Abstract
ABSTRACTConsiderable efforts have been made to apply scan statistics in detecting fraudulent or excessive activities in dynamic email networks. However, previous studies are mostly based on the fixed and disjoint windows, and on the assumption of short-term stationarity of the series, which might result in loss of information and error in detecting excessive activities. Here we devise scan statistics with variable and overlapping windows on stationary time series of organizational emails with a two-step process, and use likelihood function to rank the clusters. We initially estimate the log-likelihood ratio to obtain a primary cluster of communications using the Poisson model on email count series, and then extract neighborhood ego subnetworks around the observed primary cluster to obtain more refined cluster by invoking the graph invariant betweenness as the locality statistic using the binomial model. The results were then compared with the non-parametric maximum likelihood estimation method, and the residual analysis of ARMA model fitted to the time series of graph edit distance. We demonstrate that the scan statistics with two-step process is effective in detecting excessive activity in large dynamic social networks.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.