Network Analysis Max Hinne

Social Networks 6/1/20152Network Analysis

Networks & Digital Security Interdisciplinary Combination formal & ‘soft’ interpretation Security in the sense of a detective 6/1/2015Network Analysis3

Overview 1.Primer on graph theory 2.Centrality – Who is important? 3.Clustering – Who belong together? 4.Detecting & predicting changes – LIGA project Central theme: global vs. local approaches 6/1/2015Network Analysis4

GRAPH PRIMER 6/1/2015Network Analysis5

Graph primer - basics V = vertices, N = |V| A = arcs, M = |A| 6 (x points to y) 6/1/2015Network Analysis

Graph primer - concepts Neighborhood: Degree: Path: Similar concepts for undirected graphs G=(V,E) 6/1/2015Network Analysis7

Graph primer – graph types 6/1/2015Network Analysis Models for these graphs by: 1.Erdős-Renyi (1959) 2.Tsvetovat-Carley (2005) 3.Barabási-Albert (1999)

Graph primer – degree distributions Erdős-Renyi: number of vertices N, each edge occurs with probability p Barabási-Albert: start with a small set of vertices and add new ones. Each new vertex is connected to others with a probability based on their degree 6/1/2015Network Analysis9 Degree distributions: what is the chance a node has degree k? Poisson Power-law (scale-free)

Graph primer – small world effect Famous experiment by Milgram (1967) Everyone on the world is connected to everyone else in at most 6 steps Social graphs exhibit the ‘small world effect’: the diameter of a social graph scales logarithmically with N 6/1/2015Network Analysis10

CENTRALITY 6/1/2015Network Analysis11

Centrality 6/1/201512Network Analysis Importance, control of flow Ranking of most important (control) to least important (control)

Node centrality measures 1/4 6/1/2015Network Analysis13 – Degree Immediate effect

Node centrality measures 2/4 6/1/2015Network Analysis14 – Closeness ETA of flow to v c C inverted for visualization

Node centrality measures 3/4 6/1/2015Network Analysis15 – Eigenvector Influence or risk

Node centrality measures 4/4 6/1/2015Network Analysis16 – Betweenness Volume of flow/traffic

Obtaining c B Fastest current algorithm by Brandes in O(nm) Solves all shortest paths in one pass – For each vertex, consider all d=1 nearest neighbors, then d=2 and so on – For each shortest path, store which vertices are on it – Derive c B 6/1/2015Network Analysis17

Local approach No known algorithms calculate c B (v) faster than c B (v) for all v! We only want to rank nodes of interest, not all Local approach – Find c B for some specific nodes – If we can estimate c B, we can rank relevant nodes 6/1/201518Network Analysis

Ego betweenness 6/1/201519Network Analysis Ego-net: and corresponding edges Calculate c B considering only ego(v) Let A be the adjacency matrix:

No direct link between c B and c EB 6/1/2015Network Analysis20 Red circles + ego form a n+1 node star Green triangles form an p node complete graph K p Red circles + ego form a p+1 node star Green triangles + ego form an n node complete graph K n

Correlation c B and c EB Very strong positive correlation! 6/1/2015Network Analysis21

GRAPH CLUSTERING 6/1/2015Network Analysis22

Types of clustering What is a cluster? Supervised vs. unsupervised Partitional vs. hierarchical 6/1/2015Network Analysis23

Clustering quality – modularity C1C1 C2C2 C3C3 C4C4 C1C C2C C3C C4C C1C1 C2C2 C3C3 C4C4 C1C C2C C3C C4C Network Analysis6/1/2015 Cluster adjacency matrixCluster adjacency matrix E

Newman & Girvan clustering algorithm Edges that are the most ‘between’ connect large parts of the graph 1.Calculate edge betweenness A ij in n x n matrix A 2.Remove edge with highest score 3.Recalculate edge betweenness for affected edges 4.Goto 2 until no edges remain O(m 2 n), may be smaller on graphs with strong clustering 6/1/2015Network Analysis25

Greedy clustering algorithm Maximize Q to find clustering Greedy approach: Creates a bottom-up dendogram Cut corresponding to maximum Q is optimal clustering Still a costly process, O(n 2 ) 6/1/2015Network Analysis26 C := V; repeat (i,j) := argmax{∆Q|C i, C j C}; C := C - C j ; C i := C i + C j ; until |C| = 1

Practical applications of social clusters Find people related to someone Find out if people belong to the same cluster This does not require a partitioning of the entire network! 6/1/2015Network Analysis27

Local modularity C= collection nodes v ∈ V with known link structure U(C) = all nodes outside C to which nodes from C point: U(C) = {u ∈ V-C|A(C,u) ≠ ∅ } B(C) = all nodes in C with at least one neighbor outside C: B(C) = {b ∈ C|A(b,U) ≠ ∅ } C: cluster U: universe B: boundary 28Network Analysis6/1/2015

Local cluster algorithm C := Ø; v := v 0 ; repeat C := C+v; v := argmax{R(C+u)|u ∈ U(C)} until |C| = k or R ≥ d ∆R(C,u) = R(C+u) – R(C) Arcs removed from arcs(B(C),V) Arcs newly added to arcs(B(C),V) Arcs removed from arcs(B(C),C) Arcs newly added to arcs(B(C),C) ∆R(C+v 4 ) = 1/3 – 1/4 = 1/12 29Network Analysis6/1/2015

Example 1 on Zachary’s Karate Club (d=0.65) 6/1/2015Network Analysis30

Example 2 on Zachary’s Karate Club (d=0.65) 6/1/2015Network Analysis31

Local cluster quality vs. global clusters For each node v in each global cluster i – Find the local cluster with the same size – Average 6/1/2015Network Analysis32

Preliminary results on real graphs Network (size)Compiled bySim(L v,G i )STD Karate club (34)Zachary Dolphin social relations (62)Lusseau Les Miserables coappearance (75)Knuth American College Football (113)Girvan & Newman C. Elegans neural network (295)Watts & Strogatz 6/1/2015Network Analysis33 Experiment too small for real conclusions, but – edge vertices ruin the fun, – edge betweenness? Usefulness of local approach depends on the seed node

LOCAL INTELLIGENCE IN GLOBAL APPLICATIONS LIGA 6/1/2015Network Analysis34

Web graph ‘Social’ network of blogs and news sites Most graph models are static, but the Web is highly dynamic Stored copy is infeasible, continuous crawling intractable Change in relevance -> change in link structure 6/1/2015Network Analysis35

Fully connected triad (1 role) Node roles Frequently recurring sub graphs: motifs Nodes share a role iff there is a permutation of nodes and edges that preserves motif structure On the Web: 6/1/2015Network Analysis36 Uplinked mutual dyad (2 roles) Feedback with two mutual dyads (2 roles)

Dynamic graphs Changes in relevance cause changes in link structure Changes in specific roles imply changes in other node roles – Fanbase links to itself and their authorities – Learning relevant links through affiliated sites – etc. Relevance decays (half-life λ) 6/1/2015Network Analysis37

LIGA research questions How to model (Web) node relevance ? How does acquired or lost relevance change linkage? How can we predict consequential changes? How can such prediction models be approximated by local incremental algorithms? A. m. o.... 6/1/2015Network Analysis38

Putting it together Networks can be analyzed using an array of tools Network analysis is useful in various disciplines: – Information Retrieval – Security But also in: – Sociology – (Statistical) physics – Bioinformatics – AI 6/1/2015Network Analysis39

Most cited literature Centrality: – Borgatti S. P.: Centrality and Network Flow. Social Networks 27 (2005) – Brandes U.: A Faster Algorithm for Betweenness Centrality. Journal of Mathematical Sociology 25(2) (2001) – Freeman L. C.: A Set of Measures of Centrality Based on Betweennes. Sociometry 40 (1977) Clustering: – Clauset A.: Finding local community structure in networks. Physics Review E 72 (2005) – Girvan M., Newman M. E. J.: Community structure in social and biological networks. PNAS 99(12) (2002) – Newman M. E. J.: Fast algorithm for detecting community structure in networks. Physics Review E 69 (2004) /1/2015Network Analysis40