Anomalous Node Detection in Time Series of

Mobile Communication Graphs

Leman AkogluJanuary 28, 2010

Project Question

(1) In a given graph in which- edges are weighted- nodes are UNlabeled

which nodes to consider as “anomalous”?

(2) How about in a time-series of graphs?

Dataset: who-calls/texts-whom• 3 million customers interacting over 6 months

• + incoming/outgoing edges from/to out-of-network users

• Both SMS and phone-call

ego

4

egonetWhich nodes are anomalous?

Which nodes are anomalous?

5

Features to characterize nodes

Ni: number of neighbors (degree) of ego i

Ei: number of edges in egonet i

Wi: total weight of egonet i

Si: number of singleton neighbors of ego i with degree 1

max(di): average degree of i’s neighbors …

features nodes

M

“2-mode look” at the data as a matrix

8

Which nodes are anomalous?

time

nodes

M

“3-mode look” at the data as a tensor

features

time

Mt

nodes

time

UVT∑

Preliminary objectives

• ICA? Robust PCA?• How to capture correlations between

features?• How to do evaluation? • Anomalous edges/groups of nodes?