Performance evaluation of social network anomaly detection using a moving window–based scan method

Zhao, Meng; Driscoll, Anne R.; Sengupta, Srijan; Fricker, Ronald D.; Spitzner, Dan J.; Woodall, William H.

doi:10.1002/qre.2364

Cited by 28 publications

(34 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Jones‐Farmer et al discussed the importance of effectively collecting and analyzing baseline data during Phase I. If the network being monitored is expected to evolve over time, then we recommend moving window approaches as opposed to a fixed Phase I sample as considered in other studies …”

Section: The Network Surveillance Problemmentioning

confidence: 99%

See 1 more Smart Citation

Modeling and detecting change in temporal networks via the degree corrected stochastic block model

Wilson

Stevens

Woodall

2019

Quality & Reliability Eng

Self Cite

109

View full text Add to dashboard Cite

In many applications, it is of interest to identify anomalous behavior within a dynamic interacting system. Such anomalous interactions are reflected by structural changes in the network representation of the system. We propose and investigate the use of the degree corrected stochastic block model (DCSBM) to model and monitor dynamic networks that undergo a significant structural change. We apply statistical process monitoring techniques to the estimated parameters of the DCSBM to identify significant structural changes in the network. We apply our surveillance strategy to a dynamic US Senate covoting network. We detect significant changes in the political network that reflect both times of cohesion and times of polarization among Republican and Democratic party members. Our analysis demonstrates that the DCSBM monitoring procedure effectively detects local and global structural changes in complex networks, providing useful insights into the modeled system. The DCSBM approach is an example of a general framework that combines parametric random graph models and statistical process monitoring techniques for network surveillance.

show abstract

Section: The Network Surveillance Problemmentioning

confidence: 99%

“…Perry developed an EWMA control chart to monitor the hierarchy present in directed networks. Both Zhao et al and Noorossana analyzed the use of control charts for dynamic anomaly detection in social networks.…”

Section: Related Workmentioning

confidence: 99%

Modeling and detecting change in temporal networks via the degree corrected stochastic block model

Wilson

Stevens

Woodall

2019

Quality & Reliability Eng

Self Cite

109

View full text Add to dashboard Cite

show abstract

“…Zhao et al [25] have shown that 4, rather than the value 5 recommended by Priebe et al [24], is a reasonable signaling threshold. Thus, a signal indicating the possible presence of an anomaly is generated at time t if .…”

Section: Network Model and Surveillance Methodsmentioning

confidence: 99%

“…Woodall et al [4], Savage et al [5], Zhao et al [25] and Fricker [26] all argued that the use of synthetic data is necessary when studying network monitoring methods. We agree with this argument because the temporal information of network anomalies within any existing set of network data can be difficult to determine at best.…”

Section: Description Of Simulationmentioning

confidence: 99%

The effect of temporal aggregation level in social network monitoring

et al. 2018

Self Cite

View full text Add to dashboard Cite

Social networks have become ubiquitous in modern society, which makes social network monitoring a research area of significant practical importance. Social network data consist of social interactions between pairs of individuals that are temporally aggregated over a certain interval of time, and the level of such temporal aggregation can have substantial impact on social network monitoring. There have been several studies on the effect of temporal aggregation in the process monitoring literature, but no studies on the effect of temporal aggregation in social network monitoring. We use the degree corrected stochastic block model (DCSBM) to simulate social networks and network anomalies and analyze these networks in the context of both count and binary network data. In conjunction with this model, we use the Priebe scan method as the monitoring method. We demonstrate that temporal aggregation at high levels leads to a considerable decrease in the ability to detect an anomaly within a specified time period. Moreover, converting social network communication data from counts to binary indicators can result in a significant loss of information, hindering detection performance. Aggregation at an appropriate level with count data, however, can amplify the anomalous signal generated by network anomalies and improve detection performance. Our results provide both insights on the practical effects of temporal aggregation and a framework for the study of other combinations of network models, surveillance methods, and types of anomalies.

show abstract

“…Woodall et al provided an overview of social networking monitoring and discussed relationships with other types of monitoring. Zhao et al studied the properties of the scan method of Priebe et al under the assumption of the Erdős and Rényi model. In addition, we have studied monitoring under the assumption of the degree‐corrected stochastic block model (see the works of Wilson et al, Zhao et al, and Yu et al).…”

Section: Social Network Surveillancementioning

confidence: 99%

Discussion of “Statistical methods for network surveillance”

Sengupta

Woodall

2018

Appl Stoch Models Bus & Ind

Self Cite

View full text Add to dashboard Cite

We appreciate the opportunity to discuss this interesting and thought-provoking paper. We agree with the authors that there is a growing interest in network surveillance with many important applications.In the context of network surveillance, we think it is important to distinguish between the case where the network is deterministic and the case where the network is random.The first case arises when the network itself (ie, the set of vertices/nodes and the set of edges/links) is considered to be fixed and deterministic, and some kind of traffic is being transmitted via the network links. The traffic flow being transmitted through each network link is considered to be a random observation from some statistical model, and the goal of network surveillance in this scenario is to detect whether the random traffic flow through the deterministic network has significantly deviated from normal or baseline conditions. Two of the three examples in the paper fall under this category, namely, monitoring network security and monitoring reliability of data networks. This general framework also includes a variety of interconnected systems beyond computer networks, for example, vehicular traffic on the interstate highway network or electric power transmission via the power grid network. The underlying principles of network surveillance from computer networks can therefore be extended to such networked systems.The second case arises when networks at different point of time are considered to be a time series of random observations from a statistical model, such as the degree corrected stochastic blockmodel in the authors' Section 5.3.2. In this case, the network structure itself is the observed sequence of random variables, and the goal of network surveillance is to detect whether the network structure has significantly deviated from normal or baseline conditions. Examples include email networks (ie, the Enron network from their Section 5), social media networks, and friendship networks.These two cases are inherently different in terms of the statistical framework and the objective of network surveillance. In the first case, the objective is to carry out surveillance on networks, whereas in the second case, the objective is to carry out surveillance of networks. The umbrella term network surveillance appears to include both cases, but we think it is better to distinguish between them, preferably by using different terms to describe the two cases. Perhaps, fixed network surveillance and random network surveillance would work.There are sampling issues with respect to any type of surveillance. For example, how often should the process be sampled? Over what time period should the data be aggregated? In the authors' Figure 2, the number of users is recorded at five-minute intervals. What was the justification for this frequency of sampling? Sampling at a high frequency can make modeling more difficult, whereas sampling at lower frequencies means that detection of anomalies may be unsuccessful or delayed. Zwetsloot and Woodall 1 discusse...

show abstract

Performance evaluation of social network anomaly detection using a moving window–based scan method

Cited by 28 publications

References 24 publications

Modeling and detecting change in temporal networks via the degree corrected stochastic block model

Modeling and detecting change in temporal networks via the degree corrected stochastic block model

The effect of temporal aggregation level in social network monitoring

Discussion of “Statistical methods for network surveillance”

Contact Info

Product

Resources

About