1 Clarifying Sensor Anomalies using Social Network feeds * University of Illinois at Urbana Champaign + U.S. Army Research Lab ++ IBM Research, USA Prasanna Giridhar *, Tanvir Amin *, Lance Kaplan +, Jemin George +, Raghu Ganti ++, Tarek Abdelzaher *

2 INTRODUCTION  Explosive growth in deployment of physical sensors.  Many times activities recorded by these sensors deviate from the norm:  Closure of a freeway due to forest fire.  Change in building occupancy due to shutdown.  Unusual behavior tend to attract human attention and get reported socially as well.

3  Several research works in the past for detecting events in the physical as well as the social domain.  Can we use the social media as a tool for explaining the underlying cause of anomalies?  A system for identifying the discriminative social feeds that can be correlated with sensor anomalies.  The more unusual the event, higher probability.  Evaluation performed on real time traffic data. MOTIVATION

4 System Work-flow STEP 1: Initialization of the system Continuous stream of tweets using parameters  Keywords  Location Continuous stream of data from physical sensors

5 STEP 2: Identification of sensor anomalies  Run a black box algorithm.  Store attributes for sensors classified positively by the algorithm  Cluster the sensors which provide redundant data Detecting events in Sensors

6 STEP 2: Identification of sensor anomalies  Run a black box algorithm.  Store attributes for sensors classified positively by the algorithm  Cluster the sensors which provide redundant data Detecting events in Sensors t1,t2

7 STEP 2: Identification of sensor anomalies  Run a black box algorithm.  Store attributes for sensors classified positively by the algorithm  Cluster the sensors which provide redundant data Detecting events in Sensors

8 STEP 3: Identification of discriminative social feeds  Social feeds often have keywords describing an event Discriminative Social Feeds  Keywords: malaysian, airlines, 370

9 Keyword Signatures Single Keyword? Airlines

10 Keyword Signatures Keyword pair? Malaysian, Airlines

11 Keyword Signatures Keyword triplet? Malaysia, Airlines, 370 Malaysia, Airlines, Satellite

12 Keyword Signatures Signature Events per Signature Signatures per Event Single keyword Keyword Pair Keyword Triplet  Signature profile on the twitter data collected  Ideal 1-to-1 mapping for keyword pair

13 Problem: Given a list of keyword pairs for the current and past window, how to find the most discriminating subset? Difference in rate of occurrences: (traffic,jam) 50 times today compared to past average of 35 (drunk, kills) 12 times today compared to a past average of 0. Increase in percentage: (traffic,jam) 1 time today compared to past average of 0 (drunk, kills) 12 times today compared to a past average of 2 Possible Approaches Overcome disadvantages using Information Gain Theory

14 Information Gain Theory and Entropy Entropy measures randomness introduced by a variable Using conditional entropy value determine information gain about an event by the keyword pair. This can be formulated as: Information Gain = H(Y) − H(Y|X) Y: variable associated with event; y=0 (normal) and y=1 (anomalous) X: variable associated with keyword pair; x=0 (absent) and x=1 (present)

15 STEP 4: Ranking discriminative events  Identify tweets for discriminative pairs.  Score proportional to conditional entropy.  The lower the entropy value, the higher is the discriminating power. Rank the unusual events

16 STEP 5: Matching tweets with sensor anomalies We align both the data based on spatiotemporal properties associated with the event. For example  Sensor ID40456 on I-15 Northbound with unusual activity  Unusual Tweet: “SFvSD game tonight, traffic!!!” Mapping both events

17 STEP 6: Output the matched explanations  Final step is to provide the explanations.  A user interface which enables to track unusual events on a per-day basis. Output Explanations

18 Twitter feeds collected for a period of 2 weeks: Aug 19 to September 01, 2013 with a radius of 30 miles Three cities in CA: Los Angeles San Francisco San Diego Physical sensors data retrieved from PeMS (Caltrans Performance Measurement System ) : 5 minutes report for flow, speed, occupancy, delay EXPERIMENTAL RESULTS

19 Table: Precision using different methods B1 corresponds to Difference in rate of occurrences and B2 to Increase in percentage. Table: Average position of tweets from the top Performance measured using Precision and Mean Average rank for our Information gain theory approach against other baseline approaches EXPERIMENTAL RESULTS

20 INTERESTING EVENTS Sensor anomaly detected  Highway I-80 Eastbound in SF  Landmarks: Bay bridge  Duration: 4 days

21 INTERESTING EVENTS

22 US101 blockage due to Bomb squad in LA INTERESTING EVENTS

23 Traffic on 15N due to game in SD INTERESTING EVENTS

24 CONCLUSION  Abnormal behavior recorded in social medium.  Tool to explain the abnormalities.  Major activities explained with high precision.  Explanations ranked among top two tweets.

25 Future Work  Scalability Issues  Credibility of social feeds  Geo localization of tweets

26 THANK YOU Q+A