Performance evaluation of social network anomaly detection using a moving window–based scan method

Abstract

AbstractTimely detection of anomalous events in networks, particularly social networks, is a problem of increasing interest and relevance. A variety of methods have been proposed for monitoring such networks, including the window‐based scan method proposed by a previous study. However, research assessing the performance of this and other methods has been sparse. In this article, we use simulated social network structures to study the performance of the Priebe et al method. The detection power is high only when more than half of the social network experiences anomalous behavior or if the anomalous behavior is extreme. Both can be represented by high signal‐to‐noise ratios in the network. More precisely, Priebe's scan method performs well when the signal‐to‐noise ratio is above 20. Simulation studies are used to show that an improved detection rate and shortened monitoring delays can be achieved by lagging the moving window used for standardization, lowering the signaling threshold, and using shorter moving windows at the initial stage of monitoring. We suggest a community detection method to be used after an anomalous event has been identified to help determine the subnetwork associated with this anomalous behavior.