Online Statistical Monitoring and Anomaly Detection in Social Networks
Ph.D. Studentship, Dept. of Mathematics and the Institute for Security Science and Technology
Applications are invited for a PhD studentship to commence in October 2009, funded by the ESPRC through the new Institute for Security Science and Technology of Imperial College and based in the Department of Mathematics. To be eligible for funding, applicants must be UK citizens, or EU citizens resident in the UK for the last three years.
Effective surveillance of a large social network for security purposes requires computationally scalable methods for efficient real-time anomaly detection if timely interventions are to be made. Additionally these methods should provide insight into the hierarchies within the network and their influences on the anomalous behaviour. At present, such methods are not well developed.
This project seeks to build on earlier work on Bayesian anomaly detection methods for dynamic networks in discrete time. There, the communications between pairs of nodes in the network were monitored and any node counts within a period which were abnormally high or low against their usual behaviour were flagged as being anomalous. In the continuous time domain, there is the possibility to incorporate survival analysis methods to make use of the amount of time elapsing between communications. In particular, working within this framework would open up the possibility of looking at the causal effects of behaviours in the network, so for example inferring whether individual X recently contacting individual Y caused individual Y to contact individual Z.
Additional challenges include data integration, where we have multiple communication channels for the network members, such as telephone, file transfer and email, and some additional, possibly dynamic, information on the node members such as spatial location. For longer term modelling, where even normal behaviour might be expected to evolve, online changepoint detection models provide another important development area. Against these needed extensions is a requirement for the implementation to be computationally feasible in real-time; the aforementioned discrete time Bayesian framework was in principle highly parallelisable, but the realisation of this strategy and its feasibility has not yet been explored, and this provides a further interesting computational challenge.
Besides the publicly available real and simulated data, we now have access to a vast supply of anonymised computer network traffic data. This data resource has a huge number of nodes, approximately 50,000, and real life seasonality issues to overcome; additionally there are very clear targets for anomaly detection which we wish to capture, such as a virus attacking a computer and changing its connection behaviour.
The project is to be supervised by Dr Nick Heard and Professor David Hand. Further project specific information can be obtained from Dr Heard ([log in to unmask]<mailto:[log in to unmask]>). Applicants are expected to have at least a 2.1 degree in a mathematical discipline containing a significant amount of statistics. The ideal candidate would be familiar with network analysis or Bayesian inference, and possess strong computer programming skills.
Deadline for applications is 28 August 2009.
To apply please email your CV, two references and a personal statement to [log in to unmask]<mailto:[log in to unmask]> or send them by post to Rusudan Svanidze, Department of Mathematics, South Kensington Campus, Imperial College London, SW7 2AZ. Short listed candidates will be asked to complete a postgraduate application form.
|