Detection of excessive activities in time series of graphs

Considerable efforts have been made to apply scan statistics in detecting fraudulent or excessive activities in dynamic email networks. However, previous studies are mostly based on the fixed and disjoint windows, and on the assumption of short-term stationarity of the series, which might result in loss of information and error in detecting excessive activities. Here we devise scan statistics with variable and overlapping windows on stationary time series of organizational emails with a two-step process, and use likelihood function to rank the clusters. We initially estimate the log-likelihood ratio to obtain a primary cluster of communications using the Poisson model on email count series, and then extract neighborhood ego subnetworks around the observed primary cluster to obtain more refined cluster by invoking the graph invariant betweenness as the locality statistic using the binomial model. The results were then compared with the non-parametric maximum likelihood estimation method, and the residual analysis of ARMA model fitted to the time series of graph edit distance. We demonstrate that the scan statistics with two-step process is effective in detecting excessive activity in large dynamic social networks.