Presentation is loading. Please wait.

Presentation is loading. Please wait.

B. Aditya Prakash Computer Science Virginia Tech.

Similar presentations


Presentation on theme: "B. Aditya Prakash Computer Science Virginia Tech."— Presentation transcript:

1 B. Aditya Prakash Computer Science Virginia Tech.
Understanding, Predicting and Managing Behaviors using Propagation: From Flu-trends to Cyber-Security B. Aditya Prakash Computer Science Virginia Tech. Fidelis Cybersecurity, Sept 26, 2016

2 Thanks! Abhishek Sharma Prakash 2016

3 Networks are everywhere!
Facebook Network [2010] Gene Regulatory Network [Decourty 2008] Human Disease Network [Barabasi 2007] The Internet [2005] Prakash 2016

4 Dynamical Processes over networks are also everywhere!
Prakash 2016

5 Why do we care? Social collaboration Information Diffusion
Viral Marketing Epidemiology and Public Health Cyber Security Human mobility Games and Virtual Worlds Ecology Prakash 2016

6 Why do we care? (1: Epidemiology)
Dynamical Processes over networks [AJPH 2007] SI Model CDC data: Visualization of the first 35 tuberculosis (TB) patients and their 1039 contacts Diseases over contact networks Prakash 2016

7 Why do we care? (1: Epidemiology)
Dynamical Processes over networks Each circle is a hospital ~3000 hospitals More than 30,000 patients transferred Mention number of hospitals Patients transferred [US-MEDICARE NETWORK 2005] Problem: Given k units of disinfectant, whom to immunize? Prakash 2016

8 Why do we care? (1: Epidemiology)
~6x fewer! [US-MEDICARE NETWORK 2005] CURRENT PRACTICE OUR METHOD Hospital-acquired inf. took 99K+ lives, cost $5B+ (all per year) Prakash 2016

9 Why do we care? (2: Online Diffusion)
> 800m users, ~$1B revenue [WSJ 2010] ~100m active users > 50m users Prakash 2016

10 Why do we care? (2: Online Diffusion)
Dynamical Processes over networks Buy Versace™! Celebrity Followers Social Media Marketing Prakash 2016

11 Why do we care? (3: To change the world?)
Dynamical Processes over networks Social networks and Collaborative Action Prakash 2016

12 High Impact – Multiple Settings
epidemic out-breaks Q. How to squash rumors faster? Q. How do opinions spread? Q. How to market better? products/viruses transmit s/w patches Prakash 2016

13 Large real-world networks & processes
Research Theme ANALYSIS Understanding POLICY/ ACTION Managing/Utilizing DATA Large real-world networks & processes Prakash 2016

14 Research Theme – Public Health
ANALYSIS Will an epidemic happen? POLICY/ ACTION How to control out-breaks? DATA Modeling # patient transfers Prakash 2016

15 Research Theme – Social Media
ANALYSIS # cascades in future? POLICY/ ACTION How to market better? DATA Modeling Tweets spreading Prakash 2016

16 Large real-world networks & processes
In this talk DATA Large real-world networks & processes Q1: How to predict Flu- trends better? Q2: How does information evolve over time? Prakash 2016

17 Large real-world networks & processes
In this talk DATA Large real-world networks & processes Q3: How do malware attacks evolve over time? Prakash 2016

18 Outline Motivation Part 1: Learning Models (Empirical Studies)
Part 2: Policy and Action (Algorithms) Conclusion single virus VS multiple viruses Prakash 2016

19 Part 1 Part 1: Learning Models (Empirical Studies)
Q1: How to predict Flu-trends better? Q2: How does information evolve over time? Q3: How does malware attacks evolve over time? single virus VS multiple viruses Prakash 2016

20 Surveillance How to estimate and predict flu trends?
[Chen et. al. ICDM 2014] Surveillance How to estimate and predict flu trends? Population survey Hospital record Lab survey Surveillance Report Prakash 2016

21 GFT & Twitter Estimate flu trends using online electronic sources
So cold today, I’m catching cold. I have headache, sore throat, I can’t go to school today. My nose is totally congested, I have a hard time understanding what I’m saying. Prakash 2016

22 Observation 1: States There are different states in an infection cycle. SEIR model: 1. Susceptible Exposed 3. Infected Recovered Prakash 2016

23 Observation 2: Ep. & So. Gap
Infection cases drop exponentially in epidemiology (Hethcote 2000) Keyword mentions drop in a power-law pattern in social media (Matsubara 2012) Prakash 2016

24 HFSTM Model Details Hidden Flu-State from Tweet Model (HFSTM)
Each word (w) in a tweet (Oi) can be generated by: A background topic Non-flu related topics State related topics Latent state Initial prob. Transit. switch Binary non-flu related switch Transit. prob. Binary background switch Word distribution Prakash 2016

25 HFSTM Model Generating tweets Generate the state for a tweet
Generate the topic for a word State: [S,E,I] Topic: [Background, Non-flu, State] S: good This restaurant is really E: The movie was but it freezing I: I think have flu Prakash 2016

26 Inference Details EM-based algorithm: HFSTM-FIT E-step: M-step:
At(i)=P(O1,O2,…,Ot,St=i) Bt(i)=P(Ot+1,…,OTu|St=i) γt(i)=P(St=i|Ou) M-step: Other parameters such as state transition probabilities, topic distributions, etc. Parameters learned: Prakash 2016

27 A possible issue with HFSTM
Suffers from large, noisy vocabulary. Semi-supervision for improvement Introduce weak supervision into HFSTM. Prakash 2016

28 HFSTM-A HFSTM-A(spect)
Introduce an aspect variable y, expressing our belief on whether a word is flu-related or not. The value of y biases the switch variables s.t. flu-related words are more likely to be explained by state topics. When the aspect value (y) is introduced, the switching probability are updated accordingly. Prakash 2016

29 Vocabulary & Dataset Vocabulary (230 words): Dataset (34,000 tweets):
Flu-related keyword list by Chakraborty SDM 2014 Extra state-related keyword list Dataset (34,000 tweets): Identify infected users and collect their tweets Train on data from Jun 20, 2013-Aug 06, 2013 Test on two time period: Dec 01, July 08, 2013 Nov 10, 2013-Jan 26, 2014 Prakash 2016

30 Learned word distributions
The most probable words learned in each state Probably healthy: S Having symptons: E Definitely sick: I Prakash 2016

31 Learned state transition
Transition probabilities Transition in real tweets Learned by HFSTM: Not directly flu-related, yet correctly identified Prakash 2016

32 Flu trend fitting Ground-truth: Algorithms:
The Pan American Health Organization (PAHO) Algorithms: Baseline: Count the number of keywords weekly as features, and regress to the ground-truth curve. Google flu trend: Take the google flu trend data as input, regress to the PAHO curve. HFSTM: Distinguish different states of keyword, and only use the number of keywords in I state. Again regress to PAHO. Prakash 2016

33 Flu trend fitting Linear regression to the case count reported by PAHO (the ground-truth) Prakash 2016

34 HFSTM-A Results are qualitatively similar with HFSTM, when the vocabulary is 10 times larger. Prakash 2016

35 Part 1 Part 1: Learning Models (Empirical Studies)
Q1: How to predict Flu-trends better? Q2: How does information evolve over time? Q3: How does malware attacks evolve over time? single virus VS multiple viruses Prakash 2016

36 Google Search Volume ? ? e.g., given (1) first spike,
(2) release date of two sequel movies (3) access volume before the release date (1) First spike (2) Release date (3) Two weeks before release ? ? Prakash 2016

37 Patterns Y X Prakash 2016

38 Patterns Y More Data X Prakash 2016

39 Patterns Y Anomaly ? X Prakash 2016

40 Patterns Y Anomaly ? Extrapolation X Prakash 2016

41 Patterns Y Anomaly Imputation Extrapolation X Prakash 2016

42 Patterns Anomaly Imputation Compression Extrapolation Prakash 2016

43 Rise and fall patterns in social media
Meme (# of mentions in blogs) short phrases Sourced from U.S. politics in 2008 “you can put lipstick on a pig” “yes we can” Prakash 2016

44 Rise and fall patterns in social media
Can we find a unifying model, which includes these patterns? four classes on YouTube [Crane et al. ’08] six classes on Meme [Yang et al. ’11] Prakash 2016

45 Rise and fall patterns in social media
Answer: YES! We can represent all patterns by single model In Matsubara, Sakurai, Prakash+ SIGKDD 2012 Prakash 2016

46 Main idea - SpikeM β 1. Un-informed bloggers (uninformed about rumor)
2. External shock at time nb (e.g, breaking news) 3. Infection (word-of-mouth) β Time n=0 Time n=nb Time n=nb+1 Infectiveness of a blog-post at age n: Strength of infection (quality of news) Decay function (how infective a blog posting is) Power Law Prakash 2016

47 -1.5 slope J. G. Oliveira et. al. Human Dynamics: The Correspondence Patterns of Darwin and Einstein. Nature 437, 1251 (2005) . [PDF] (also in Leskovec, McGlohon+, SDM 2007) Prakash 2016

48 SpikeM - with periodicity
Details SpikeM - with periodicity Full equation of SpikeM Periodicity 12pm Peak activity 3am Low activity Time n Bloggers change their activity over time (e.g., daily, weekly, yearly) activity Prakash 2016

49 Tail-part forecasts SpikeM can capture tail part Prakash 2016

50 “What-if” forecasting
e.g., given (1) first spike, (2) release date of two sequel movies (3) access volume before the release date (1) First spike (2) Release date (3) Two weeks before release ? ? Prakash 2016

51 “What-if” forecasting
SpikeM can forecast not only tail-part, but also rise-part! SpikeM can forecast upcoming spikes (1) First spike (2) Release date (3) Two weeks before release Prakash 2016

52 Bonus: Protest Predictions
Violent Protest (VP) [Sundereisan et al. ASONAM 2014] [Jin et al. SIGKDD 2014] Can Twitter provide a lead time? South American twitter dataset Language: Spanish/Portuguese Idea Look for trending keywords. Predict event type for protest using SpikeM parameters! VP A political tweet Non Violent Protest (P) P Prakash 2016

53 Part 1 Part 1: Learning Models (Empirical Studies)
Q1: How to predict Flu-trends better? Q2: How does information evolve over time? Q3: How do malware attacks evolve over time? single virus VS multiple viruses Prakash 2016

54 Modeling Malware Penetration
Worldwide Intelligence Network Which machine got which malware (or legitimate files) 1 Billion nodes 37 Billion edges Q: Temporal patterns? Prakash 2016

55 Pointers: Book chapter
Graph Mining for Cyber Security Prakash. Cyber Warfare: Building the Scientific Foundation Springer 2015. Latest results on using big-data graph mining for cyber security Prakash 2016

56 Book plug The Global Cyber-Vulnerability Report
Subrahmanian, Ovelgonne, Dumitras, Prakash. Springer 2016 The result of analyzing two years of data from Symantec comprising over 20 billion malware and telemetry reports from over 4 million machines per year over a 2 year period. In addition, the report looks at the cybersecurity policies of all 44 countries and tries to identify important next steps that must be taken to mitigate cyber-threats. Prakash 2016

57 WINE dataset Prakash 2016

58 Cybersecurity Popularity of files follows a power-law Prakash 2016

59 Q: Temporal Patterns Looks familiar? 
Exponential rise and power law fall Prakash 2016

60 SpikeM again (or SharkFin)
[Papalexakakis et. al. ASONAM 2013] 7 parameters only! ~ 400 points ~ 400 points Prakash 2016

61 Latent Propagation Patterns
Prakash 2016

62 BUT Does not take into account differences between detections vs actual infections. Prakash 2016

63 Domain-based approach: Data
[Chan et. al. WSDM 2016] Looked at the entire 2 years of WINE data. Augmented with vulnerability and patch data from NIST’s National Vulnerability Database (NVD) Considered all machines from 40 countries – study still ongoing. Considered the 50 most commonly occurring malware. Prakash 2016

64 Study Approach: Main Steps
Prakash 2016

65 Study Approach: Patch & Detection Incompetence
Incompetence : 4 base variables to measure hosts' incompetence in detecting malware and incompetence in patching (absolute and relative) w.r.t. various time period. “How much time each host took in detecting or patching for each malware” For each time tick, we built a directed bipartite graph capturing normalized detection/patching incompetence between malware and hosts Prakash 2016

66 FBP Model Dependent variable: For each (c,m) pair, the % of hosts in the country c attacked by malware m. Independent variables for each (c,m) pair: ADI, API, RDI, RPI, AADI, ARDI,AAPI, ARPI, ADA, RDA, APA and RPA of hosts in country c, APH and RPH of malware m Six similarity measures for hosts in two different countries Per Capita GDP and HDI of countries Found k-nearest neighbors of each (c,m) pair according to different similarity measures and used features of those countries as well. Prakash 2016

67 DIPS and DIPS-EXP Model
Infection rate 𝛽 𝑡 . Patching rates: Susceptible hosts: 𝜃(𝑡) Detected hosts: 𝛿(𝑡) Developed algorithm to learn best parameters for DIPS and DIPS-Exp model by minimizing error terms. Prakash 2016

68 Learning DIPS parameters
Given the #infections and detection at each time t in learning period, find parameters Φ to minimize the sum of squared errors: Learning algorithm (Two phases) Train parameters with sum of all infections and detections Train the subset of parameters for each target pair ML technique: Levenberg Marquardt (LM) algorithm Prakash 2016

69 Ensemble Models Developed two kinds of models: Ensemble Models
Feature-based prediction (FBP) Propagation-based prediction (DIPS) Ensemble Models Based on FBP Add output from DIPS models as additional features Prakash 2016

70 Experiments : Overall We predict infection ratios of hosts in each country for each malware Test all country-malware pairs for top 50 malware and top 40 GDP countries w.r.t. # of infections NRMSE is important because infections ratios over countries are very different FBP shows better performance than FUNNEL w.r.t. all performance measures DIPS shows better performance than FBP w.r.t. all performance measures ESM0 is the best w.r.t. NRMSE FUNNEL*: disease infection prediction model FBP + FUNNEL does not work The MAE* values were computed with |# of ground true infected hosts – the expected # of infected hosts| Prakash 2016

71 Experiments Prakash 2016

72 Summary of Forecasting Experiments
FBP, DIPS and ESM showed better performance when there were lots of infection attempts. FBP showed reliable performance across the board DIPS was very accurate when infectiousness level is high ESM takes both advantages of FBP and DIPS and shows very accurate and reliable performance Prakash 2016

73 Extensions: Human Vulnerability (to malware attacks) Study
Identify behaviors of users that are correlated with the number of attacks on those users Approach: Find statistical proxies for human behavior Correlate them with malware attacks [Ovelgonne et al. TIST 2016] Some slides from: V S Subrahmanian Prakash 2016

74 Host behavior and Vulnerability
Prakash 2016

75 Results 1 Prakash 2016

76 Number of Binaries vs number of infections per host
Prakash 2016

77 Results 2: Software developers are the most vulnerable (8.1 vs. 3.3)), even after discounting for the fact that many binaries may have been produced by them. All results are statistically significant with p < (i.e. with > 99.9% confidence) Prakash 2016

78 Also: Cyber-vulnerability
Characterize CV of customers in different countries? help governments/companies better ensure safer user behavior Prakash 2016

79 Data Preparation Prakash 2016

80 Question Which 5 countries have the highest rate of attacks per machine? Prakash 2016

81 Similarly Prakash 2016

82 World Cyber-Vulnerability Map
Prakash 2016

83 Europe Prakash 2016

84 Average Attacks per Host
Prakash 2016

85 But in India… Prakash 2016

86 Per capita GDP and attacks
Prakash 2016

87 Downloaded Binaries and Risk
Prakash 2016

88 50 most-common malware Order?
US UK S. Korea India China S. Korea, India, and China may be doing a better job patching against the most common 50 types of malware. Or maybe in the US, people distribute patching effort across lots of malware components. Our model took patching behavior into account. Prakash 2016

89 More in… The Global Cyber-Vulnerability Report
Subrahmanian, Ovelgonne, Dumitras, Prakash. Springer 2016 The result of analyzing two years of data from Symantec comprising over 20 billion malware and telemetry reports from over 4 million machines per year over a 2 year period. In addition, the report looks at the cybersecurity policies of all 44 countries and tries to identify important next steps that must be taken to mitigate cyber-threats. Prakash 2016

90 Outline Motivation Part 1: Learning Models (Empirical Studies)
Part 2: Policy and Action (Algorithms) Conclusion single virus VS multiple viruses Prakash 2016

91 Alg 1: Immunization (= Interventions)
Different Flavors: Pre-emptive Data-aware Prakash 2016

92 Pre-emptive: Vulnerability
First eigenvalue λ1 (of adjacency matrix) is sufficient for most diffusion models. [Prakash et al. ICDM’12 selected for best papers] λ1 is the epidemic threshold “Safe” “Vulnerable” “Deadly” Increasing λ1 , Increasing vulnerability Prakash 2016

93 Goal Decrease λ1 as much as possible
Node based [Tong, P., + ICDM 2010] Edge-based [Tong, P., Eliassi-Rad+ CIKM 2012, Best Paper Award] Edge-Manipulation [P., Adamic+ SDM 2013] Prakash 2016

94 Latest results First (provable) approximation algorithms for edge-based problem [Saha, Adiga, P., Vullikanti SDM 2015]) O(log^2 n)--factor (can be improved to O(log n)) Based on the idea of removing closed walks Semi-Definite Programming Rounding-based O(1) factor Prakash 2016

95 Data-aware Immunization
[Zhang and Prakash, SDM 2014 Zhang and Prakash, TKDD 2015] Given: Graph and Infected nodes Find: ‘best’ nodes for immunization Complexity NP-hard Hard to approximate within an absolute error DAVA-tree Optimal solution on the tree DAVA and DAVA-fast Merging infected nodes Build a “dominator tree”, and run DAVA-tree Running time: subquadratic DAVA: O(k(|E|+ |V|log|V|)) DAVA-fast: O(|E|+|V|log|V|) Graph with infected nodes Dominator tree Prakash 2016

96 Extensions Can be extended to Uncertain and noisy initial data as well! [Zhang and Prakash, CIKM 2014] Twitter Firehose API 1% sample Prakash 2016

97 Alg 2: “Zoom-out” of the network
“Zoom-out” of the cascade graph to get a quick picture (= summarization) A D D A Zoom-out C C B B F E F E Smaller representation of the network Big graph Coarsening [Purohit, Prakash, et, al. SIGKDD 2014] Prakash 2016

98 Application: Diffusion observation
Stats: 1891 groups mean group size: 16.6 the largest group: nodes (roughly 40% of nodes) (See more results in the paper) Observation 1: a very large fraction of movies propagate in a small number of groups Observation 2: a multi-modal distribution Prakash 2016

99 And many others…. Finding Culprits [Prakash et al. 2012]
Correcting for missing data in cascades [Sunderaisen et al. 2015] Prakash 2016

100 Outline Motivation Part 1: Learning Models (Empirical Studies)
Part 2: Policy and Action (Algorithms) Conclusion single virus VS multiple viruses Prakash 2016

101 Large real-world networks & processes
Future Plans ANALYSIS Understanding POLICY/ ACTION Managing DATA Large real-world networks & processes Prakash 2016

102 Scalability – Big Data Need scalable algorithms for
Datasets of unprecedented scale High dimensionality and sample size! Need scalable algorithms for Learning Models Developing Policy Leverage parallel systems Map-Reduce clusters (like Hadoop) for data-intensive jobs (more than 6000 machines) Parallelized compute-intensive simulations (like Condor) Prakash 2016

103 Uncertain Data in Cascade analysis (more implementable policies)
Correcting for missing data Designing More Robust Immunization Policies Original, Nodes sampled off Culprits, and missing nodes filled in Zhang and Prakash. CIKM 2014 Sundereisan, Vreeken, Prakash Prakash 2016

104 Coarsening How is it related to community structure?
More applications, like Visualization… Parallelization A D D A Zoom-out C C B B F E F E Prakash 2016 Big graph

105 Summarization and Segmentation
Automatic segmentation? Segment flu cascades? ……. Prakash 2016

106 References Scalable Vaccine Distribution in Large Graphs given Uncertain Data (Yao Zhang and B. Aditya Prakash) -- In CIKM 2014. Fast Influence-based Coarsening for Large Networks (Manish Purohit, B. Aditya Prakash, Chahhyun Kang, Yao Zhang and V. S. Subrahmanian) – In SIGKDD 2014 DAVA: Distributing Vaccines over Large Networks under Prior Information (Yao Zhang and B. Aditya Prakash) -- In SDM 2014 Fractional Immunization on Networks (B. Aditya Prakash, Lada Adamic, Jack Iwashnya, Hanghang Tong, Christos Faloutsos) – In SDM 2013 Spotting Culprits in Epidemics: Who and How many? (B. Aditya Prakash, Jilles Vreeken, Christos Faloutsos) – In ICDM 2012, Brussels Vancouver (Invited to KAIS Journal Best Papers of ICDM.) Gelling, and Melting, Large Graphs through Edge Manipulation (Hanghang Tong, B. Aditya Prakash, Tina Eliassi-Rad, Michalis Faloutsos, Christos Faloutsos) – In ACM CIKM 2012, Hawaii (Best Paper Award) Rise and Fall Patterns of Information Diffusion: Model and Implications (Yasuko Matsubara, Yasushi Sakurai, B. Aditya Prakash, Lei Li, Christos Faloutsos) – In SIGKDD 2012, Beijing Interacting Viruses on a Network: Can both survive? (Alex Beutel, B. Aditya Prakash, Roni Rosenfeld, Christos Faloutsos) – In SIGKDD 2012, Beijing Winner-takes-all: Competing Viruses or Ideas on fair-play networks (B. Aditya Prakash, Alex Beutel, Roni Rosenfeld, Christos Faloutsos) – In WWW 2012, Lyon Threshold Conditions for Arbitrary Cascade Models on Arbitrary Networks (B. Aditya Prakash, Deepayan Chakrabarti, Michalis Faloutsos, Nicholas Valler, Christos Faloutsos) - In IEEE ICDM 2011, Vancouver (Invited to KAIS Journal Best Papers of ICDM.) Times Series Clustering: Complex is Simpler! (Lei Li, B. Aditya Prakash) - In ICML 2011, Bellevue Epidemic Spreading on Mobile Ad Hoc Networks: Determining the Tipping Point (Nicholas Valler, B. Aditya Prakash, Hanghang Tong, Michalis Faloutsos and Christos Faloutsos) – In IEEE NETWORKING 2011, Valencia, Spain Formalizing the BGP stability problem: patterns and a chaotic model (B. Aditya Prakash, Michalis Faloutsos and Christos Faloutsos) – In IEEE INFOCOM NetSciCom Workshop, 2011. On the Vulnerability of Large Graphs (Hanghang Tong, B. Aditya Prakash, Tina Eliassi-Rad and Christos Faloutsos) – In IEEE ICDM 2010, Sydney, Australia Virus Propagation on Time-Varying Networks: Theory and Immunization Algorithms (B. Aditya Prakash, Hanghang Tong, Nicholas Valler, Michalis Faloutsos and Christos Faloutsos) – In ECML-PKDD 2010, Barcelona, Spain MetricForensics: A Multi-Level Approach for Mining Volatile Graphs (Keith Henderson, Tina Eliassi-Rad, Christos Faloutsos, Leman Akoglu, Lei Li, Koji Maruhashi, B. Aditya Prakash and Hanghang Tong) - In SIGKDD 2010, Washington D.C. Prakash 2016

107 Acknowledgements Collaborators Christos Faloutsos
Roni Rosenfeld, Michalis Faloutsos, Lada Adamic, Theodore Iwashyna (M.D.), Dave Andersen, Tina Eliassi-Rad, Iulian Neamtiu, Varun Gupta, Jilles Vreeken, V. S. Subrahmanian John Brownstein (M.D.) Deepayan Chakrabarti, Hanghang Tong, Kunal Punera, Ashwin Sridharan, Sridhar Machiraju, Mukund Seshadri, Alice Zheng, Lei Li, Polo Chau, Nicholas Valler, Alex Beutel, Xuetao Wei Prakash 2016

108 Acknowledgements Students Liangzhe Chen Shashidhar Sundereisan
Benjamin Wang Yao Zhang Sorour Amiri Bijaya Adhikari Prakash 2016

109 Acknowledgements Funding Prakash 2016

110 Making Diffusion Work for You
B. Aditya Prakash Analysis Policy/Action Data Prakash 2016


Download ppt "B. Aditya Prakash Computer Science Virginia Tech."

Similar presentations


Ads by Google