Churn detection in large user networks

Anomaly detection on dynamic real-world networks such as large caller networks and online social networks is a very difficult problem, analogous to looking for a needle in a haystack. This paper considers detecting churners in a 3.7 million mobile phone network. The two main issues are designing fast and efficient features and classifiers. We discuss both in this paper. We associate every caller in the network with an activity vector and an affinity graph, and our features are derived from activity levels computed from subgraphs of the affinity graph. These features reflect the graph-dependent nature of the problem. To compute these networks expeditiously, we extend as integral affinity graphs the concept of integral images. Our anomaly classifier is a cascaded classifier with stages that combine naive Bayes and decision tree classifiers. Simulations with a 3.7 million cell phone user network illustrate an anomaly classifier that reaches a false alarm rate of 0.8% with a churn detection rate of 71%.