### Abstract

We present GraphScan, a novel method for detecting arbitrarily shaped connected clusters in graph or network data. Given a graph structure, data observed at each node, and a score function defining the anomalousness of a set of nodes, GraphScan can efficiently and exactly identify the most anomalous (highest-scoring) connected subgraph. Kulldorff’s spatial scan, which searches over circles consisting of a center location and its k − 1 nearest neighbors, has been extended to include connectivity constraints by FlexScan. However, FlexScan performs an exhaustive search over connected subsets and is computationally infeasible for k > 30. Alternatively, the upper level set (ULS) scan scales well to large graphs but is not guaranteed to find the highest-scoring subset. We demonstrate that GraphScan is able to scale to graphs an order of magnitude larger than FlexScan, while guaranteeing that the highest-scoring subgraph will be identified. We evaluate GraphScan, Kulldorff’s spatial scan (searching over circles) and ULS in two different settings of public health surveillance. The first examines detection power using simulated disease outbreaks injected into real-world Emergency Department data. GraphScan improved detection power by identifying connected, irregularly shaped spatial clusters while requiring less than 4.3 sec of computation time per day of data. The second scenario uses contaminant plumes spreading through a water distribution system to evaluate the spatial accuracy of the methods. GraphScan improved spatial accuracy using data generated from noisy, binary sensors in the network while requiring less than 0.22 sec of computation time per hour of data.

Original language | English (US) |
---|---|

Pages (from-to) | 1014-1033 |

Number of pages | 20 |

Journal | Journal of Computational and Graphical Statistics |

Volume | 24 |

Issue number | 4 |

DOIs | |

State | Published - Oct 2 2015 |

### Fingerprint

### Keywords

- Biosurveillance
- Event detection
- Graph mining
- Scan statistics
- Spatial scan statistic

### ASJC Scopus subject areas

- Discrete Mathematics and Combinatorics
- Statistics and Probability
- Statistics, Probability and Uncertainty

### Cite this

*Journal of Computational and Graphical Statistics*,

*24*(4), 1014-1033. https://doi.org/10.1080/10618600.2014.960926

**Scalable Detection of Anomalous Patterns With Connectivity Constraints.** / Speakman, Skyler; McFowland, Edward; Neill, Daniel.

Research output: Contribution to journal › Article

*Journal of Computational and Graphical Statistics*, vol. 24, no. 4, pp. 1014-1033. https://doi.org/10.1080/10618600.2014.960926

}

TY - JOUR

T1 - Scalable Detection of Anomalous Patterns With Connectivity Constraints

AU - Speakman, Skyler

AU - McFowland, Edward

AU - Neill, Daniel

PY - 2015/10/2

Y1 - 2015/10/2

N2 - We present GraphScan, a novel method for detecting arbitrarily shaped connected clusters in graph or network data. Given a graph structure, data observed at each node, and a score function defining the anomalousness of a set of nodes, GraphScan can efficiently and exactly identify the most anomalous (highest-scoring) connected subgraph. Kulldorff’s spatial scan, which searches over circles consisting of a center location and its k − 1 nearest neighbors, has been extended to include connectivity constraints by FlexScan. However, FlexScan performs an exhaustive search over connected subsets and is computationally infeasible for k > 30. Alternatively, the upper level set (ULS) scan scales well to large graphs but is not guaranteed to find the highest-scoring subset. We demonstrate that GraphScan is able to scale to graphs an order of magnitude larger than FlexScan, while guaranteeing that the highest-scoring subgraph will be identified. We evaluate GraphScan, Kulldorff’s spatial scan (searching over circles) and ULS in two different settings of public health surveillance. The first examines detection power using simulated disease outbreaks injected into real-world Emergency Department data. GraphScan improved detection power by identifying connected, irregularly shaped spatial clusters while requiring less than 4.3 sec of computation time per day of data. The second scenario uses contaminant plumes spreading through a water distribution system to evaluate the spatial accuracy of the methods. GraphScan improved spatial accuracy using data generated from noisy, binary sensors in the network while requiring less than 0.22 sec of computation time per hour of data.

AB - We present GraphScan, a novel method for detecting arbitrarily shaped connected clusters in graph or network data. Given a graph structure, data observed at each node, and a score function defining the anomalousness of a set of nodes, GraphScan can efficiently and exactly identify the most anomalous (highest-scoring) connected subgraph. Kulldorff’s spatial scan, which searches over circles consisting of a center location and its k − 1 nearest neighbors, has been extended to include connectivity constraints by FlexScan. However, FlexScan performs an exhaustive search over connected subsets and is computationally infeasible for k > 30. Alternatively, the upper level set (ULS) scan scales well to large graphs but is not guaranteed to find the highest-scoring subset. We demonstrate that GraphScan is able to scale to graphs an order of magnitude larger than FlexScan, while guaranteeing that the highest-scoring subgraph will be identified. We evaluate GraphScan, Kulldorff’s spatial scan (searching over circles) and ULS in two different settings of public health surveillance. The first examines detection power using simulated disease outbreaks injected into real-world Emergency Department data. GraphScan improved detection power by identifying connected, irregularly shaped spatial clusters while requiring less than 4.3 sec of computation time per day of data. The second scenario uses contaminant plumes spreading through a water distribution system to evaluate the spatial accuracy of the methods. GraphScan improved spatial accuracy using data generated from noisy, binary sensors in the network while requiring less than 0.22 sec of computation time per hour of data.

KW - Biosurveillance

KW - Event detection

KW - Graph mining

KW - Scan statistics

KW - Spatial scan statistic

UR - http://www.scopus.com/inward/record.url?scp=84949544374&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84949544374&partnerID=8YFLogxK

U2 - 10.1080/10618600.2014.960926

DO - 10.1080/10618600.2014.960926

M3 - Article

VL - 24

SP - 1014

EP - 1033

JO - Journal of Computational and Graphical Statistics

JF - Journal of Computational and Graphical Statistics

SN - 1061-8600

IS - 4

ER -