Discovering and Explaining Abnormal Nodes in Semantic Graphs

Abstract

Abstract-An important problem in the area of homeland security is to identify abnormal or suspicious entities in large data sets. Although there are methods from data mining and social network analysis focusing on finding patterns or central nodes from networks or numerical data sets, there has been little work aimed at discovering abnormal instances in large complex semantic graphs, whose nodes are richly connected with many different types of links. In this paper, we describe a novel unsupervised framework to identify such instances. Besides discovering abnormal instances, we believe that to complete the process, a system has to also provide users with understandable explanations for its findings. Therefore, in the second part of the paper, we describe an explanation mechanism to automatically generate human-understandable explanations for the discovered results. To evaluate our discovery and explanation systems, we perform experiments on several different semantic graphs. The results show that our discovery system outperforms stateof-the-art unsupervised network algorithms used to analyze the 9/11 terrorist network and other graph-based outlier detection algorithms by a significant margin. Additionally, the human study we conducted demonstrates that our explanation system, which provides natural language explanations for the system's findings, allowed human subjects to perform complex data analysis in a much more efficient and accurate manner.

Dominant Features Identification for Covert Nodes in 9/11 Attack Using their Profile

“…The Table 1 shows the various selection strategies and their path type formats. The path type is obtained by reducing the path using variable relaxation approach [2].…”

“…SoNMine finds the influential node based on their behavioral profile which has contribution value of the nodes towards a specific behavioral path type. UNICORN is an already existing framework for the above mentioned purpose [2]. It has done its evaluation based on the relation only selection strategy and used the path length as 4 [11].…”

Identifying key players in a covert network using behavioral profile

“…The semantic graph has been used by Shou-de Lin et.al [2] in an unsupervised framework UNICORN, to generate a profile from which suspicious nodes could be detected and uses a novel explanation system to verify the profiles using natural language processing. Shou-de Lin et.al [3] has also used the interestingness measure to determine the rarity using the node path and node loop discovery strategies.…”

“…The selection strategies have been considered here because it helps us to choose a path type which is collection of paths based on which the profile is generated [2]. These strategies are used basically in two circumstances namely path oriented selection strategy and constraint oriented selection strategy.…”

A comparative study of social networking approaches in identifying the covert nodes

“…Secondly KPP2 determines the influence of a node's tie in the network based on the maximum ties of its connection to other nodes. [20] focus on finding abnormal instances in multi-relational networks (MNR) which uses unsupervised framework to model semantic profile and detects the suspicious node with the abnormal semantic profile. The authors propose a novel explanation mechanism that facilitates verification of the discovered results by generating humanunderstandable natural language explanations describing the unique aspects of these nodes.…”