A survey on social network’s anomalous behavior detection

Anomalous behaviors in social networks can lead to privacy leaks and the spread of false information. In this paper, we propose an anomalous behavior detection method based on optimized graph embedding representation. Specifically, the user behavior logs are first extracted into a social network user behavior temporal knowledge graph, based on which the graph embedding representation method is used to transform the network topology and temporal information in the user behavior knowledge graph into structural embedding vectors and temporal information embedding vectors, and the hybrid attention mechanism is used to merge the two types of vectors to obtain the final entity embedding to complete the prediction and complementation of the temporal knowledge graph of user behavior. We use graph neural networks, which use the temporal information of user behaviors as a time constraint and capture both user behavioral and semantic information. It converts the two parts of information into vectors for concatenation and linear transformation to obtain a comprehensive representation vector of the whole subgraph, as well as joint deep learning models to evaluate abnormal behavior. Finally, we perform experiments on the Yelp dataset to validate that our method achieves a 9.56% improvement in the F1-score.

The navigational safety of ships on waterways plays a crucial role in ensuring the operational efficiency of ports. Ship anomalous behavior detection is an important method of water traffic surveillance that can effectively identify abnormal ship behavior, such as sudden acceleration or deceleration. In order to detect potential anomalous ship behavior in real time, a method for ship anomalous behavior detection in waterways is proposed based on text similarity and kernel density estimation. Under the assumption of known traffic patterns entering and leaving the port, this method can identify ship behaviors that violate traffic patterns in real time. Firstly, kernel density estimation is applied to construct a traffic pattern density model for ship trajectories entering and leaving the port, used to estimate the density values of ship motion states. Simultaneously, a semantic transformation method is used to convert traffic pattern trajectory into pattern trajectory text, which is used to identify the ship’s traffic pattern. Subsequently, the historical trajectory data of the target ship are transformed into textual trajectories, and text similarity is used to identify ship inbound and outbound traffic patterns. Furthermore, the constructed traffic pattern density model is used to estimate real-time density values of the state of ship motion, and the trajectory points that exceed the threshold of the anomaly factor are marked as anomalies. Finally, the effectiveness of the proposed method is validated using simulation data, and the results indicate an accuracy of more than 90% for the comprehensive detection of anomalous behavior. This study, approaching the detection of potential ship anomalous behavior from the perspective of port traffic patterns, enriches the methods of ship anomalous behavior detection in port waterways.

Internal employees have always been at the core of organizational security management challenges. Once an employee exhibits behaviors that threaten the organization, the resulting damage can be profound. Therefore, analyzing reasonably stored behavioral data can equip managers with effective threat monitoring and warning solutions. Through data-mining, a knowledge graph for internal threat data is deduced, and models for detecting anomalous behaviors and predicting resignations are developed. Initially, data-mining is employed to model the knowledge ontology of internal threats and construct the knowledge graph; subsequently, using the behavioral characteristics, the BP neural network is optimized with the Sparrow Search Algorithm (SSA), establishing a detection model for anomalous behaviors (SBP); additionally, behavioral sequences are processed through data feature vectorization. Utilizing SBP, the LSTM network is further optimized, creating a predictive model for employee behaviors (SLSTM); ultimately, SBP detects anomalous behaviors, while SLSTM predicts resignation intentions, thus enhancing detection strategies for at-risk employees. The integration of these models forms a comprehensive threat detection technology within the organization. The efficacy and practicality of detecting anomalous behaviors and predicting resignations using SBP and SLSTM are demonstrated, comparing them with other algorithms and analyzing potential causes of misjudgment. This work has enhanced the detection efficiency and update speed of abnormal employee behaviors, lowered the misjudgment rate, and significantly mitigated the impact of internal threats on the organization.

Large-scale transitions in societies are associated with both individual behavioural change and restructuring of the social network. These two factors have often been considered independently, yet recent advances in social network research challenge this view. Here we show that common features of societal marginalization and clustering emerge naturally during transitions in a co-evolutionary adaptive network model. This is achieved by explicitly considering the interplay between individual interaction and a dynamic network structure in behavioural selection. We exemplify this mechanism by simulating how smoking behaviour and the network structure get reconfigured by changing social norms. Our results are consistent with empirical findings: The prevalence of smoking was reduced, remaining smokers were preferentially connected among each other and formed increasingly marginalized clusters. We propose that self-amplifying feedbacks between individual behaviour and dynamic restructuring of the network are main drivers of the transition. This generative mechanism for co-evolution of individual behaviour and social network structure may apply to a wide range of examples beyond smoking.

Analysis of opinion dynamics in social networks plays an important role in today's life. For applications such as predicting users' political preference, it is particularly important to be able to analyze the dynamics of competing opinions. While observing the evolution of polar opinions of a social network's users over time, can we tell when the network "behaved" abnormally? Furthermore, can we predict how the opinions of the users will change in the future? Do opinions evolve according to existing network opinion dynamics models? To answer such questions, it is not sufficient to study individual user behavior, since opinions can spread far beyond users' egonets. We need a method to analyze opinion dynamics of all network users simultaneously and capture the effect of individuals' behavior on the global evolution pattern of the social network. In this work, we introduce Social Network Distance (SND) - a distance measure that quantifies the "cost" of evolution of one snapshot of a social network into another snapshot under various models of polar opinion propagation. SND has a rich semantics of a transportation problem, yet, is computable in time linear in the number of users, which makes SND applicable to the analysis of large-scale online social networks. In our experiments with synthetic and real-world Twitter data, we demonstrate the utility of our distance measure for anomalous event detection. It achieves a true positive rate of 0.83, twice as high as that of alternatives. When employed for opinion prediction in Twitter, our method's accuracy is 75.63%, which is 7.5% higher than that of the next best method. Source Code: https://cs.ucsb.edu/~victor/pub/ucsb/dbl/snd/

Mobile networks and smart phones have become ubiquitous in our daily life. Large amount of customer related telecom data from various sources are generated every day, from which diversified behavior patterns can be revealed, including some anomalous behaviors that are vicious. It becomes increasingly important to achieve both efficient and effective customer behavior analysis based on the telecom big data. In this paper, the Multi-faceted Telecom Customer Behavior Analysis (MTCBA) framework for anomalous telecom customer behavior detection and clustering analysis is proposed. In this framework, we further design the hierarchical Locality Sensitive Hashing-Local Outlier Factor (hierarchical LSH-LOF) scheme for suspicious customer detection, and the Autoencoders with Factorization Machines (FM-AE) structure for dimension reduction to achieve more efficient clustering. Hierarchical LSH-LOF is an improved algorithm of LOF, in which we design a hierarchical LSH process that selects the approximate k nearest neighbors from coarse to fine by gradually narrowing down the scope. Experiments show its superiority over KD-tree w.r.t searching speed. FM-AE exploits Factorization Machines for learning second order feature interactions, which we prove to be useful by designing comparative experiments with five dimension reduction algorithms. With the proposed MTCBA framework, efficient and effective telecom customer behavior analysis including anomalous customer behavior detection and clustering analysis is performed on the real world telecom operating data provided by one of the major Internet service providers (ISPs) in China. Meanwhile, interpretable clustering results of six clusters are obtained to provide valuable information for the precision marketing of telecom operators, criminal combating, and social credit system construction.

Introduction The residential neighbourhood is thought to affect residents because of presumed neighbourhood effects; the independent effects of a neighbourhood’s characteristics on the life chances of its residents. An enormous body of research has tried to measure neighbourhood effects, however, there are no clear conclusions on how much, if any, effect the neighbourhood has on its residents. There is non-random selection of people into neighbourhoods which causes a bias in the modelling of neighbourhood effects. Any correlation found between neighbourhood characteristics and individual outcomes might be explained by selection bias and can therefore not prove the existence of a causal neighbourhood effect. The question is; do poor neighbourhoods make people poor, or do poor people live in unattractive neighbourhoods because they cannot afford to live elsewhere (Cheshire, 2007). Therefore, insight in selection is important to gain more insight in neighbourhood effects (Van Ham and Manley, 2012). For neighbourhood effects research it is important to study selective mobility and neighbourhood choice and to combine neighbourhood effects research with neighbourhood selection research (Doff, 2010a; Van Ham and Manley, 2012; Van Ham et al., 2012; Galster, 2003; Hedman, 2011). The aim of this thesis therefore is to gain more insight in both the causes and the consequences of segregation and thus to study both individual residential mobility and neighbourhood selection and neighbourhood effects. Besides the neighbourhood effects literature, also the segregation literature will benefit from better insights in selective residential mobility because selective residential mobility is one of the main driving forces of segregation. There are two main research questions for this thesis. Firstly, I try to give insight in selective mobility and neighbourhood choice and thus to study where, when and why which people move. What is the effect of personal characteristics, neighbourhood characteristics and macro level housing market developments on individual neighbourhood satisfaction, moving wishes, moving behaviour and neighbourhood selection and on macro level selective mobility patterns and segregation? Secondly, I will test presumed neighbourhood effect mechanisms. Concentration areas of ethnic minorities are seen as undesirable, because their residents are thought to have less contact with the native majority which might hamper their integration and their life chances. It is, however, unclear to what extent social contact is affected by the residential neighbourhood. The second research question therefore asks whether ethnic minorities have less contact with the native majority if they live in minority concentration neighbourhoods. Segregation Segregation is defined as the population composition of neighbourhoods in relation to each other; that is, the concentration or underrepresentation of population groups in neighbourhoods compared to a city or national level average. Selective residential mobility is one of the main driving forces of segregation. Households move to a certain neighbourhood, either because they choose to live there, or because they are constrained in their choice options. Therefore segregation can be both voluntary and involuntary. This thesis focuses on selective residential mobility as cause of segregation, therefore it tries to understand why and where people move. According to residential mobility theory, personal characteristics determine residential preferences and if the residential situation is not in line with these preferences this will lead to dissatisfaction and a desire to move (Brown and Moore, 1970). Whether a dissatisfied household succeeds in moving to a dwelling and neighbourhood more in line with their preferences, depends on their personal resources and restrictions and macro level opportunities and constraints (Mulder and Hooimeijer, 1999). Successful households will move to a neighbourhood more in line with their preferences. There are, however, differences between households in which neighbourhoods are open to choice. Low income households will only be able to select neighbourhoods in which inexpensive dwellings are available. Similarly, households who depend on the social housing sector, or on the owner-occupied sector will only be able to select neighbourhoods where dwellings of this tenure are available. In addition, there are differences between households in which neighbourhood is (deemed) most attractive. People prefer to live among others who are similar to themselves and also facilities directed towards specific groups will make especially concentration neighbourhoods of the own ethnic or income group attractive. Besides residential preferences, also other factors will affect neighbourhood selection; population groups will differ in access to information on neighbourhood attractiveness or housing opportunities and discrimination, or fear of discrimination, can limit the opportunities of minority groups on the housing market. Neighbourhood effects It is typically assumed in European and American urban policy and academic research that spatial concentrations of low income households or ethnic minorities have negative effects on their inhabitants (Friedrichs et al., 2003). An enormous body of research has tried to measure neighbourhood effects; the independent effect of a neighbourhood on its residents when controlling for individual characteristics (see for a review Dietz, 2002; Ellen and Turner, 1997; Sharkey and Faber, 2014; Van Ham et al., 2012). The research attention for neighbourhood effects started with the seminal work of Wilson (1987). He argued that living in concentration areas of the jobless lowest class, isolated from role models, mainstream values and norms, and informal job networks and social contacts with employed, has a negative effect on your life chances. Neighbourhoods can affect their residents via a number of mechanisms (Ellen and Turner, 1997; Erbring and Young, 1979; Galster, 2012). Firstly, the geographical location determines job access and thereby labour market opportunities. Secondly, pollution, noise and disturbance affect health and (thereby) life chances via environmental mechanisms . In addition, neighbourhood stigmatisation can reduce life chances because others have prejudiced ideas and low expectations of the residents of stigmatised neighbourhoods. Also, the quality of institutions such as schools, museums, libraries and sport facilities will generally be lower in disadvantaged neighbourhoods, thereby reducing the life chances of residents. Finally, neighbourhood effects can transpire via social interactions with neighbours. Through collective socialisation and peer pressure people are thought to conform to local social norms (Jencks and Mayer, 1990). Positive role models and social network contacts with individuals with more social capital can help people advance in their work or educational career (Ellen and Turner, 1997). For ethnic minorities it can be important to have social interactions with the native majority to have the opportunity to learn the majority language, standards and values (Lazear, 1999) and to have bridging network ties that can provide access to valuable information not present within the own ethnic network (Buck, 2001). Many neighbourhood effect researchers believe that living in concentrated poverty has negative effects on individuals, and policymakers try to create mixed neighbourhoods to prevent these negative neighbourhood effects. However, although “it is perfectly plausible that poor people are made poorer by the characteristics of the neighbourhoods in which they live” (…) “a close examination of the best research available does not reveal any clear evidence to support it” (Cheshire, 2007: p. ix). Almost all neighbourhood effect studies struggle with selection bias (Cheshire, 2007). Any relation found between neighbourhood characteristics and individual outcomes might be a selection effect and therefore cannot prove the existence of a causal neighbourhood effect. Neighbourhood effects researchers have tried to reduce or eliminate selection bias. Firstly this is done by using quasi-experimental study designs, using households whose residential neighbourhood is determined by external factors (Sampson et al., 2002). Secondly, advanced statistical methods such as sibling studies, fixed effects studies, instrumental variables and propensity score matching are used to reduce selection bias or to control for selection (Harding, 2003). These advancements in methodology have improved our insight in selection bias and in neighbourhood effects, however, since there are no methods that can completely eliminate selection bias, there is still no clear evidence of causal neighbourhood effects. Generally, methods that apply more controls for selection bias find smaller neighbourhood effects. Instead of trying to eliminate selection bias, this thesis tries to provide insight in selection, in why and where which people move. In addition, this thesis tests presumed neighbourhood effect mechanisms. Social interactive mechanisms assume that neighbourhood effects transpire because the population composition of the residential neighbourhood affects with whom you interact (Ellen and Turner, 1997; Galster, 2012). Therefore I test whether the ethnic composition of the neighbourhood affects interethnic contact. Individual differences in determinants of residential satisfaction<

Airports are critical infrastructures that require special protection. Public spaces are considered vulnerable areas and a possible target for general crime as well as terrorism. Because of the latest terrorist attacks which targeted vulnerable areas in airports, it is essential to test proactive methods capable of helping to detect potential threats. In this context, there are also other illicit activities closely related to civil air transport, which must also be addressed. First, we propose a theoretical framework to explain the presence and detection of anomalous behaviors. Therefore, in this research, we start by analyzing the behavior of airport users (N = 352) in terms of “patterns of movement,” “patterns of communication,” indicators activated by the autonomic nervous system, and object adaptors. The results show significant differences in both movement and communication patterns between those who commit illegal acts and those who do not. No significant differences were found related to indicators coming from the autonomous nervous system or the object adaptors. Six significant behaviors account for the 49% of the variance in those who commit illegal activities. Three significant behaviors account for the 19% of the variance in those who possess background records.

Detecting anomalous behaviors of cloud platforms is one of critical tasks for cloud providers. Every anomalous behavior potentially causes incidents, especially some unaware and/or unknown issues, which severely harm their SLA (Service Level Agreement). Existing solutions generally monitor cloud platform at different layers and then detect anomalies based on rules or learning algorithms on monitoring metrics. However, complexity of nowadays cloud platforms, high dynamics of cloud workloads and thousands of various types of metrics make anomalous behavior detection more challenging to be applied in production, especially in large scale cloud production environments. In this paper, we present a practical cloud anomalous behavior detection system called DriftInsight. It firstly analyzes multi-denominational metrics of each component and identifies a set of representative steady components based on the convergences of their states. Then it generates a state model and a state transit model for each steady cloud component. Finally, it detects behavior anomalies of these steady components in near real-time and meanwhile evolve behavior models on the fly. The evaluation results of this approach in a commercial large-scale PaaS (Platform-as-a-Service) cloud are demonstrated its capability and efficiency.

Social Networks have become embedded in our daily life so much that we no longer realize it. But researches on the structures of networks are correspondingly fewer than their statistical properties, however, the studies of structural features are necessary and significant. Here we present an approach to study the structures of social networks based on Role-to-role Connectivity Profiles (RCP). We conduct experiments in some classical social networks, we find that the social networks with different functions exhibit obvious different profiles. Different from the classification of complex networks, social networks are divided into two distinct classes with strict judgement basis rather than vague judgement. In addition, according to the RCP, we can find important nodes in social networks, which is more significant than those with high degree. Through the use of the algorithm in social networks, we can thoroughly understand a social network by the comprehensive network classifications rather than only relying on community detection and other global properties.

This dissertation consists of two original studies in social networks and one original study in political economy. In the first two chapters, I study (i) how social networks form, and (ii) how economic agents optimize their behaviors for a given network structure. In the last chapter, I examine how election rules affect individual voting decisions and ultimate election outcomes. In Chapter 1, Social Network Formation and Strategic Interaction in Large Networks, I present a dynamic network formation model that aims to explain why some empirical degree distributions exhibit the increasing hazard rate property (IHRP). In my model, a sequentially arriving node forms a link with one existing node through a bilateral agreement. newborn node prefers a highly linked node; however, the more links an existing node has, the more the marginal return from an additional link diminishes. I prove that the IHRP emerges if and only if the latter effect prevails over the former. I present two implications of the IHRP for strategic interactions in networks. First, when there is uncertainty about neighboring agents' connectivity, the IHRP guarantees that a unique Bayesian equilibrium exists in a network game with strategic complementarities. Second, the IHRP characterizes a monotone revenue-maximizing mechanism with allocative externalities. In Chapter 2, Monopoly Pricing and Diffusion of a (Social) Network Good, I present a model of dynamic pricing and diffusion of a network good sold by a monopolist. In the model, the network good is a subscription social network good. This means that in each period, each consumer has to pay a subscription price to use the good, and the utility derived from subscribing to the good increases as more of her neighboring consumers subscribe. Consumers myopically optimize their subscription decisions, and the monopolist chooses a sequence of subscription prices that maximizes his discounted sum of per-period profits. Three main results emerge. First, I characterize a unique steady state of the monopoly market. Second, I find that optimal sequences of subscription prices oscillate around the subscription price at the steady state as time passes. Third, I analyze how changes in the monopolist's discount factor and the density of the social network affect the subscription price, subscription rate, and deadweight loss at the steady state. In Chapter 3, A Model of Pre-Electoral Coalition Formation, I study how two different election rules, simple plurality (e.g., as in South Korea) and two-round runoff (e.g., as in France), affect political candidates’ incentives to form pre-electoral coalitions (PECs). In my model, three candidates compete for a single office, and two candidates can form a PEC. Since the candidates are both policy- and office-motivated, one candidate can incentivize the other candidate to withdraw his candidacy by choosing a joint policy platform. I find that PECs are more likely to form in plurality elections than in two-round runoff elections. I further examine how other electoral environments, such as ideological distance and pre-election polls, influence incentives to form PECs.

Physical activity buddies: a network analysis of social aspects of physical activity in adults

Adaptive community detection incorporating topology and content in social networks✰

BackgroundSocial networks influence health behavior, including tobacco use and cessation. To date, little is known about whether and how the networks of online smokers and non-smokers may differ, or the potential implications of such differences with regards to intervention efforts. Understanding how social networks vary by smoking status could inform public health efforts to accelerate cessation or slow the adoption of tobacco use.ObjectivesThese secondary analyses explore the structure of ego networks of both smokers and non-smokers collected as part of a randomized control trial conducted within Facebook.MethodsDuring the trial, a total of 14,010 individuals installed a Facebook smoking cessation app: 9,042 smokers who were randomized in the trial, an additional 2,881 smokers who did not meet full eligibility criteria, and 2,087 non-smokers. The ego network for all individuals was constructed out to second-degree connections. Four kinds of networks were constructed: friendship, family, photo, and group networks. From these networks we measured edges, isolates, density, mean betweenness, transitivity, and mean closeness. We also measured diameter, clustering, and modularity without ego and isolates. Logistic regressions were performed with smoking status as the response and network metrics as the primary independent variables and demographics and Facebook utilization metrics as covariates.ResultsThe four networks had different characteristics, indicated by different multicollinearity issues and by logistic regression output. Among Friendship networks, the odds of smoking were higher in networks with lower betweenness (p = 0.00), lower transitivity (p = 0.00), and larger diameter (p = 0.00). Among Family networks, the odds of smoking were higher in networks with more vertices (p = .01), less transitivity (p = .04), and fewer isolates (p = .01). Among Photo networks, none of the network metrics were predictive of smoking status. Among Group networks, the odds of smoking were higher when diameter was smaller (p = .04). Together, these findings suggested that compared to non-smokers, smokers in this sample had less connected, more dispersed Facebook Friendship networks; larger but more fractured Family networks with fewer isolates; more compact Group networks; and Photo networks that were similar in network structure to those of non-smokers.ConclusionsThis study illustrates the importance of examining structural differences in online social networks as a critical component for network-based interventions and lays the foundation for future research that examines the ways that social networks differ based on individual health behavior. Interventions that seek to target the behavior of individuals in the context of their social environment would be well served to understand social network structures of participants.

We conduct an extensive statistical analysis on the social networks of contributors in Open Source Software (OSS) communities using datasets collected from two most fast-growing OSS social interaction sites, Github.com and Ohloh.net. Our goal is to analyze the connectivity structure of the social networks of contributors and to investigate the effect of the different social ties structures on developers’ overall productivity to OSS projects. We, first, analyze the general structure of the social networks, e.g., graph distances and the degree distribution of the social networks. Our social network structure analysis confirms a power-law degree distribution and small-world characteristics. However, the degree mixing pattern shows that high degree nodes tend to connect more with low degree nodes suggesting a collaboration between experts and newbie developers. We further conduct the same analysis on affiliation networks and find that contributors tend to participate in projects of similar team sizes. Second, we study the correlation between various social factors (e.g., closeness and betweenness centrality, clustering coefficient and tie strength) and the productivity of the contributors in terms of the amount of contribution and commitment to OSS projects. The analysis is conducted under the contexts of global and local networks, where a global network analysis considers a developer’s connectivity in the whole OSS community network, whereas a local network analysis considers a developer’s connectivity within a team network that is affiliated to a project. The analysis demonstrates evident influence of the social factors on the developers’ overall productivity.KeywordsOpen source software (OSS)Social networkAffiliation networkGlobal network analysisLocal network analysisDegree of connectivityTies strength