1. EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS
Leman Akoglu Christos Faloutsos

2. MOTIVATION Anomaly and event (change-point) detection,
is the building block for many applications:
Cyber warfare
Network intrusion
Epidemic outbreaks
Fault detection in engineering systems
The US Geological survey (USGS), as per this BBC report, is trawling the tweets for keywords like quake and earthquake to detect earthquakes to an extent , but mostly to gauge its impact and to know the severity in  different geographic areas. 
As you can see, people break up less during the summer, and more during the Winter and Spring.
* A big peak right before Spring Break * Most breakups are announced on Mondays * People like to start the summer being single * A big peak right before Christmas * The lowest day throughout the whole year is Christmas Day

3. DATA DESCRIPTION
Texting interactions of mobile phone users from a phone service company in a large city in India
who-texts-whom network
edge-weighted: #SMS
>2 million customers
50 million SMS interactions
Dec. 1, 2007 to May 31, 2008

4. PROBLEM STATEMENT
Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

5. PROBLEM STATEMENT Two main considerations:
N is very large (on the order of 106)
 monitoring each node independently is not practical.
“Anomaly” is defined in a collective setting
 a time-point/node is anomalous if different than “others”

6. OVERVIEW OF OUR METHOD
Extract features for nodes
Derive the typical behavior (“eigen-behavior”) of nodes
Compare “eigenbehavior”s over time

7. FEATURE EXTRACTION Extract features from egonets for all nodes
Indegree/outdegree
Inweight/outweight
Number of neighbors
Number of edges
Reciprocal degree …

8. DATA IN 3-D
Nodes (>2 million)
Features (12)
Time
(183 days)

9. OVERVIEW OF OUR METHOD
Extract features for nodes
Derive the typical behavior (“eigen-behavior”) of nodes
Compare “eigenbehavior”s over time

10. DERIVING “EIGEN-BEHAVIOR”T N N T F W T N N
F:inweight
principal eigenvector
“typical behavior”
“eigen-behavior”
active node  high score
e.g. nodes 1, 2, 6

11. OVERVIEW OF OUR METHOD
Extract features for nodes
Derive the typical behavior (“eigen-behavior”) of nodes
Compare “eigenbehavior”s over time

12. TRACKING “BEHAVIOR” OVER TIMEF W W T N N
F:inweight
past pattern
change metric:
angle θ
eigen-behavior at t
eigen-behaviors

13. DETECTED CHANGE POINTS
EXPERIMENTS
F:inweight
Christian New Year
Hindi New Year
“back to work”

14. DETECTED CHANGE POINTS
EXPERIMENTS
F: out-degree
F: reciprocal degree
Similar behavior for other features

15. PROBLEM STATEMENT
Given a graph that changes over time, can we identify: 1) “change detection”: time points at which many of the N nodes change their behavior significantly? 2) “attribution”: top k nodes which contribute to the change in behavior the most?

16. ATTRIBUTING CHANGE TO NODES
EXPERIMENTS
F:inweight
DEC 26
r(t-1)
no change zone
u(t)

17. ATTRIBUTING CHANGE TO NODES
EXPERIMENTS
26 DEC
26 DEC
#SMS received
Not
time (days)
Time series of top 5 nodes marked

18. ATTRIBUTING CHANGE TO NODES
EXPERIMENTS
JAN 2
“back to work”
reciprocal degree
time (days)

19. CONCLUSION
An algorithm based on tracking “eigenbehavior” patterns over time
“change detection”: spot time-points at which “behavior” changes significantly
“attribution”: spot nodes that cause the most change
Experiments: on real, SMS messages, 2M users, over 6 months

20. THANK YOU www.cs.cmu.edu/~lakoglu
Christian New Year
“back to work”
Hindi New Year
26 DEC
change detection
attribution