Atzmueller, Martin

Güven, Çiçek

English

The detection of anomalies and exceptional patterns in the context of link analysis on complex interaction networks is a prominent research direction in complexity and network science. Applications include, e.g., fraud detection in online social networks, discovering events or unusual topics in heterogeneous network data, or identifying specific interesting or outstanding behavior, for example, considering influential or "central" actors. Taking an abstract view, an anomaly can be considered as a pattern that does not conform to some notion of the expected, normal behavior. A straightforward general anomaly detection approach first defines a range covering the expected behavior, and then identifies any observation in the data that does not belong to this range as an anomaly. However, there is usually no clear formalization of the "normal behavior". In addition, the notion of an anomaly includes other factors compared to a mere outlier which is typically defined by statistical criteria. The concept of an anomaly typically captures more complex criteria, including semantics, (user) expectations and complex data-driven structures. Thus, it is difficult to formalize anomalies with a complex structure, e.g., relating to a group structure instead of considering isolated points. Therefore, such complex (collective) anomaly patterns are often not detected if the individual contained points seem normal and only their interaction causes an anomaly. In addition, the complexity of anomaly detection is further enhanced by multi-relational and multi-dimensional data. This poster presents model-based approaches and methods for addressing and formalizing these issues in the context of complex interaction networks, and exemplifies promising directions for its implementation. We basically distinguish between approaches that require an explicit formalization, i. e., theory-based, knowledge-based and preference-based modeling, and those that rely on data-driven and structure driven criteria, i. e., behavior-based and structure-based modeling. Then, we specifically consider exceptional pattern mining and link prediction. Exceptional pattern mining can be applied, e.g., for subgroup discovery and community detection. The typical focus of link prediction targets the dynamics and mechanisms in the creation of links between nodes in complex networks. Then, the goal is to learn a model for predicting the links accurately. However, such a model can also be applied for identifying anomalous links. For the sketched model-based approaches, we exemplify theory-based models (e.g., exploiting homophily), knowledge-based models (e.g., utilizing logical formalisms such as answer set programming), preference-based models (using user preferences/expectations), as well as behaviorbased and structure-based models (utilizing data-driven interestingness functions and structural/topological network criteria)

Tilburg University Repository

    Tilburg UniversityA Multi-Perspective View on Model-Based Exceptional Link Analysis on ComplexInteraction NetworksAtzmueller, Martin; Güven, ÇiçekPublication date:2019Link to publication in Tilburg University Research PortalCitation for published version (APA):Atzmueller, M., & Güven, Ç. (2019). A Multi-Perspective View on Model-Based Exceptional Link Analysis onComplex Interaction Networks. Poster session presented at Annual Conference of The Netherlands Platform ofComplex Systems, Utrecht, Netherlands.General rightsCopyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright ownersand it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.            • Users may download and print one copy of any publication from the public portal for the purpose of private study or research.            • You may not further distribute the material or use it for any profit-making activity or commercial gain            • You may freely distribute the URL identifying the publication in the public portalTake down policyIf you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediatelyand investigate your claim.Download date: 12. May. 2021AbstractThe detection of anomalies and exceptional patterns in the context of linkanalysis on complex interaction networks is a prominent research direction incomplexity and network science. Applications include, e.g., fraud detection inonline social networks, discovering events or unusual topics in heterogeneousnetwork data, or identifying specific interesting or outstanding behavior, forexample, considering influential or "central" actors. Taking an abstract view,an anomaly can be considered as a pattern that does not conform to somenotion of the expected, normal behavior. However, there is usually no clearformalization of the "normal behavior". In addition, the notion of an anomalyincludes other factors compared to a mere outlier which is typically definedby statistical criteria. The concept of an anomaly typically captures morecomplex criteria, including semantics, (user) expectations and complex data-driven structures. Thus, it is difficult to formalize anomalies with a complexstructure, e.g., relating to a group structure instead of considering isolatedpoints. Therefore, such complex (collective) anomaly patterns are often notdetected if the individual contained points seem normal and only theirinteraction causes an anomaly. In addition, the complexity of anomalydetection is further enhanced by multi-relational and multi-dimensional data.Preference-Based Modeling• Social Event Network Analysis• Context: Music Event• Preference(planned performances)• Attendance (GPS tracks)• Analysis of structure/behavior• On Graphs & Projections• Mining exceptional patterns (i.e. deviations/anomalies)A Multi-Perspective View on Model-Based Exceptional Link Analysis on Complex Interaction NetworksMartin Atzmueller, Cicek GüvenTilburg	University	(CSAI)Model-Based OptionsExample Application: Openbeacon wearable sensor for smart social sensing, i.e.,for the detection of face-to-face contacts (http://www.sociopatterns.org).Constructing offline social networks based on human face-to-face proximity.http://www.vikamine.orgMartin AtzmuellerTilburg	Universitym.atzmuller@uvt.nlCicek GüvenTilburg	Universityc.guven@uvt.nlExplicit	FormalizationData-/Structure-drivenTheory-Based ModelingKnowledge-Based ModelingPreference-Based ModelingBehavior-Based ModelingStructure-Based ModelingCompilationKnowledge-Based ModelingAnswer Set Programming#const n=2.#const n_survey=2.%	ASP	facts	- defining	the	networks/graphsnode(1..6).	%	Nodes	of	the	interaction	graphedge(1,	2). edge(1,	4).	edge(2,	5).	edge(2,	3).	edge(3,	4).	%	Edges,	first	time	intervaltest(2,	4).	test(1,	5).	test(3,	5).	test(4,	5).	test(5,	6). %	Edges,	second	time	interval	(test	set)%	Nodes	and	edges	of	the	survey	graph:node_survey(4..8).	node_survey(csai).	node_survey(dsbg).	node_survey(f).	node_survey(m).edge_survey(5,	csai).	edge_survey(8,	dsbg).	edge_survey(7,	dsbg).edge_survey(4,	csai).	edge_survey(6,	csai).	edge_survey(5,	m).	edge_survey(4,	m).edge_survey(8,	m).	edge_survey(7,	f).	edge_survey(6,	m).%	ASP	rulesedge(Y,	X)	:- edge(X,	Y).	%	This	is	an	undirected	graph, hence	there	is	symmetry	in	edges.edge_survey(Y,	X)	:- edge_survey(X,	Y).%	X	is	a	common	neighbor	of	Y	and	Z	where	they	are	not	connected.c(X,	Y,	Z)	:- edge(X,	Y),	edge(X,	Z), not	edge(Y,	Z),	Y!=Z.c_survey(X,	Y,	Z)	:- edge_survey(X,	Y),	edge_survey(X,	Z), not	edge_survey(Y,	Z),	Y!=Z.%	a	link	is	predicted	when	there	are	2	common	neighbors	in	the	interaction	graphcn_lp_interaction(Y,	Z)	:- node(Y),	node(Z),	not	edge(Y,	Z),	Y!=Z, n=#count{X:c(X,	Y,	Z)}.%	a	link	is	predicted when	there	are	2	common	neighbors	in	the	survey	graphcn_lp_survey(Y,	Z)	:- node(Y),	node(Z),	not	edge(Y,	Z),	Y!=Z, n_survey=#count{X:c_survey(X,	Y,	Z)}.test(Y,	X)	:- test(X,	Y).%	The	match	rule	compares	the	predicted	set	of	links	with	the	test	setmatch(X,	Y)	:- test(X,	Y), cn_lp_interaction(X,	Y).match(X,	Y)	:- test(X,	Y), cn_lp_survey(X,	Y).%	interactions	predicted	by	interaction	network,	predicted	by survey,	but	not	in	the	test	setanomaly1(X,Y):-cn_lp_interaction(X,	Y),cn_lp_survey(X,	Y),	not	test(X,	Y).%	interactions	NOT	predicted	by	interaction	network,	predicted	by survey	network,	but	not	in	the	test	setanomaly2(X,Y):- not	cn_lp_interaction(X,	Y),cn_lp_survey(X,	Y),	not	test(X,	Y).%	interactions	NOT	predicted	by	interaction	network,	predicted	by survey,	that	are	actually	in	the	test	setanomaly3(X,Y):- not	cn_lp_interaction(X,	Y),cn_lp_survey(X,	Y), test(X,	Y).#show	anomaly1/2.#show	anomaly2/2.#show	anomaly3/2.Behavior-/Structure-BasedModeling Examples:• Interestingness measure: large patternswith large deviation, e.g. comparisonto null model• Specific graph structures, e.g. cliques,k-cores, ...• Also: Combination of the above, e.g.for mining local exceptional patterns.

A Multi-Perspective View on Model-Based Exceptional Link Analysis on Complex Interaction Networks

https://pure.uvt.nl/ws/files/30765670/NPCS_2019_AMulti_PerspectiveViewonModel_BasedExceptionalLinkAnalysisonComplexInteractionNetworksCGMA.pdf

A Multi-Perspective View on Model-Based Exceptional Link Analysis on Complex Interaction Networks

Abstract

Similar works

Full text

Available Versions

Tilburg University Repository