Network Neighborhood Analysis For Detecting Anomalies in Time Series of Graphs

NETWORK NEIGHBORHOOD ANALYSIS FOR DETECTING ANOMALIES IN TIME SERIES OF GRAPHS Suchismita Goswami, PhD George Mason University, 2019 Dissertation Director: Dr. Igor Griva Around terabytes of unstructured electronic data are generated every day from twitter networks, scientific collaborations, organizational emails, telephone calls and websites. Excessive communications in communication networks, particularly in organizational e-mail networks, continue to be a major problem. In some cases, for example, Enron e-mails, frequent contact or excessive activities on interconnected networks lead to fraudulent activities. Analyzing the excessive activity in a social network is thus important to understand the behavior of individuals in subregions of a network. In a social network, anomalies can occur as a result of abrupt changes in the interactions among a group of individuals. Therefore, one needs to develop methodologies to analyze and detect excessive communications in dynamic social networks. The motivation of this research work is to investigate the excessive activities and make inferences in dynamic sub networks. In this dissertation work, I implement new methodologies and techniques to detect excessive communications, topic activities and the associated influential individuals in the dynamic networks obtained from organizational emails using scan statistics, multivariate time series models and probabilistic topic modeling. Three major contributions have been presented here to detect anomalies of dynamic networks obtained from organizational emails. At first, I develop a different approach by invoking the log-likelihood ratio as a scan statistic with overlapping and variable window sizes to rank the clusters, and devise a two-step scan process to detect the excessive activities in an organizations e-mail network as a case study. The initial step is to determine the structural stability of the e-mail count time series and perform differencing and de-seasonalizing operations to make the time series stationary, and obtain a primary cluster using a Poisson process model. I then extract neighborhood ego subnetworks around the observed primary cluster to obtain more refined cluster by invoking the graph invariant betweenness as the locality statistic using the binomial model. I demonstrate that the two-step scan statistics algorithm is more scalable in detecting excessive activity in large dynamic social networks. Secondly, I implement for the first time the multivariate time series models to detect a group of influential people and their dynamic relationships that are associated with excessive communications, which cannot be assessed using scan statistics models. For the multivariate modeling, a vector auto regressive (VAR) model has been employed in time series of subgraphs in e-mail networks constructed using the graph edit distance, as the nodes or vertices of the subgraphs are interrelated. Anomalies or excessive communications are assessed using the residual thresholds greater than three times the standard deviations, obtained from the fitted time series models. Finally, I devise a new method of detecting excessive topic activities from the unstructured text obtained from e-mail contents by combining the probabilistic topic modeling and scan statistics algorithms. Initially, I investigate the major topics discussed using the probabilistic modeling, such as latent Dirichlet allocation (LDA) modeling, then employ scan statistics to assess the excessive topic activities, which has the largest log likelihood ratio in the neighborhood of primary cluster. These analyses provide new ways of detecting the excessive communications and topic flow through the influential vertices in a dynamic network, and can be extended in other dynamic social networks to critically investigate excessive activities. Chapter 1: Introduction Anomalies, which are clusters of events or excessive or unusual activities, are common in science and technology. Some of the most commonly used methods for anomaly detection in data mining are density-based techniques such as k-nearest neighbor [KNT00] and local outlier factor [BKNS00], one class support vector machines [SPST+01], neural networks [HHWB00], cluster analysis-based outlier detection [HXD03] and ensemble techniques [LK05]. All these methods used to detect excessive activity, are mostly descriptive in nature, and not effective in making statistical inferences. In other words, these methods do not predict if these observed clusters of events are statistically significant or not [Kul79]. A very powerful statistical inference methodology that has been developed to detect the region of unusual activity in a random process and to infer the statistical significance of the observed excessive activity is scan statistics [Kul79], which is also termed as moving window analysis in the engineering literature and has mostly been used in spatial statistics and image analysis. Scan statistic is defined as a maximum or minimum of local statistics estimated from the local region of the data. Let {Xt, t ≥ 0} be a Poisson process with rate, λ, where Xt is the number of points (events) occurring in the interval [0, t). In any subinterval of [0, T) of length, w, let Yt be the number of points (events) in a window of the interval, [t, t+ w), such that Yt = Xt+w Xt. The one-dimensional continuous scan statistic, Sw, is written as [GB99]: Sw = max 0