1. Network Analysis Max Hinne mhinne@sci.ru.nl

2. Social Networks 6/1/20152Network Analysis

3. Networks & Digital Security Interdisciplinary Combination formal & ‘soft’ interpretation Security in the sense of a detective 6/1/2015Network Analysis3

4. Overview 1.Primer on graph theory 2.Centrality – Who is important? 3.Clustering – Who belong together? 4.Detecting & predicting changes – LIGA project Central theme: global vs. local approaches 6/1/2015Network Analysis4

5. GRAPH PRIMER 6/1/2015Network Analysis5

6. Graph primer - basics V = vertices, N = |V| A = arcs, M = |A| 6 (x points to y) 6/1/2015Network Analysis

7. Graph primer - concepts Neighborhood: Degree: Path: Similar concepts for undirected graphs G=(V,E) 6/1/2015Network Analysis7

8. Graph primer – graph types 6/1/2015Network Analysis8 1. 2. 3. Models for these graphs by: 1.Erdős-Renyi (1959) 2.Tsvetovat-Carley (2005) 3.Barabási-Albert (1999)

9. Graph primer – degree distributions Erdős-Renyi: number of vertices N, each edge occurs with probability p Barabási-Albert: start with a small set of vertices and add new ones. Each new vertex is connected to others with a probability based on their degree 6/1/2015Network Analysis9 Degree distributions: what is the chance a node has degree k? Poisson Power-law (scale-free)

10. Graph primer – small world effect Famous experiment by Milgram (1967) Everyone on the world is connected to everyone else in at most 6 steps Social graphs exhibit the ‘small world effect’: the diameter of a social graph scales logarithmically with N 6/1/2015Network Analysis10

11. CENTRALITY 6/1/2015Network Analysis11

12. Centrality 6/1/201512Network Analysis Importance, control of flow Ranking of most important (control) to least important (control)

13. Node centrality measures 1/4 6/1/2015Network Analysis13 – Degree Immediate effect

14. Node centrality measures 2/4 6/1/2015Network Analysis14 – Closeness ETA of flow to v c C inverted for visualization

15. Node centrality measures 3/4 6/1/2015Network Analysis15 – Eigenvector Influence or risk

16. Node centrality measures 4/4 6/1/2015Network Analysis16 – Betweenness Volume of flow/traffic

17. Obtaining c B Fastest current algorithm by Brandes in O(nm) Solves all shortest paths in one pass – For each vertex, consider all d=1 nearest neighbors, then d=2 and so on – For each shortest path, store which vertices are on it – Derive c B 6/1/2015Network Analysis17

18. Local approach No known algorithms calculate c B (v) faster than c B (v) for all v! We only want to rank nodes of interest, not all Local approach – Find c B for some specific nodes – If we can estimate c B, we can rank relevant nodes 6/1/201518Network Analysis

19. Ego betweenness 6/1/201519Network Analysis Ego-net: and corresponding edges Calculate c B considering only ego(v) Let A be the adjacency matrix:

20. No direct link between c B and c EB 6/1/2015Network Analysis20 Red circles + ego form a n+1 node star Green triangles form an p node complete graph K p Red circles + ego form a p+1 node star Green triangles + ego form an n node complete graph K n

21. Correlation c B and c EB Very strong positive correlation! 6/1/2015Network Analysis21

22. GRAPH CLUSTERING 6/1/2015Network Analysis22

23. Types of clustering What is a cluster? Supervised vs. unsupervised Partitional vs. hierarchical 6/1/2015Network Analysis23

24. Clustering quality – modularity C1C1 C2C2 C3C3 C4C4 C1C1 18524 C2C2 51520 C3C3 22191 C4C4 40120 C1C1 C2C2 C3C3 C4C4 C1C1 0.180.050.020.04 C2C2 0.050.150.020.00 C3C3 0.02 0.190.01 C4C4 0.040.000.010.20 24Network Analysis6/1/2015 Cluster adjacency matrixCluster adjacency matrix E

25. Newman & Girvan clustering algorithm Edges that are the most ‘between’ connect large parts of the graph 1.Calculate edge betweenness A ij in n x n matrix A 2.Remove edge with highest score 3.Recalculate edge betweenness for affected edges 4.Goto 2 until no edges remain O(m 2 n), may be smaller on graphs with strong clustering 6/1/2015Network Analysis25

26. Greedy clustering algorithm Maximize Q to find clustering Greedy approach: Creates a bottom-up dendogram Cut corresponding to maximum Q is optimal clustering Still a costly process, O(n 2 ) 6/1/2015Network Analysis26 C := V; repeat (i,j) := argmax{∆Q|C i, C j C}; C := C - C j ; C i := C i + C j ; until |C| = 1

27. Practical applications of social clusters Find people related to someone Find out if people belong to the same cluster This does not require a partitioning of the entire network! 6/1/2015Network Analysis27

28. Local modularity C= collection nodes v ∈ V with known link structure U(C) = all nodes outside C to which nodes from C point: U(C) = {u ∈ V-C|A(C,u) ≠ ∅ } B(C) = all nodes in C with at least one neighbor outside C: B(C) = {b ∈ C|A(b,U) ≠ ∅ } C: cluster U: universe B: boundary 28Network Analysis6/1/2015

29. Local cluster algorithm C := Ø; v := v 0 ; repeat C := C+v; v := argmax{R(C+u)|u ∈ U(C)} until |C| = k or R ≥ d ∆R(C,u) = R(C+u) – R(C) Arcs removed from arcs(B(C),V) Arcs newly added to arcs(B(C),V) Arcs removed from arcs(B(C),C) Arcs newly added to arcs(B(C),C) ∆R(C+v 4 ) = 1/3 – 1/4 = 1/12 29Network Analysis6/1/2015

30. Example 1 on Zachary’s Karate Club (d=0.65) 6/1/2015Network Analysis30

31. Example 2 on Zachary’s Karate Club (d=0.65) 6/1/2015Network Analysis31

32. Local cluster quality vs. global clusters For each node v in each global cluster i – Find the local cluster with the same size – Average 6/1/2015Network Analysis32

33. Preliminary results on real graphs Network (size)Compiled bySim(L v,G i )STD Karate club (34)Zachary0.750.24 Dolphin social relations (62)Lusseau0.620.28 Les Miserables coappearance (75)Knuth0.580.29 American College Football (113)Girvan & Newman0.580.36 C. Elegans neural network (295)Watts & Strogatz 6/1/2015Network Analysis33 Experiment too small for real conclusions, but – edge vertices ruin the fun, – edge betweenness? Usefulness of local approach depends on the seed node

34. LOCAL INTELLIGENCE IN GLOBAL APPLICATIONS LIGA 6/1/2015Network Analysis34

35. Web graph ‘Social’ network of blogs and news sites Most graph models are static, but the Web is highly dynamic Stored copy is infeasible, continuous crawling intractable Change in relevance -> change in link structure 6/1/2015Network Analysis35

36. Fully connected triad (1 role) Node roles Frequently recurring sub graphs: motifs Nodes share a role iff there is a permutation of nodes and edges that preserves motif structure On the Web: 6/1/2015Network Analysis36 Uplinked mutual dyad (2 roles) Feedback with two mutual dyads (2 roles)

37. Dynamic graphs Changes in relevance cause changes in link structure Changes in specific roles imply changes in other node roles – Fanbase links to itself and their authorities – Learning relevant links through affiliated sites – etc. Relevance decays (half-life λ) 6/1/2015Network Analysis37

38. LIGA research questions How to model (Web) node relevance ? How does acquired or lost relevance change linkage? How can we predict consequential changes? How can such prediction models be approximated by local incremental algorithms? A. m. o.... 6/1/2015Network Analysis38

39. Putting it together Networks can be analyzed using an array of tools Network analysis is useful in various disciplines: – Information Retrieval – Security But also in: – Sociology – (Statistical) physics – Bioinformatics – AI 6/1/2015Network Analysis39

40. Most cited literature Centrality: – Borgatti S. P.: Centrality and Network Flow. Social Networks 27 (2005) 55-71 – Brandes U.: A Faster Algorithm for Betweenness Centrality. Journal of Mathematical Sociology 25(2) (2001) 163-177 – Freeman L. C.: A Set of Measures of Centrality Based on Betweennes. Sociometry 40 (1977) 35-41 Clustering: – Clauset A.: Finding local community structure in networks. Physics Review E 72 (2005) 026132 – Girvan M., Newman M. E. J.: Community structure in social and biological networks. PNAS 99(12) (2002) 7821-7826 – Newman M. E. J.: Fast algorithm for detecting community structure in networks. Physics Review E 69 (2004) 066133 6/1/2015Network Analysis40