Mining social networks for anomalies: Methods and challenges

Bindu, P V; Thilagam, P. Santhi

doi:10.1016/j.jnca.2016.02.021

Cited by 66 publications

(30 citation statements)

References 113 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Carley, McCulloh and Carley, and Wei and Carley studied temporal pattern recognition and anomaly detection in social networks with some business and military applications. Savage et al, Bindu and Thilagam, Woodall et al, and Noorossana et al reviewed numerous methods that have been developed for monitoring social network data.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Performance evaluation of social network anomaly detection using a moving window–based scan method

Zhao

Driscoll

Sengupta

et al. 2018

Quality & Reliability Eng

View full text Add to dashboard Cite

Timely detection of anomalous events in networks, particularly social networks, is a problem of increasing interest and relevance. A variety of methods have been proposed for monitoring such networks, including the window‐based scan method proposed by a previous study. However, research assessing the performance of this and other methods has been sparse. In this article, we use simulated social network structures to study the performance of the Priebe et al method. The detection power is high only when more than half of the social network experiences anomalous behavior or if the anomalous behavior is extreme. Both can be represented by high signal‐to‐noise ratios in the network. More precisely, Priebe's scan method performs well when the signal‐to‐noise ratio is above 20. Simulation studies are used to show that an improved detection rate and shortened monitoring delays can be achieved by lagging the moving window used for standardization, lowering the signaling threshold, and using shorter moving windows at the initial stage of monitoring. We suggest a community detection method to be used after an anomalous event has been identified to help determine the subnetwork associated with this anomalous behavior.

show abstract

Section: Introductionmentioning

confidence: 99%

“…A fixed amount of dynamic network data is used (in a retrospective analysis) to detect anomalies in some applications. For example, Bindu et al, Ranshous et al, and Akoglu et al reviewed methods where the main task is to identify anomalous network activities given the network history.…”

Section: Introductionmentioning

confidence: 99%

Performance evaluation of social network anomaly detection using a moving window–based scan method

Zhao

Driscoll

Sengupta

et al. 2018

Quality & Reliability Eng

View full text Add to dashboard Cite

show abstract

“…In this section, we review a handful of network surveillance methodologies that were chosen specifically to exemplify different areas of emphasis in network surveillance applications. For a more comprehensive review of this topic, see the works of Savage et al, Ranshous et al, Bindu and Thilagam, and Woodall et al…”

Section: Monitoring For Change In Dynamic Networkmentioning

confidence: 99%

Statistical methods for network surveillance

Jeske

Stevens

Tartakovsky

et al. 2018

Appl Stoch Models Bus & Ind

View full text Add to dashboard Cite

show abstract

“…Reflecting the growing interest in the problem, several survey papers have also appeared recently. Savage et al [40] and Bindu and Thilagam [6] review the main methods for detecting anomalies in online social networks, whereas Woodall et al [48] give an overview of the available tools for social network monitoring, together with a discussion of some performance metrics.…”

Section: Dynamic Network Structure and Change Detectionmentioning

confidence: 99%

“…We performed an adaptive model selection over the census-tract-based snapshots restricted to the Manhattan area (N = 288). Using time windows of 8 h per snapshot, we examined how the optimal value forK changes over time, per day segment, by allowing K ∈ [6,14]. We then used the average ofK ′ over all the snapshots, and re-ran the WSBM with the fixed optimized value, which turns out to beK ′ = 10 for the analyzed month.…”

Section: Model Selectionmentioning

confidence: 99%

Context‐aided analysis of community evolution in networks

Pallotta

Konjevod

Cadena

et al. 2017

Statistical Analysis

View full text Add to dashboard Cite

We are interested in detecting and analyzing global changes in dynamic networks (networks that evolve with time). More precisely, we consider changes in the activity distribution within the network, in terms of density (ie, edge existence) and intensity (ie, edge weight). Detecting change in local properties, as well as individual measurements or metrics, has been well studied and often reduces to traditional statistical process control. In contrast, detecting change in larger scale structure of the network is more challenging and not as well understood. We address this problem by proposing a framework for detecting change in network structure based on separate pieces: a probabilistic model for partitioning nodes by their behavior, a label‐unswitching heuristic, and an approach to change detection for sequences of complex objects. We examine the performance of one instantiation of such a framework using mostly previously available pieces. The dataset we use for these investigations is the publicly available New York City Taxi and Limousine Commission dataset covering all taxi trips in New York City since 2009. Using it, we investigate the evolution of an ensemble of networks under different spatiotemporal resolutions. We identify the community structure by fitting a weighted stochastic block model. We offer insights on different node ranking and clustering methods, their ability to capture the rhythm of life in the Big Apple, and their potential usefulness in highlighting changes in the underlying network structure.

show abstract

Mining social networks for anomalies: Methods and challenges

Cited by 66 publications

References 113 publications

Performance evaluation of social network anomaly detection using a moving window–based scan method

Performance evaluation of social network anomaly detection using a moving window–based scan method

Statistical methods for network surveillance

Context‐aided analysis of community evolution in networks

Contact Info

Product

Resources

About