1. 1 SnT – Interdisciplinary Centre for Security, Reliability and Trust 2 Bell Laboratories, Alcatel-Lucent Identifying abnormal patterns in cellular communication flows IPTCOMM 2013 Principles, Systems and Applications of IP Telecommunications October 15 - 17, 2013 David Goergen 1 Veena Mendiratta 2 Radu State 1 Thomas Engel 1

2. OUTLINE Introduction Related Work Model / Metric D4D Dataset Evaluation Future work Conclusion IPTCOMM 201311/11/20132

3. Intro Analyzing large volumes of cellular communications records –Can help to improve the overall quality it provides to its users –Allows operators to detect abnormal patterns and react accordingly Definition of model and metric to detect abnormal traffic Application on a country-level data set Correlated detected flows with events IPTCOMM 201311/11/20133

4. D4D Dataset specification One country Time Period: 01.12.2011 to 28.04.2012 5 million users 1124 base stations (for mobile communications) More then 3 billion entries summarizing on a hourly basis the SMS and Voice Calls 50000 mobile users tracked over these months with GPS and call records IPTCOMM 201311/11/20134

5. D4D Dataset specification Set 1: Base station-to-base station ongoing calls Set 2: User movement among base stations Set 3: User movement among region subdivision Set 4: Communication sub-graphs IPTCOMM 201311/11/20135

6. Related Work S. van den Elzen, D. H. Jorik Blaas, J.-K. Buenen, J. J. van Wijk, R. Spousta, A. Miao, S. Sala, and S. Chan. Exploration and Analysis of Massive Mobile Phone Data: A Layered Visual Analytics approach. In NetMob, 2013 M. Cerinsek, J. Bodlaj, and V. Batagelj. Symbolic clustering of users and antennae. In NetMob, 2013. G. Krings, F. Calabrese, C. Ratti, and V. D. Blondel. Urban Gravity: A Model For Intercity Telecommunication Flows. Journal Of Statistical Mechanics: Theory And Experiment, 2009, 2009 V. A. Traag, A. Browet, F. Calabrese, and F. Morlot. Social Event Detection in Massive Mobile Phone Data Using Probabilistic Location Inference. In Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on Social Computing (SocialCom), 2011. IPTCOMM 201311/11/20136

7. Model / Metric IPTCOMM 201311/11/20137

8. Comparison Related WorkOur method 11/11/2013IPTCOMM 20138

9. Data processing on Hadoop cluster Hadoop 2.0.0- cdh 4.3.0 4 nodes –hexacore 2.4GHz Xeon 120 GB RAM HDFS 27.54 TB 2 x 1GB Ethernet bonded IPTCOMM 201311/11/20139

10. Hadoop job process 11/11/2013IIT RTC conference10

11. Metric parameters Analyzing the impact of α and the window size w –α dataset –w dataset Tradeoff between granularity and loss of detail Chosen w = 10 and α = 0.5 IPTCOMM 201311/11/201311

12. Abnormal number of calls Applying our metric –Circle Power failures –Square President appeared at court –Triangle Rebelious fanatics invasion IPTCOMM 201311/11/201312

13. Abnormal duration of calls Applying our metric –Circle Power failures –Square President appeared at court –Triangle Rebelious fanatics invasion IPTCOMM 201311/11/201313

14. Closer look at specific region IPTCOMM 201311/11/201314

15. Detecting abnormal situation IPTCOMM 201311/11/201315

16. IPTCOMM 201311/11/201316

17. Observation of the highlighted period IPTCOMM 201311/11/201317

18. IPTCOMM 201311/11/201318

19. Clustering: mean duration vs mean number of calls Group A –Small amount of calls and short to medium duration Group B –Large amount of calls and short to medium duration usual diurnal behaviour of night and day communication Group C is the outlier –Long duration and global average amount of calls –All calls occur in the same time slot on different days IPTCOMM 201311/11/201319

20. Principal Component Analysis PCA on number of callsPCA on the total duration IPTCOMM 201311/11/201320

21. PCA result Cross-referencing the results of both analyses 10 base stations most affected by PC1 IPTCOMM 201311/11/201321

22. Future Work Further investigate the impact of the chosen parameters –Window size and α Graph theory analysis –Detect effects on the complete connected graph –Using page-rank or HITS algorithm IPTCOMM 201311/11/201322

23. Conclusion Detection of abnormal traffic is possible by our metric Large data set analysis in reasonable amount of time IPTCOMM 201311/11/201323

24. THANK YOU FOR YOUR ATTENTION QUESTIONS? IPTCOMM 201311/11/201324

25. Requirements 11/11/2013IPTCOMM 201325