No abstract

Timely detection of anomalous events in networks, particularly social networks, is a problem of increasing interest and relevance. A variety of methods have been proposed for monitoring such networks, including the window‐based scan method proposed by a previous study. However, research assessing the performance of this and other methods has been sparse. In this article, we use simulated social network structures to study the performance of the Priebe et al method. The detection power is high only when more than half of the social network experiences anomalous behavior or if the anomalous behavior is extreme. Both can be represented by high signal‐to‐noise ratios in the network. More precisely, Priebe's scan method performs well when the signal‐to‐noise ratio is above 20. Simulation studies are used to show that an improved detection rate and shortened monitoring delays can be achieved by lagging the moving window used for standardization, lowering the signaling threshold, and using shorter moving windows at the initial stage of monitoring. We suggest a community detection method to be used after an anomalous event has been identified to help determine the subnetwork associated with this anomalous behavior.

No abstract

The integrity of Phase II control charting depends on the accuracy of Phase I estimation. Studies have shown that extremely large sample sizes are needed in Phase I to ensure that performance of control charts with estimated in-control parameters is comparable with the performance of charts with known parameters. The sample size recommendations can be impractical for attribute control charts. In this article, the in-control performance of the c-chart with an estimated in-control average number of non-conforming items is assessed. We show that the sampling variability associated with estimation results in a high percentage of control charts with in-control average run lengths well below that of corresponding control charts with known parameters. This sampling variability can be described as between-practitioner variability. To overcome the variability in performance, a c-chart with bootstrapped control limits is recommended. A simulation study reveals that these adjusted bootstrapped control limits improve the conditional average run length performance of the c-chart by controlling the proportion of charts with in-control average run length performance below a given value. The out-of-control performance of the c-chart with adjusted limits is also discussed.

Social networks have become ubiquitous in modern society, which makes social network monitoring a research area of significant practical importance. Social network data consist of social interactions between pairs of individuals that are temporally aggregated over a certain interval of time, and the level of such temporal aggregation can have substantial impact on social network monitoring. There have been several studies on the effect of temporal aggregation in the process monitoring literature, but no studies on the effect of temporal aggregation in social network monitoring. We use the degree corrected stochastic block model (DCSBM) to simulate social networks and network anomalies and analyze these networks in the context of both count and binary network data. In conjunction with this model, we use the Priebe scan method as the monitoring method. We demonstrate that temporal aggregation at high levels leads to a considerable decrease in the ability to detect an anomaly within a specified time period. Moreover, converting social network communication data from counts to binary indicators can result in a significant loss of information, hindering detection performance. Aggregation at an appropriate level with count data, however, can amplify the anomalous signal generated by network anomalies and improve detection performance. Our results provide both insights on the practical effects of temporal aggregation and a framework for the study of other combinations of network models, surveillance methods, and types of anomalies.