRACKING “BEHAVIOR” OVER TIME N N W W N N T T F F:inweight past pattern T change metric: angle θ eigen-behavior at t eigen-behaviors

13. DETECTED CHANGE POINTS EXPERIMENTS F:inweight Christian New Year Hindi New Year “back to work”

14. DETECTED CHANGE POINTS EXPERIMENTS F: reciprocal degree F: out-degree Similar behavior for other features

15. PROBLEM STATEMENT Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

16. ATTRIBUTING CHANGE TO NODES EXPERIMENTS F:inweight DEC 26 no change zone r(t-1) u(t)

17. ATTRIBUTING CHANGE TO NODES EXPERIMENTS 26 DEC 26 DEC #SMS received time (days) Time series of top 5 nodes marked

18. ATTRIBUTING CHANGE TO NODES EXPERIMENTS JAN 2 “back to work” reciprocal degree time (days)

19. CONCLUSION • An algorithm based on tracking “eigenbehavior” patterns over time • “change detection”: spot time-points at which “behavior” changes significantly • “attribution”: spot nodes that cause the most change • Experiments: on real, SMS messages, 2M users, over 6 months

20. Christian New Year THANK YOU www.cs.cmu.edu/~lakoglu Email: lakoglu@cs.cmu.edu Hindi New Year “back to work” 26 DEC attribution change detection