Anomalous Node Detection in Time Series of Mobile Communication Graphs Leman Akoglu January 28, 2010

Project Question (1) In a given graph in which - edges are weighted - nodes are UNlabeled which nodes to consider as “anomalous”? (2) How about in a time-series of graphs?

Dataset: who-calls/texts-whom 3 million customers interacting over 6 months + incoming/outgoing edges from/to out-of- network users Both SMS and phone-call

ego 4 egonet Which nodes are anomalous?

5

Features to characterize nodes  N i : number of neighbors (degree) of ego i  E i : number of edges in egonet i  W i : total weight of egonet i  S i : number of singleton neighbors of ego i with degree 1  max(d i ): average degree of i’s neighbors  …

features nodes M “2-mode look” at the data as a matrix

8 Which nodes are anomalous? time

nodes M “3-mode look” at the data as a tensor features time MtMt

nodes time U VTVT ∑

Preliminary objectives ICA? Robust PCA? How to capture correlations between features? How to do evaluation? Anomalous edges/groups of nodes?