PaperlayerView exact revision on arXiv

Source-linked AI summary

GLAD: Group Anomaly Detection in Social Media Analysis- Extended Abstract

Qi, Yu, Xinran He, Yan Liu

arXiv:1410.1940v1cs.LGcs.SI

TL;DR

Social-media anomaly detection has focused largely on individuals, while group anomalies matter and existing approaches assume groups are already known. The paper proposes GLAD to jointly use point-wise and pair-wise data for group discovery and anomaly detection, with d-GLAD for dynamic data. It reports effective, robust group discovery and anomaly detection, with dynamic d-GLAD achieving lower false-positive rates and better data fitting.

  • Problem

    Social-media anomalies can arise from coordinated groups, but existing group-anomaly approaches assume groups are known even though individuals may appear normal.

    Source: §1 · pp. 1–2

  • Method

    GLAD is a hierarchical generative model that jointly uses point-wise and pair-wise data to infer groups and detect anomalies, with d-GLAD extending it to dynamic data.

    Source: §1 · p. 2

  • Results

    GLAD outperforms existing approaches in group-anomaly detection accuracy and robustness, while d-GLAD reports lower false-positive rates and better data fitting on dynamic networks.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The reported evaluations indicate that GLAD can discover latent groups and detect group anomalies in synthetic and real-world data.

    Source: §1 · p. 2

    The definition assumes groups share a fixed set of roles and that anomalous groups deviate from normal groups in their role-mixture rates.

    Source: §3 · p. 3

Abstract

from arXiv · show

Traditional anomaly detection on social media mostly focuses on individual point anomalies while anomalous phenomena usually occur in groups. Therefore it is valuable to study the collective behavior of individuals and detect group anomalies. Existing group anomaly detection approaches rely on the assumption that the groups are known, which can hardly be true in real world social media applications. In this paper, we take a generative approach by proposing a hierarchical Bayes model: Group Latent Anomaly Detection (GLAD) model. GLAD takes both pair-wise and point-wise data as input, automatically infers the groups and detects group anomalies simultaneously. To account for the dynamic properties of the social media data, we further generalize GLAD to its dynamic extension d-GLAD. We conduct extensive experiments to evaluate our models on both synthetic and real world datasets. The empirical results demonstrate that our approach is effective and robust in discovering latent groups and detecting group anomalies.

1 Introduction

The paper targets group anomalies in social media, where coordinated behavior may be anomalous even when individuals appear normal. It proposes GLAD and dynamic d-GLAD to infer groups and detect anomalies using social-media data.

1 Introduction

  • Group anomalies such as collusive false reviews or threat campaigns have received limited examination in social-media analysis.The paper focuses on groups whose behavior does not conform to that of most other groups.Source: §1 · pp. 1–2
  • Social-media group detection must account for point-wise features and pair-wise ties, subtle anomalies, and changing networks with groups not known in advance.The paper notes that activities may appear normal at the individual level even when anomalous at the group level.Source: §1 · p. 2
  • GLAD outperforms existing approaches in group-anomaly detection accuracy and robustness; d-GLAD reports lower false-positive rates and better data fitting on dynamic networks.The paper reports evaluations on synthetic and real-world datasets, including a constructed ACM publications dataset.Source: §1 · p. 2
  • GLAD jointly models point-wise and pair-wise data to infer groups and detect group anomalies, while d-GLAD extends the approach to dynamic data.The contributions include tractable inference algorithms for GLAD and its dynamic extension.Source: §1 · p. 2
  • The paper formulates group anomaly detection for static and dynamic social-media settings and evaluates its models on synthetic and real-world data.The experiments use anomaly injections and include a dataset constructed from ACM publications.Source: §1 · p. 2

2 Related Work

Prior methods either model group-level feature mixtures or apply discriminative detection, but generally require groups to be supplied beforehand. The paper motivates a joint approach that discovers groups and detects anomalies while accommodating evolving networks.

2 Related Work

  • MGM scores groups by their role-mixture likelihood, while FGM treats topic-mixture rates as random variables to accommodate diverse group distributions.MGM shares candidate mixture rates globally, which may fit poorly when groups have different sets of rates; both models follow the LDA paradigm.Source: §2 · p. 2
  • SMM [16] extends one-class support vector machines to group detection by embedding distributions in a probability-measure space with kernels.The approach handles aggregate behavior of data points.Source: §2 · pp. 2–3
  • Existing approaches separate group discovery from anomaly detection and require group information before detection, often constructing groups from application-specific data.Examples include connected components for SDSS, local cubes for turbulence, and collision events for particle data.Source: §2 · p. 3
  • Two-stage methods assume point-wise and pair-wise data are marginally independent, potentially missing their mutual influence and joint effect on detected anomalies.The paper motivates modeling both data forms together and performing group discovery and anomaly detection at once.Source: §2 · p. 3
  • Earlier work is limited to static networks and fixed-size groups, whereas evolving social media can involve changing team membership, group size, and mixture rates.The paper therefore formulates the dynamic task as change-point detection.Source: §2 · p. 3

3 Definition of Group Anomaly

The paper defines group anomalies through collective behavior: groups share a set of roles but differ in their role-mixture rates. Static GLAD identifies rare rates, whereas d-GLAD looks for substantial temporal changes in rates.

3 Definition of Group Anomaly

  • A group is anomalous when its role-mixture rate deviates from the pattern shared by normal groups, with all groups drawing from the same set of roles.Roles are components describing node features, such as article topics, social roles, or job titles.Source: §3 · p. 3
  • Static GLAD treats rare role-mixture rates as anomalous and scores each group's likelihood under the learned normal mixture rates.Lower likelihood under those normal rates indicates a more anomalous group.Source: §3 · p. 3
  • Dynamic d-GLAD frames group anomaly as change-point detection, finding groups whose mixture rates change drastically over time and specifying when they become anomalous.Changing group structure and mixture rates make rarity-based detection unsuitable in the dynamic setting.Source: §3 · pp. 3–4
  • Both definitions rely on inferring group membership and role identity for individuals, despite using different static and dynamic anomaly criteria.Source: §3 · p. 4

4 GLAD0

GLAD0 jointly uses activity features and communications to model group structure and role composition. The section describes its generative design and approximate inference, then motivates a more compact alternative because GLAD0 is computationally costly.

4 GLAD0

  • GLAD0 takes point-wise activity features and pair-wise communication links as inputs and aims to jointly identify groups with irregular role-mixture rates.Its inference is described as using a variational Bayesian approach.Source: §4 · p. 4

4.1 Model Specification

  • The model assigns group identities and role identities to activities and communication memberships to links, fixing the numbers of groups and roles.A person's group identity is undirected, while communication membership depends on the recipient; role identity captures activity-feature clusters.Source: §4.1 · pp. 4–5
  • GLAD0 connects MMSB-style link formation with LDA-style feature generation through a shared group-membership distribution.Links depend on group identities, roles on group-specific mixture rates, and activity features on roles; the activity model can be adapted to other data forms.Source: §4.1 · p. 5

4.2 Model Inference

Algorithm 2 Variational Inference for the alternative GLAD

  • The alternative GLAD estimates parameters by empirical Bayes on the variational likelihood, using Newton-Raphson for α, and ranks groups by negative variational role likelihood.The highest anomaly score marks the most anomalous group.Source: Algorithm 2 Variational Inference for… · p. 7
  • GLAD0's latent-variable count grows with each person's activities, increasing computational cost and complicating dynamic inference; a more compact design is proposed to address these issues.The paper also identifies the loose shared-membership connection as potentially restrictive for capturing dependencies between point-wise and pair-wise data.Source: Algorithm 2 Variational Inference for… · p. 7

5 GLAD

GLAD jointly models social-media activities and communications to infer group and role structure. Its inference procedure approximates the latent-variable posterior and learns model parameters; the static model is limited when network dynamics matter.

5 GLAD

  • GLAD links activity observations to roles and group identities, while modeling pairwise communications from group identity.This compact model shares group membership across the activity and link components.Source: §5 · p. 7

5.1 Inference and Learning

  • Variational inference approximates the latent-variable posterior, whose marginalization is intractable, by choosing a variational distribution and optimizing its objective.The variational distribution is factorized over latent variables, and its objective is maximized over free parameters subject to probability constraints.Source: §5.1 · p. 8

Algorithm 3 Variational Inference for GLAD

  • The GLAD updates use empirical Bayes parameter estimation, and the group with the highest approximated log-likelihood anomaly score is treated as most anomalous.The parameter updates for α and B match those of MMSB.Source: Algorithm 3 Variational Inference for… · p. 9
  • GLAD models a static network, which may be restrictive when the network changes over time.The text motivates extending the model to account for dynamics.Source: Algorithm 3 Variational Inference for… · p. 9

6 dynamic GLAD

d-GLAD extends GLAD to model social-media dynamics by copying the model across time points. It allows latent group and role assignments and group mixture rates to change over time, with sequential inference for the mixture rates.

6 dynamic GLAD

  • d-GLAD generalizes GLAD to account for dynamics in social media.The model specification is followed by inference procedures using variational Bayesian methods and Monte Carlo sampling.Source: §6 · pp. 9–10

6.1 Model Specification

  • Each time point has a GLAD copy; role, group, and mixture-rate factors may change, while membership distributions and model parameters remain fixed.Mixture rates evolve through multivariate Gaussian distributions, with soft-max normalization for multinomial parameters; when T = 1, d-GLAD reduces to GLAD.Source: §6.1 · p. 10
  • Temporal smoothness limits drastic mixture-rate changes, while d-GLAD can represent individuals switching groups and roles over time.The authors frame identifying groups whose mixture rates change substantially as easier under this smoothness model.Source: §6.1 · p. 10

6.2 Inference and Learning

  • d-GLAD uses variational Kalman filtering to infer sequential latent variables and learn model parameters.The variational distribution includes a longitudinal factor for the mixture rates.Source: §6.2 · p. 10

Algorithm 4 Generative Process of DGLAD

Algorithm 5 Monte Carlo Sampling of DGLAD

  • For empirical evaluation, the Monte Carlo d-GLAD inference uses particle filtering for the mixture-rate transitions.The authors report using Monte Carlo sampling because of numerical difficulty with the variational Kalman filter.Source: Algorithm 4 Generative Process of DGLAD · p. 11

7 Experiments

Experiments evaluate GLAD and d-GLAD on synthetic and real-world data, comparing them with two-stage baselines. Across these settings, results cover group discovery, anomaly detection, and temporal model fit.

7.2.1 Synthetic Data with Anomaly Injection

  • Among the three grouping approaches tested on five synthetic groups, GLAD’s inferred memberships are closest to ground truth.Figure 4 rearranges the adjacency matrix by inferred group membership; dark pixels indicate links and blue blocks mark learned groups.Source: §7.2.1 · pp. 12–13, Figure 4 · p. 13
  • For the dynamic synthetic data, d-GLAD achieves the lowest false positive rate among the compared models.The comparison is against static GLAD and MMSB-MGM trained independently at each time point.Source: §7.2.1 · p. 13
  • GLAD has the highest detection accuracy and greater robustness over 10 runs on synthetic data with injected group anomalies.The experiment varies group counts and compares GLAD with four baselines.Source: §7.2.1 · p. 13, Figure 5 · p. 14

7.2.2 Benchmark Data with Anomaly Labels

  • On the employee benchmark, GLAD and MMSB-MGM outperform the other methods on F1, while GLAD has lower variance than MMSB-MGM.All members of detected anomalous groups are treated as individual anomalies and compared with 39 labeled anomalies.Source: §7.2.2 · pp. 13–14, Figure 6 · p. 15

7.3.1 Scientific Publications

  • GLAD outperforms all four baselines across the tested normal/abnormal settings for DBLP group anomaly detection.The experiment treats KDD papers as normal groups and papers from other conferences as anomalies.Source: Table 2 · p. 15, §7.3.1 · p. 15
  • In 6 of 9 ACM publication prediction experiments, d-GLAD achieves higher log-likelihood than GLAD.The comparison evaluates test-set predictive log-likelihood for publications from the following year.Source: Table 5 · p. 16, §7.3.1 · p. 16

7.3.2 US Senate Voting

  • GLAD recovers Senate party affiliation except for Ben Nelson and James Jeffords, whose voting behavior was often at odds with party leadership.The experiment applies GLAD to the aggregated voting network of 100 senators.Source: §7.3.2 · pp. 16–17, Figure 7 · p. 17
  • On the Senate time series, d-GLAD alarms at the seventh time step for Democrats, coinciding with Joseph Lieberman’s primary loss and independent-Democrat status.The paper cautions that this event does not establish the cause of the role-mixture change.Source: §7.3.2 · p. 17

8 Conclusion

The conclusion presents an alternative unified GLAD construction with shared group membership for relational and point-wise data. Its simulation compares joint modeling with two-stage approaches.

8 Conclusion

  • The alternative unified model shares group membership distributions across point-wise and pair-wise data.The paper frames this as a follow-up study of GLAD.Source: §8 · p. 17
  • The paper provides a variational Bayesian inference algorithm for the unified model.Source: §8 · p. 17
  • A simulation experiment evaluates the benefit of the joint model against two-stage approaches.Source: §8 · p. 17

Related papers

Loading 1410.1940v1…