Presentation is loading. Please wait.

Presentation is loading. Please wait.

Anomaly Detection and Virus Propagation in Large Graphs Christos Faloutsos CMU.

Similar presentations


Presentation on theme: "Anomaly Detection and Virus Propagation in Large Graphs Christos Faloutsos CMU."— Presentation transcript:

1 Anomaly Detection and Virus Propagation in Large Graphs Christos Faloutsos CMU

2 Thank you! Dr. Ching-Hao (Eric) Mao Prof. Kenneth Pao Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu2

3 3 Outline Part 1: anomaly detection – OddBall (anomaly detection) – Belief Propagation – Conclusions Part 2: influence propagation Taiwan'12

4 OddBall: Spotting A n omalies in Weighted Graphs Leman Akoglu, Mary McGlohon, Christos Faloutsos Carnegie Mellon University School of Computer Science PAKDD 2010, Hyderabad, India

5 Main idea For each node, extract ‘ego-net’ (=1-step-away neighbors) Extract features (#edges, total weight, etc etc) Compare with the rest of the population Faloutsos, Prakash, Chau, Koutra, Akoglu5Taiwan'12

6 What is an egonet? ego 6 egonet Faloutsos, Prakash, Chau, Koutra, AkogluTaiwan'12

7 Selected Features  N i : number of neighbors (degree) of ego i  E i : number of edges in egonet i  W i : total weight of egonet i  λ w,i : principal eigenvalue of the weighted adjacency matrix of egonet I 7Faloutsos, Prakash, Chau, Koutra, AkogluTaiwan'12

8 Near-Clique/Star 8Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu

9 Near-Clique/Star 9Faloutsos, Prakash, Chau, Koutra, AkogluTaiwan'12

10 Near-Clique/Star 10Faloutsos, Prakash, Chau, Koutra, AkogluTaiwan'12

11 Andrew Lewis (director) Near-Clique/Star 11Faloutsos, Prakash, Chau, Koutra, AkogluTaiwan'12

12 Faloutsos, Prakash, Chau, Koutra, Akoglu12 Outline Part 1: anomaly detection – OddBall (anomaly detection) – Belief Propagation – Conclusions Part 2: influence propagation Taiwan'12

13 Faloutsos, Prakash, Chau, Koutra, Akoglu13 E-bay Fraud detection w/ Polo Chau & Shashank Pandit, CMU [www’07]

14 Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu14 E-bay Fraud detection

15 Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu15 E-bay Fraud detection

16 Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu16 E-bay Fraud detection - NetProbe

17 Popular press And less desirable attention: E-mail from ‘Belgium police’ (‘copy of your code?’) Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu17

18 Faloutsos, Prakash, Chau, Koutra, Akoglu18 Outline OddBall (anomaly detection) Belief Propagation – Ebay fraud – Symantec malware detection – Unification results Conclusions Taiwan'12

19 Polo Chau Machine Learning Dept Carey Nachenberg Vice President & Fellow Jeffrey Wilhelm Principal Software Engineer Adam Wright Software Engineer Prof. Christos Faloutsos Computer Science Dept Polonium: Tera-Scale Graph Mining and Inference for Malware Detection PATENT PENDING SDM 2011, Mesa, Arizona

20 Polonium: The Data 60+ terabytes of data anonymously contributed by participants of worldwide Norton Community Watch program 50+ million machines 900+ million executable files Constructed a machine-file bipartite graph (0.2 TB+) 1 billion nodes (machines and files) 37 billion edges Taiwan'1220Faloutsos, Prakash, Chau, Koutra, Akoglu

21 Polonium: Key Ideas Use Belief Propagation to propagate domain knowledge in machine-file graph to detect malware Use “guilt-by-association” (i.e., homophily) – E.g., files that appear on machines with many bad files are more likely to be bad Scalability: handles 37 billion-edge graph Taiwan'1221Faloutsos, Prakash, Chau, Koutra, Akoglu

22 Polonium: One-Interaction Results 84.9% True Positive Rate 1% False Positive Rate True Positive Rate % of malware correctly identified False Positive Rate % of non-malware wrongly labeled as malware 22 Ideal Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu

23 23 Outline Part 1: anomaly detection – OddBall (anomaly detection) – Belief Propagation Ebay fraud Symantec malware detection Unification results – Conclusions Part 2: influence propagation Taiwan'12

24 Unifying Guilt-by-Association Approaches: Theorems and Fast Algorithms Danai Koutra U Kang Hsing-Kuo Kenneth Pao Tai-You Ke Duen Horng (Polo) Chau Christos Faloutsos ECML PKDD, 5-9 September 2011, Athens, Greece

25 Problem Definition: G B A techniques Faloutsos, Prakash, Chau, Koutra, Akoglu25 Given: Graph; & few labeled nodes Find: labels of rest (assuming network effects) Taiwan'12

26 Homophily and Heterophily Faloutsos, Prakash, Chau, Koutra, Akoglu26 Step 1 Step 2 All methods handle homophily NOT all methods handle heterophily BUT proposed method does! NOT all methods handle heterophily BUT proposed method does! Taiwan'12

27 Are they related? RWR (Random Walk with Restarts) – google’s pageRank (‘if my friends are important, I’m important, too’) SSL (Semi-supervised learning) – minimize the differences among neighbors BP (Belief propagation) – send messages to neighbors, on what you believe about them Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu27

28 Are they related? RWR (Random Walk with Restarts) – google’s pageRank (‘if my friends are important, I’m important, too’) SSL (Semi-supervised learning) – minimize the differences among neighbors BP (Belief propagation) – send messages to neighbors, on what you believe about them Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu28 YES!

29 Correspondence of Methods Faloutsos, Prakash, Chau, Koutra, Akoglu29 MethodMatrixUnknownknown RWR [I – c AD -1 ]×x=(1-c)y SSL [I + a (D - A)] ×x=y F A BP [I + a D - c ’ A] ×bhbh =φhφh 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 ? ? 0 1 0 1 d1 d2 d3 d1 d2 d3 final labels/ beliefs prior labels/ beliefs adjacency matrix Taiwan'12

30 Results: Scalability Faloutsos, Prakash, Chau, Koutra, Akoglu30 F A BP is linear on the number of edges. # of edges (Kronecker graphs) runtime (min) Taiwan'12

31 Results (5): Parallelism Faloutsos, Prakash, Chau, Koutra, Akoglu31 F A BP ~2x faster & wins/ties on accuracy. runtime (min) % accuracy Taiwan'12

32 Faloutsos, Prakash, Chau, Koutra, Akoglu32 Conclusions Anomaly detection: hand-in-hand with pattern discovery (‘anomalies’ == ‘rare patterns’) ‘OddBall’ for large graphs ‘NetProbe’ and belief propagation: exploit network effects. FaBP: fast & accurate Taiwan'12

33 Faloutsos, Prakash, Chau, Koutra, Akoglu33 Outline Part 1: anomaly detection – OddBall (anomaly detection) – Belief Propagation – Conclusions Part 2: influence propagation Taiwan'12

34 Influence propagation in large graphs - theorems and algorithms B. Aditya Prakash http://www.cs.cmu.edu/~badityap Christos Faloutsos http://www.cs.cmu.edu/~christos Carnegie Mellon University

35 Networks are everywhere! Human Disease Network [Barabasi 2007] Gene Regulatory Network [Decourty 2008] Facebook Network [2010] The Internet [2005] Faloutsos, Prakash, Chau, Koutra, Akoglu35Taiwan'12

36 Dynamical Processes over networks are also everywhere! Faloutsos, Prakash, Chau, Koutra, Akoglu36Taiwan'12

37 Why do we care? Information Diffusion Viral Marketing Epidemiology and Public Health Cyber Security Human mobility Games and Virtual Worlds Ecology Social Collaboration........ Faloutsos, Prakash, Chau, Koutra, Akoglu37Taiwan'12

38 Why do we care? (1: Epidemiology) Dynamical Processes over networks [AJPH 2007] CDC data: Visualization of the first 35 tuberculosis (TB) patients and their 1039 contacts Diseases over contact networks Faloutsos, Prakash, Chau, Koutra, Akoglu38Taiwan'12

39 Why do we care? (1: Epidemiology) Dynamical Processes over networks Each circle is a hospital ~3000 hospitals More than 30,000 patients transferred [US-MEDICARE NETWORK 2005] Problem: Given k units of disinfectant, whom to immunize? Faloutsos, Prakash, Chau, Koutra, Akoglu39Taiwan'12

40 Why do we care? (1: Epidemiology) CURRENT PRACTICEOUR METHOD ~6x fewer! [US-MEDICARE NETWORK 2005] Faloutsos, Prakash, Chau, Koutra, Akoglu40Taiwan'12 Hospital-acquired inf. took 99K+ lives, cost $5B+ (all per year)

41 Why do we care? (2: Online Diffusion) > 800m users, ~$1B revenue [WSJ 2010] ~100m active users > 50m users Faloutsos, Prakash, Chau, Koutra, Akoglu41Taiwan'12

42 Why do we care? (2: Online Diffusion) Dynamical Processes over networks Celebrity Buy Versace™! Followers Social Media Marketing Faloutsos, Prakash, Chau, Koutra, Akoglu42Taiwan'12

43 High Impact – Multiple Settings Q. How to squash rumors faster? Q. How do opinions spread? Q. How to market better? epidemic out-breaks products/viruses transmit s/w patches Faloutsos, Prakash, Chau, Koutra, Akoglu43Taiwan'12

44 Research Theme DATA Large real-world networks & processes ANALYSIS Understanding POLICY/ ACTION Managing Faloutsos, Prakash, Chau, Koutra, Akoglu44Taiwan'12

45 In this talk ANALYSIS Understanding Given propagation models: Q1: Will an epidemic happen? Faloutsos, Prakash, Chau, Koutra, Akoglu45Taiwan'12

46 In this talk Q2: How to immunize and control out-breaks better? POLICY/ ACTION Managing Faloutsos, Prakash, Chau, Koutra, Akoglu46Taiwan'12

47 Outline Part 1: anomaly detection Part 2: influence propagation Motivation Epidemics: what happens? (Theory) Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu47Taiwan'12

48 A fundamental question Strong Virus Epidemic? Faloutsos, Prakash, Chau, Koutra, Akoglu48Taiwan'12

49 example (static graph) Weak Virus Epidemic? Faloutsos, Prakash, Chau, Koutra, Akoglu49Taiwan'12

50 Problem Statement Find, a condition under which – virus will die out exponentially quickly – regardless of initial infection condition above (epidemic) below (extinction) # Infected time Separate the regimes? Faloutsos, Prakash, Chau, Koutra, Akoglu50Taiwan'12

51 Threshold (static version) Problem Statement Given: – Graph G, and – Virus specs (attack prob. etc.) Find: – A condition for virus extinction/invasion Faloutsos, Prakash, Chau, Koutra, Akoglu51Taiwan'12

52 Threshold: Why important? Accelerating simulations Forecasting (‘What-if’ scenarios) Design of contagion and/or topology A great handle to manipulate the spreading – Immunization – Maximize collaboration ….. Faloutsos, Prakash, Chau, Koutra, Akoglu52Taiwan'12

53 Outline Motivation Epidemics: what happens? (Theory) – Background – Result (Static Graphs) – Proof Ideas (Static Graphs) – Bonus 1: Dynamic Graphs – Bonus 2: Competing Viruses Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu53Taiwan'12

54 “SIR” model: life immunity (mumps) Each node in the graph is in one of three states – Susceptible (i.e. healthy) – Infected – Removed (i.e. can’t get infected again) Prob. β Prob. δ t = 1t = 2t = 3 Faloutsos, Prakash, Chau, Koutra, Akoglu54Taiwan'12

55 Terminology: continued Other virus propagation models (“VPM”) – SIS : susceptible-infected-susceptible, flu-like – SIRS : temporary immunity, like pertussis – SEIR : mumps-like, with virus incubation (E = Exposed) ….…………. Underlying contact-network – ‘who-can-infect- whom’ Faloutsos, Prakash, Chau, Koutra, Akoglu55Taiwan'12

56 Related Work  R. M. Anderson and R. M. May. Infectious Diseases of Humans. Oxford University Press, 1991.  A. Barrat, M. Barthélemy, and A. Vespignani. Dynamical Processes on Complex Networks. Cambridge University Press, 2010.  F. M. Bass. A new product growth for model consumer durables. Management Science, 15(5):215–227, 1969.  D. Chakrabarti, Y. Wang, C. Wang, J. Leskovec, and C. Faloutsos. Epidemic thresholds in real networks. ACM TISSEC, 10(4), 2008.  D. Easley and J. Kleinberg. Networks, Crowds, and Markets: Reasoning About a Highly Connected World. Cambridge University Press, 2010.  A. Ganesh, L. Massoulie, and D. Towsley. The effect of network topology in spread of epidemics. IEEE INFOCOM, 2005.  Y. Hayashi, M. Minoura, and J. Matsukubo. Recoverable prevalence in growing scale-free networks and the effective immunization. arXiv:cond-at/0305549 v2, Aug. 6 2003.  H. W. Hethcote. The mathematics of infectious diseases. SIAM Review, 42, 2000.  H. W. Hethcote and J. A. Yorke. Gonorrhea transmission dynamics and control. Springer Lecture Notes in Biomathematics, 46, 1984.  J. O. Kephart and S. R. White. Directed-graph epidemiological models of computer viruses. IEEE Computer Society Symposium on Research in Security and Privacy, 1991.  J. O. Kephart and S. R. White. Measuring and modeling computer virus prevalence. IEEE Computer Society Symposium on Research in Security and Privacy, 1993.  R. Pastor-Santorras and A. Vespignani. Epidemic spreading in scale-free networks. Physical Review Letters 86, 14, 2001.  ……… All are about either: Structured topologies (cliques, block-diagonals, hierarchies, random) Specific virus propagation models Static graphs All are about either: Structured topologies (cliques, block-diagonals, hierarchies, random) Specific virus propagation models Static graphs Faloutsos, Prakash, Chau, Koutra, Akoglu56Taiwan'12

57 Outline Motivation Epidemics: what happens? (Theory) – Background – Result (Static Graphs) – Proof Ideas (Static Graphs) – Bonus 1: Dynamic Graphs – Bonus 2: Competing Viruses Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu57Taiwan'12

58 How should the answer look like? Answer should depend on: – Graph – Virus Propagation Model (VPM) But how?? – Graph – average degree? max. degree? diameter? – VPM – which parameters? – How to combine – linear? quadratic? exponential? ….. Faloutsos, Prakash, Chau, Koutra, Akoglu58Taiwan'12

59 Static Graphs: Our Main Result Informally, For,  any arbitrary topology (adjacency matrix A)  any virus propagation model (VPM) in standard literature the epidemic threshold depends only 1.on the λ, first eigenvalue of A, and 2.some constant, determined by the virus propagation model λ λ No epidemic if λ * < 1 Faloutsos, Prakash, Chau, Koutra, Akoglu59Taiwan'12 In Prakash+ ICDM 2011 (Selected among best papers). w/ Deepay Chakrabarti

60 Our thresholds for some models s = effective strength s < 1 : below threshold Models Effective Strength (s) Threshold (tipping point) SIS, SIR, SIRS, SEIR s = λ. s = 1 SIV, SEIV s = λ. ( H.I.V. ) s = λ. Faloutsos, Prakash, Chau, Koutra, Akoglu60Taiwan'12

61 Our result: Intuition for λ “Official” definition: Let A be the adjacency matrix. Then λ is the root with the largest magnitude of the characteristic polynomial of A [det(A – xI)]. Doesn’t give much intuition! “Un-official” Intuition λ ~ # paths in the graph u u ≈. (i, j) = # of paths i  j of length k Faloutsos, Prakash, Chau, Koutra, Akoglu61Taiwan'12

62 Largest Eigenvalue (λ) λ ≈ 2λ = Nλ = N-1 N = 1000 λ ≈ 2λ= 31.67λ= 999 better connectivity higher λ Faloutsos, Prakash, Chau, Koutra, Akoglu62Taiwan'12 N nodes

63 Examples: Simulations – SIR (mumps) (a) Infection profile (b) “Take-off” plot PORTLAND graph: synthetic population, 31 million links, 6 million nodes Fraction of Infections Footprint Effective Strength Time ticks Faloutsos, Prakash, Chau, Koutra, Akoglu63Taiwan'12

64 Examples: Simulations – SIRS (pertusis) Fraction of Infections Footprint Effective StrengthTime ticks (a) Infection profile (b) “Take-off” plot PORTLAND graph: synthetic population, 31 million links, 6 million nodes Faloutsos, Prakash, Chau, Koutra, Akoglu64Taiwan'12

65 λ * < 1 Graph-based Model-based 65 General VPM structure Topology and stability See paper for full proof Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu

66 Outline Motivation Epidemics: what happens? (Theory) – Background – Result (Static Graphs) – Proof Ideas (Static Graphs) – Bonus 1: Dynamic Graphs – Bonus 2: Competing Viruses Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu66Taiwan'12

67 λ * < 1 Graph-based Model-based General VPM structure Topology and stability See paper for full proof 67Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu

68 Outline Motivation Epidemics: what happens? (Theory) – Background – Result (Static Graphs) – Proof Ideas (Static Graphs) – Bonus 1: Dynamic Graphs – Bonus 2: Competing Viruses Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu68Taiwan'12

69 Dynamic Graphs: Epidemic? adjacency matrix 8 8 Alternating behaviors DAY (e.g., work) Faloutsos, Prakash, Chau, Koutra, Akoglu69Taiwan'12

70 adjacency matrix 8 8 Dynamic Graphs: Epidemic? Alternating behaviors NIGHT (e.g., home) Faloutsos, Prakash, Chau, Koutra, Akoglu70Taiwan'12

71 SIS model – recovery rate δ – infection rate β Set of T arbitrary graphs Model Description day N N night N N, weekend….. Infected Healthy XN1 N3 N2 Prob. β Prob. δ Faloutsos, Prakash, Chau, Koutra, Akoglu71Taiwan'12

72 Informally, NO epidemic if eig (S) = < 1 Our result: Dynamic Graphs Threshold Single number! Largest eigenvalue of The system matrix S In Prakash+, ECML-PKDD 2010 S = Faloutsos, Prakash, Chau, Koutra, Akoglu72Taiwan'12

73 Synthetic MIT Reality Mining log(fraction infected) Time BELOW AT ABOVE AT BELOW Infection-profile Faloutsos, Prakash, Chau, Koutra, Akoglu73Taiwan'12

74 “Take-off” plots Footprint (# infected @ “steady state”) Our threshold (log scale) NO EPIDEMIC EPIDEMIC NO EPIDEMIC SyntheticMIT Reality Faloutsos, Prakash, Chau, Koutra, Akoglu74Taiwan'12

75 Outline Motivation Epidemics: what happens? (Theory) – Background – Result (Static Graphs) – Proof Ideas (Static Graphs) – Bonus 1: Dynamic Graphs – Bonus 2: Competing Viruses Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu75Taiwan'12

76 Competing Contagions iPhone v AndroidBlu-ray v HD-DVD 76Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu Biological common flu/avian flu, pneumococcal inf etc

77 A simple model Modified flu-like Mutual Immunity (“pick one of the two”) Susceptible-Infected1-Infected2-Susceptible Virus 1 Virus 2 Faloutsos, Prakash, Chau, Koutra, Akoglu77Taiwan'12

78 Question: What happens in the end? green: virus 1 red: virus 2 Footprint @ Steady State = ? Number of Infections Faloutsos, Prakash, Chau, Koutra, Akoglu78Taiwan'12 ASSUME: Virus 1 is stronger than Virus 2

79 Question: What happens in the end? green: virus 1 red: virus 2 Number of Infections Strength ?? = Strength 2 Footprint @ Steady State 79Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu ASSUME: Virus 1 is stronger than Virus 2

80 Answer: Winner-Takes-All green: virus 1 red: virus 2 Number of Infections 80Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu ASSUME: Virus 1 is stronger than Virus 2

81 Our Result: Winner-Takes-All Given our model, and any graph, the weaker virus always dies-out completely 1.The stronger survives only if it is above threshold 2.Virus 1 is stronger than Virus 2, if: strength(Virus 1) > strength(Virus 2) 3.Strength(Virus) = λ β / δ  same as before! 81Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu In Prakash, Beutel, + WWW 2012

82 Real Examples Reddit v DiggBlu-Ray v HD-DVD [Google Search Trends data] 82Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu

83 Outline Motivation Epidemics: what happens? (Theory) Action: Who to immunize? (Algorithms) Faloutsos, Prakash, Chau, Koutra, Akoglu83Taiwan'12

84 ? ? Given: a graph A, virus prop. model and budget k; Find: k ‘best’ nodes for immunization (removal). k = 2 ? ? Full Static Immunization Faloutsos, Prakash, Chau, Koutra, Akoglu84Taiwan'12

85 Outline Motivation Epidemics: what happens? (Theory) Action: Who to immunize? (Algorithms) – Full Immunization (Static Graphs) – Fractional Immunization Faloutsos, Prakash, Chau, Koutra, Akoglu85Taiwan'12

86 Challenges Given a graph A, budget k, Q1 (Metric) How to measure the ‘shield- value’ for a set of nodes (S)? Q2 (Algorithm) How to find a set of k nodes with highest ‘shield-value’? Faloutsos, Prakash, Chau, Koutra, Akoglu86Taiwan'12

87 Proposed vulnerability measure λ Increasing λ Increasing vulnerability λ is the epidemic threshold “Safe”“Vulnerable”“Deadly” Faloutsos, Prakash, Chau, Koutra, Akoglu87Taiwan'12

88 1 9 10 3 4 5 7 8 6 2 9 1 11 10 3 4 5 6 7 8 2 9 Original GraphWithout {2, 6} Eigen-Drop(S) Δ λ = λ - λ s Eigen-Drop(S) Δ λ = λ - λ s Δ A1: “Eigen-Drop”: an ideal shield value Faloutsos, Prakash, Chau, Koutra, Akoglu88Taiwan'12

89 (Q2) - Direct Algorithm too expensive! Immunize k nodes which maximize Δ λ S = argmax Δ λ Combinatorial! Complexity: – Example: 1,000 nodes, with 10,000 edges It takes 0.01 seconds to compute λ It takes 2,615 years to find 5-best nodes ! Faloutsos, Prakash, Chau, Koutra, Akoglu89Taiwan'12

90 A2: Our Solution Part 1: Shield Value – Carefully approximate Eigen-drop (Δ λ) – Matrix perturbation theory Part 2: Algorithm – Greedily pick best node at each step – Near-optimal due to submodularity NetShield (linear complexity) – O(nk 2 +m) n = # nodes; m = # edges Faloutsos, Prakash, Chau, Koutra, Akoglu90Taiwan'12 In Tong, Prakash+ ICDM 2010

91 Experiment: Immunization quality Log(fraction of infected nodes) NetShield Degree PageRank Eigs (=HITS) Acquaintance Betweeness (shortest path) Lower is better Time Faloutsos, Prakash, Chau, Koutra, Akoglu91Taiwan'12

92 Outline Motivation Epidemics: what happens? (Theory) Action: Who to immunize? (Algorithms) – Full Immunization (Static Graphs) – Fractional Immunization Faloutsos, Prakash, Chau, Koutra, Akoglu92Taiwan'12

93 Fractional Immunization of Networks B. Aditya Prakash, Lada Adamic, Theodore Iwashyna (M.D.), Hanghang Tong, Christos Faloutsos Under review Faloutsos, Prakash, Chau, Koutra, Akoglu93Taiwan'12

94 Fractional Asymmetric Immunization Hospital Another Hospital Drug-resistant Bacteria (like XDR-TB) Faloutsos, Prakash, Chau, Koutra, Akoglu94Taiwan'12

95 Fractional Asymmetric Immunization Hospital Another Hospital Drug-resistant Bacteria (like XDR-TB) Faloutsos, Prakash, Chau, Koutra, Akoglu95Taiwan'12

96 Fractional Asymmetric Immunization Hospital Another Hospital Problem: Given k units of disinfectant, how to distribute them to maximize hospitals saved? Faloutsos, Prakash, Chau, Koutra, Akoglu96Taiwan'12

97 Our Algorithm “SMART- ALLOC” CURRENT PRACTICESMART-ALLOC [US-MEDICARE NETWORK 2005] Each circle is a hospital, ~3000 hospitals More than 30,000 patients transferred ~6x fewer! Faloutsos, Prakash, Chau, Koutra, Akoglu97Taiwan'12

98 Running Time ≈ SimulationsSMART-ALLOC > 1 week 14 secs > 30,000x speed-up! Wall-Clock Time Lower is better Faloutsos, Prakash, Chau, Koutra, Akoglu98Taiwan'12

99 Experiments K = 200K = 2000 PENN-NETWORK SECOND-LIFE ~5 x ~2.5 x Lower is better Faloutsos, Prakash, Chau, Koutra, Akoglu99Taiwan'12

100 Acknowledgements Funding Faloutsos, Prakash, Chau, Koutra, Akoglu100Taiwan'12

101 References 1. Threshold Conditions for Arbitrary Cascade Models on Arbitrary Networks (B. Aditya Prakash, Deepayan Chakrabarti, Michalis Faloutsos, Nicholas Valler, Christos Faloutsos) - In IEEE ICDM 2011, Vancouver (Invited to KAIS Journal Best Papers of ICDM.) 2. Virus Propagation on Time-Varying Networks: Theory and Immunization Algorithms (B. Aditya Prakash, Hanghang Tong, Nicholas Valler, Michalis Faloutsos and Christos Faloutsos) – In ECML-PKDD 2010, Barcelona, Spain 3. Epidemic Spreading on Mobile Ad Hoc Networks: Determining the Tipping Point (Nicholas Valler, B. Aditya Prakash, Hanghang Tong, Michalis Faloutsos and Christos Faloutsos) – In IEEE NETWORKING 2011, Valencia, Spain 4. Winner-takes-all: Competing Viruses or Ideas on fair-play networks (B. Aditya Prakash, Alex Beutel, Roni Rosenfeld, Christos Faloutsos) – In WWW 2012, Lyon 5. On the Vulnerability of Large Graphs (Hanghang Tong, B. Aditya Prakash, Tina Eliassi- Rad and Christos Faloutsos) – In IEEE ICDM 2010, Sydney, Australia 6. Fractional Immunization of Networks (B. Aditya Prakash, Lada Adamic, Theodore Iwashyna, Hanghang Tong, Christos Faloutsos) - Under Submission 7. Rise and Fall Patterns of Information Diffusion: Model and Implications (Yasuko Matsubara, Yasushi Sakurai, B. Aditya Prakash, Lei Li, Christos Faloutsos) - Under Submission 101 http://www.cs.cmu.edu/~badityap/ Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu

102 Analysis Policy/Action Data Propagation on Large Networks B. Aditya Prakash Christos Faloutsos 102Taiwan'12Faloutsos, Prakash, Chau, Koutra, Akoglu


Download ppt "Anomaly Detection and Virus Propagation in Large Graphs Christos Faloutsos CMU."

Similar presentations


Ads by Google