1 SnT – Interdisciplinary Centre for Security, Reliability and Trust 2 Bell Laboratories, Alcatel-Lucent Identifying abnormal patterns in cellular communication flows IPTCOMM 2013 Principles, Systems and Applications of IP Telecommunications October , 2013 David Goergen 1 Veena Mendiratta 2 Radu State 1 Thomas Engel 1
OUTLINE Introduction Related Work Model / Metric D4D Dataset Evaluation Future work Conclusion IPTCOMM /11/20132
Intro Analyzing large volumes of cellular communications records –Can help to improve the overall quality it provides to its users –Allows operators to detect abnormal patterns and react accordingly Definition of model and metric to detect abnormal traffic Application on a country-level data set Correlated detected flows with events IPTCOMM /11/20133
D4D Dataset specification One country Time Period: to million users 1124 base stations (for mobile communications) More then 3 billion entries summarizing on a hourly basis the SMS and Voice Calls mobile users tracked over these months with GPS and call records IPTCOMM /11/20134
D4D Dataset specification Set 1: Base station-to-base station ongoing calls Set 2: User movement among base stations Set 3: User movement among region subdivision Set 4: Communication sub-graphs IPTCOMM /11/20135
Related Work S. van den Elzen, D. H. Jorik Blaas, J.-K. Buenen, J. J. van Wijk, R. Spousta, A. Miao, S. Sala, and S. Chan. Exploration and Analysis of Massive Mobile Phone Data: A Layered Visual Analytics approach. In NetMob, 2013 M. Cerinsek, J. Bodlaj, and V. Batagelj. Symbolic clustering of users and antennae. In NetMob, G. Krings, F. Calabrese, C. Ratti, and V. D. Blondel. Urban Gravity: A Model For Intercity Telecommunication Flows. Journal Of Statistical Mechanics: Theory And Experiment, 2009, 2009 V. A. Traag, A. Browet, F. Calabrese, and F. Morlot. Social Event Detection in Massive Mobile Phone Data Using Probabilistic Location Inference. In Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on Social Computing (SocialCom), IPTCOMM /11/20136
Model / Metric IPTCOMM /11/20137
Comparison Related WorkOur method 11/11/2013IPTCOMM 20138
Data processing on Hadoop cluster Hadoop cdh nodes –hexacore 2.4GHz Xeon 120 GB RAM HDFS TB 2 x 1GB Ethernet bonded IPTCOMM /11/20139
Hadoop job process 11/11/2013IIT RTC conference10
Metric parameters Analyzing the impact of α and the window size w –α dataset –w dataset Tradeoff between granularity and loss of detail Chosen w = 10 and α = 0.5 IPTCOMM /11/201311
Abnormal number of calls Applying our metric –Circle Power failures –Square President appeared at court –Triangle Rebelious fanatics invasion IPTCOMM /11/201312
Abnormal duration of calls Applying our metric –Circle Power failures –Square President appeared at court –Triangle Rebelious fanatics invasion IPTCOMM /11/201313
Closer look at specific region IPTCOMM /11/201314
Detecting abnormal situation IPTCOMM /11/201315
IPTCOMM /11/201316
Observation of the highlighted period IPTCOMM /11/201317
IPTCOMM /11/201318
Clustering: mean duration vs mean number of calls Group A –Small amount of calls and short to medium duration Group B –Large amount of calls and short to medium duration usual diurnal behaviour of night and day communication Group C is the outlier –Long duration and global average amount of calls –All calls occur in the same time slot on different days IPTCOMM /11/201319
Principal Component Analysis PCA on number of callsPCA on the total duration IPTCOMM /11/201320
PCA result Cross-referencing the results of both analyses 10 base stations most affected by PC1 IPTCOMM /11/201321
Future Work Further investigate the impact of the chosen parameters –Window size and α Graph theory analysis –Detect effects on the complete connected graph –Using page-rank or HITS algorithm IPTCOMM /11/201322
Conclusion Detection of abnormal traffic is possible by our metric Large data set analysis in reasonable amount of time IPTCOMM /11/201323
THANK YOU FOR YOUR ATTENTION QUESTIONS? IPTCOMM /11/201324
Requirements 11/11/2013IPTCOMM