Download
event detection in time series of mobile communication graphs n.
Skip this Video
Loading SlideShow in 5 Seconds..
EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS PowerPoint Presentation
Download Presentation
EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

207 Vues Download Presentation
Télécharger la présentation

EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS Leman Akoglu Christos Faloutsos

  2. MOTIVATION Anomaly and event (change-point) detection, is the building block for many applications: • Cyber warfare • Network intrusion • Epidemic outbreaks • Fault detection in engineering systems

  3. DATA DESCRIPTION • Texting interactions of mobile phone users from a phone service company in a large city in India • who-texts-whom network • edge-weighted: #SMS • >2 million customers • 50 million SMS interactions • Dec. 1, 2007 to May 31, 2008

  4. PROBLEM STATEMENT Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

  5. PROBLEM STATEMENT Two main considerations: • Nis very large (on the order of 106)  monitoring each node independently is not practical. • “Anomaly” is defined in a collective setting  a time-point/node is anomalous if different than “others”

  6. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

  7. FEATURE EXTRACTION egonet Extract features from egonetsfor all nodes • Indegree/outdegree • Inweight/outweight • Number of neighbors • Number of edges • Reciprocal degree • …

  8. DATA IN 3-D Nodes (>2 million) Features (12) Time (183 days)

  9. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

  10. DERIVING “EIGEN-BEHAVIOR” N N W N N T T F F:inweight principal eigenvector “typical behavior” “eigen-behavior” active node  high score e.g. nodes 1, 2, 6 T

  11. OVERVIEW OF OUR METHOD • Extract features for nodes • Derive the typical behavior (“eigen-behavior”) of nodes • Compare “eigenbehavior”s over time

  12. TRACKING “BEHAVIOR” OVER TIME N N W W N N T T F F:inweight past pattern T change metric: angle θ eigen-behavior at t eigen-behaviors

  13. DETECTED CHANGE POINTS EXPERIMENTS F:inweight Christian New Year Hindi New Year “back to work”

  14. DETECTED CHANGE POINTS EXPERIMENTS F: reciprocal degree F: out-degree Similar behavior for other features

  15. PROBLEM STATEMENT Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

  16. ATTRIBUTING CHANGE TO NODES EXPERIMENTS F:inweight DEC 26 no change zone r(t-1) u(t)

  17. ATTRIBUTING CHANGE TO NODES EXPERIMENTS 26 DEC 26 DEC #SMS received time (days) Time series of top 5 nodes marked

  18. ATTRIBUTING CHANGE TO NODES EXPERIMENTS JAN 2 “back to work” reciprocal degree time (days)

  19. CONCLUSION • An algorithm based on tracking “eigenbehavior” patterns over time • “change detection”: spot time-points at which “behavior” changes significantly • “attribution”: spot nodes that cause the most change • Experiments: on real, SMS messages, 2M users, over 6 months

  20. Christian New Year THANK YOU www.cs.cmu.edu/~lakoglu Email: lakoglu@cs.cmu.edu Hindi New Year “back to work” 26 DEC attribution change detection