Monitoring communication outbreaks among an unknown team of actors in dynamic networks

Monitoring comm unication outbreaks among an unkno wn team of actors in dynamic net w orks Ross Sparks 1 and James D. Wilson 2 Octob er 8, 2018 Abstract This pap er in vestigates the detection of comm unication outbreaks among a small team of actors in time-v arying net works. W e prop ose monitoring plans for kno wn and unkno wn teams based on generalizations of the exp onentially w eighted mo ving av erage (EWMA) statistic. F or unknown teams, we prop ose an efficient neigh b orhoo d-based searc h to estimate a collection of candidate teams. This pro cedure dramatically re- duces the computational complexit y of an exhaustive searc h. Our pro cedure consists of t wo steps: comm unication counts b etw een actors are first smo othed using a multi- v ariate EWMA strategy . Densely connected teams are identified as candidates using a neighborho o d search approach. These candidate teams are then monitored using a surv eillance plan derived from a generalized EWMA statistic. Monitoring plans are established for collaborative teams, teams with a dominant leader, as w ell as for global outbreaks. W e consider w eighted heterogeneous dynamic net works, where the expected comm unication coun t b et w een each pair of actors is p otentially different across pairs and time, as well as homogeneous netw orks, where the expected comm unication coun t is constan t across time and actors. Our monitoring plans are ev aluated on a test bed of sim ulated net w orks as w ell as on the U.S. Senate co-voting netw ork, whic h models the Senate v oting patterns from 1857 to 2015. Our analysis suggests that our surv eillance strategies can efficiently detect relev ant and significant c hanges in dynamic net w orks. K eywor ds: anomaly detection, exp onentially weigh ted mo ving av erage, outbreak detection, net w ork surveillance, statistical pro cess control 1 Digital Productivity , CSIR O. Priv ate Bag 17. North Ryde, Sydney NSW 1670, Australia Ross.Sparks@csiro.au 2 Departmen t of Mathematics and Statistics, Universit y of San F rancisco. San F rancisco, CA 94117-1080 jdwilson4@usfca.edu 1 1 In tro duction In many applications, it is of in terest to identify anomalous b ehavior among the actors in a time-v arying netw ork. F or example in online so cial netw orks, sudden increased commu- nications often signify illegal b eha vior such as fraud or collusion ( Pandit et al. , 2007 ; Sav age et al. , 2014 ). Anomalous c hanges like these are reflected by lo cal structural c hanges in the net w ork. The goal of netw ork monitoring is to pro vide a surv eillance plan that can detect suc h structural changes. Net work monitoring techniques hav e b een successfully utilized in a num b er of applications, including the identification of cen tral play ers in terrorist groups ( Krebs , 2002 ; Reid et al. , 2005 ; P orter and White , 2012 ), and the detection of fraud in online net w orks ( Chau et al. , 2006 ; P andit et al. , 2007 ; Ak oglu and F aloutsos , 2013 ). As a v ailable data has b ecome more complex, there has b een a recent surge of interest in the developmen t and application of scalable netw ork monitoring metho dologies (see Sav age et al. ( 2014 ) and W o o dall et al. ( 2016 ) for recent reviews). In this pap er, w e in vestigate monitoring the interactions of a fixed collection of n actors [ n ] = { 1 , . . . , n } ov er discrete times t = 1 , . . . , T . In general, an interaction is broadly defined and may represen t, for example, comm unications in an online netw ork ( Prusiewicz , 2008 ), citations in a co-authorship net w ork ( Liu et al. , 2005 ), or gene-gene in teractions in a biological netw ork ( P ark er et al. , 2015 ). W e mo del the in teractions of these actors at time t b y a n × n sto c hastic adjacency matrix Y t = ( y i,j,t ), where y i,j,t is the discrete random v ariable that represents the num b er of interactions b et w een actor i and actor j at time t . Our goal is to dev elop a surv eillance strategy to detect communication outbreaks among a subset of actors Ω t ⊆ [ n ] at time t . The iden tification of outbreaks among a subset of actors Ω t corresp onds to detecting sudden increases in the collection of edges { y i,j,t : i, j ∈ Ω t } . When the team is unknown, monitoring can be computationally expensive due to the need for identifying candidate teams. F or example, consider a simple case where we know the size of the target team is n Ω t = | Ω t | . An exhaustiv e monitoring of all teams of size n Ω t requires a pro cedure of complexity  n n Ω t  ≈ n n Ω t , whic h is infeasible even for mo derately sized net works. As so cial net works are generally large, e.g. n is on the order of 1 million for online netw orks like those represesenting F aceb o ok or T witter, exhaustive searc hes are not practical in real-time. T o address this challenge, we 2 prop ose a computationally efficien t lo cal surv eillance strategy that monitors the interactions of densely connected neigh b orho o ds through time. Our proposed strategy has computational complexit y of order n 2 , and pro vides a viable strategy for large net works. Our surveillance pro cedure consists of t w o steps, which can be briefly described as follows. First, we smo oth the communication counts across all pairs and time using a multiv ariate adaptation of the exp onen tially weigh ted mo ving a v erage (EWMA) technique for smo othing P oisson coun ts. By monitoring the smo othed coun ts, our strategy is robust to sudden random oscillations in the observ ed coun t pro cess. Next, candidate teams are identified lo cally for each no de using a neighborho o d-based approac h. In particular, at time t w e define a candidate team for no de i ∈ [ n ] as one that contains larger than exp ected comm unication. Surv eillance plans for these candidate teams are dev elop ed using appropriate generalizations of the m ultiv ariate EWMA statistic. W e develop surveillance plans using the ab ov e technique in general for heter o gene ous dynamic net works Y = { Y 1 , . . . , Y T } , where w e supp ose that the exp ected communication coun ts are p ossibly differen t for each pair and time, namely , E [ y i,j,t ] = λ i,j,t . W e consider three situations describing the team Ω t : (i) Col lab or ative te ams : members of Ω t comm unicate with one another far more than they comm unicate with actors outside of the team. (ii) Dominant le ader te ams : the members of Ω t ha v e a dominant leader ν who commu- nicates frequently with mem b ers of Ω t , but the members of Ω t themselv es do not necessarily comm unicate frequently amongst themselves. (iii) Glob al outbr e aks : the entire netw ork undergo es a communication outbreak, namely Ω t ≡ [ n ]. Scenarios (i) and (ii) are considered for b oth unknown and known teams. Eac h of the scenarios are also considered for homogeneous netw orks, where E [ y i,j,t ] ≡ λ . By in vestigating b oth a test b ed of simulated net w orks as well as a real netw ork describing the U.S. Senate v oting patterns, we find that our surv eillance strategy can efficiently and reliably detect significan t changes in dynamic netw orks. 3 1.1 Related W ork The most closely related work to our current man uscript is that in tro duced in Heard et al. ( 2010 ). In that pap er, the authors also consider monitoring c hanges in communication v olume b et ween subgroups of targeted p eople o v er time. Their approach ev aluates pairwise comm unication coun ts and determines whether these hav e significantly increased using a p- v alue, which assesses the deviation of the communication rate at time t and what is considered normal b eha vior. Here, normal b ehavior is mo deled using conjugate Ba y esian mo dels for the discrete-v alued time series of communications up to time t . While their fo cus is detecting c hanges on the entire net w ork, our approach considers detecting comm unication outbreaks for mem b ers of a small team within the dynamic net work. There are other mo del-based netw ork monitoring approaches that hav e b een recen tly dev elop ed, whic h w e briefly describ e here. Azarnoush et al. ( 2016 ) prop osed a longitudinal logistic mo del that describ es the (binary) o ccurence of an edge at time t as a function of time-v arying edge attributes in the sequence of netw orks G ([ n ] , T ). Likelihoo d ratio tests of the fitted mo del are used to identify significan t c hanges in G ([ n ] , T ). Peel and Clauset ( 2014 ) dev elop ed a generalized hierarc hical random graph mo del (GHR G) to mo del G ([ n ] , T ). T o detect anomalies, the authors used the GHR G as a n ull mo del to compare observ ed graphs in G ([ n ] , T ) via a Bay es factor, which is calculated using b ootstrap simulation. Wilson et al. ( 2016 ) prop osed mo deling and estimating change in a sequence of net works using the dynamic degree-corrected sto c hastic blo ck mo del (DCSBM). In that w ork, maximum lik eliho o d estimates of the DCSBM are used for monitoring via Shewhart control c harts. Our mo del is similar to the DCSBM in that edges are mo deled as ha ving discrete-v alued edge-w eigh ts, which flexibly mo del communications in so cial net w orks. The EWMA con trol c hart is a popular univ ariate monitoring tec hnique. The m ultiv ariate EWMA pro cess that w e use here is a generalization of the univ ariate EWMA strategies for P oisson counts considered in W eiß ( 2007 , 2009 ), Sparks et al. ( 2009 , 2010 ), and Zhou et al. ( 2012 ). A related m ultiv ariate EWMA con trol c hart has previously been successfully applied to space-time monitoring of crime ( Zeng et al. , 2004 ; Kim and O‘ Kelly , 2008 ; Neill , 2009 ; Naka y a and Y ano , 2010 ). Our sp ecified dynamic netw ork mo del for Y = { Y 1 , . . . , Y T } is related to several well- 4 studied random graph models, whic h are ubiquitous in so cial net work analysis. F or example, when y i,j,t are indep endent and identically distributed Poisson( λ ) random v ariables, the graph at time t is an Erd˝ os-R ´ enyi random graph mo del with edge connection probability λ ( Erd¨ os and R´ en yi , 1960 ). On the other hand, when y i,j,t are indep endent Poisson( λ i,j,t ) random v ariables, graph t is a w eighted v ariant of the Ch ung-Lu random graph mo del ( Aiello et al. , 2000 ). Random graph mo dels pla y an imp ortant role in the statistical analysis of relational data. Goldenberg et al. ( 2010 ) pro vides a recen t survey ab out random graph mo dels and their applications. 1.2 Organization of this P ap er The remainder of this pap er is organized as follows. In Section 2 , w e describ e how to smo oth the observed communication counts using multiv ariate EWMA smo othing. In Section 3 we develop surveillance strategies for comm unication outbreaks among small teams of actors in a dynamic netw ork when the target team is known. W e consider collab orative teams, dominan t leader teams, as w ell as global outbreaks. Section 4 describ es our prop osed lo cal searc h and monitoring approach for unknown target teams. Section 5 inv estigates the p erformance of our surveillance strategies on a test-b ed of sim ulated net w orks. W e make recommendations on designing the plans in such a wa y to minimize false discov ery . In Section 6 , we further assess the p erformance of our strategy by applying the plans to the heterogeneous net work describing the U.S. Senate v oting patterns from the 35th to the 113th Congress. W e conclude with a summary of our findings and discuss directions for future w ork in Section 7 . 2 T emp oral EWMA Smo othing of In teractions Throughout this w ork, we are concerned with detecting significant increases in commu- nication among the mem b ers of some subset of actors Ω t ⊆ [ n ]. Suc h fluctations corresp ond to sudden spikes in the collection of edge weigh ts { y i,j,t : i, j ∈ Ω t } . In many cases, the comm unication counts { y i,j,t : i, j ∈ [ n ] , t = 1 , . . . , T } are prone to random fluctuations that arise from noise in the observ ed pro cess. If not accoun ted for, direct monitoring of coun ts ma y lead to false disco very . T o reduce this p ossibilit y , we smo oth the observed coun ts using 5 a reflectiv e EWMA strategy ( Gan , 1993 ). T o b egin, we first obtain a collection of smo othed v alues { e y i,j,t : i, j ∈ [ n ] , t = 1 , . . . , T } using an EWMA strategy . Fix α ∈ [0 , 1], and define e y i,j,t = α y i,j,t + (1 − α ) e y i,j,t − 1 . (1) Denote the exp ected v alue of e y i,j,t b y e λ i,j,t . The exp ected v alues of these smo othed coun ts can b e calculated using the following recursion e λ i,j,t = α λ i,j,t + (1 − α ) e λ i,j,t − 1 . In the ab o ve recursion, the initial v alues are set as e y i,j, 0 = e λ i,j, 0 = λ i,j, 1 . Here, α acts as a smo othing parameter that dictates the temp oral memory retained in the sto chastic pro cess { e y i,j,t : i, j ∈ [ n ] , t = 1 , . . . , T } . Large v alues of α retain less memory and result in less smo othing. In our applications, w e fix α to 0.075 based on the previous analysis and suggestion of Sparks and Patric k ( 2014 ). Notably , the EWMA in ( 1 ) will not reflect a c hange in the observ ed count pro cess in the scenario that y i,j,t decreases immediately b efore a significant (anomalous) increase. T o a v oid this worst-case scenario, we use the reflective b oundary EWMA pro cess { y ∗ i,j,t : i, j ∈ [ n ] , t = 1 , . . . , T } , defined by y ∗ i,j,t = max ( α e y i,j,t + (1 − α ) y ∗ i,j,t , e λ i,j,t ) (2) The reflective b oundary EWMA sp ecified in ( 2 ) is robust to sudden oscillations in the coun t pro cess. Our surveillance plans will utilize the smo othed counts from ( 2 ) rather than the originally observ ed counts. 3 Monitoring a Kno wn T eam of A ctors W e b egin by considering the simplest case when the target team Ω t is known a priori . This scenario arises, for example, in the surveillance of the comm unication among a known activ e group of terrorists in a large terrorist net w ork. W e dev elop surv eillance plans for collab orativ e and dominan t leader teams, as w ell as global c hanges, where the en tire netw ork 6 undergo es a communication outbreak. F or eac h of these scenarios we describ e monitoring a homogeneous sequence of netw orks Y , where the collection of exp ected communications { λ i,j,t : i, j ∈ [ n ] , t = 1 , . . . , T } are suc h that λ i,j,t ≡ λ for all i, j and t , and further describ e how to extend the plans in this regime to the more general heterogeneous case, where exp ected comm unications are p ossibly different accross time and actor pairs. In b oth this section and Section 4 , w e will make use of t w o tunable parameters – α ∈ [0 , 1]: a smo othing parameter that controls the extent to which a prop osed EWMA statistic has temp oral memory , and h ( · , · ): threshold functions that are chosen to con trol false disco v ery of the prop osed monitoring plan. W e fix α = 0 . 075 based on previous analysis conducted in Sparks and Patric k ( 2014 ). The threshold functions h ( · , · ) are c hosen via sim ulation of the monitored pro cess. W e describ e ho w these are chosen in detail in the App endix. Throughout this and the follo wing section, let e y i,j,t and y ∗ i,j,t b e the EWMA and reflective b oundary EWMA defined in ( 1 ) and ( 2 ), resp ectiv ely . F urther, we denote n Ω t = | Ω t | as the n um b er of individuals in the team. 3.1 Ω t is a Collab orativ e T eam W e first consider monitoring for outbreaks among a collab orativ e team Ω t , wherein all mem b ers of Ω t are exp ected to communicate regularly . An outbreak in a collab orativ e team is reflected by a large av erage n um b er of communications b et ween mem b ers i, j ∈ Ω t . T o detect such outbreaks, we analyze the mean, µ Ω t , of the smo othed interactions in the collection defined as µ Ω t = E   X i ∈ Ω t X j ∈ Ω t e y i,j,t   = X i ∈ Ω t X j ∈ Ω t e λ i,j,t (3) In the case that Y is homogeneous, note that µ Ω t = n 2 Ω t λ . W e use a group - EWMA (GEWMA) statistic to identify outbreaks among the actors in Ω t . The GEWMA t pro cess is defined b y the following recursion GEWMA t = max   α X i ∈ Ω t X j ∈ Ω t e y i,j,t + (1 − α ) GEWMA t − 1 , µ Ω t   , (4) where the initial v alue GEWMA 1 = P i ∈ Ω t P j ∈ Ω t e y i,j, 1 . 7 F or homogeneous net wo rks, w e use the GEWMA t pro cess from ( 4 ) and flag an outbreak within the team Ω t when q GEWMA t − n Ω t √ λ > h G ( λ, n Ω t ) , (5) where h G ( n Ω t , λ ) is designed to give the plan a low false discov ery rate. Imp ortantly , the square ro ot transform of the GEWMA t pro cess in ( 5 ) stabilizes the v ariance of the pro cess to a constant v alue (see Bartlett ( 1936 )). Th us, the left hand side of ( 5 ) is no longer a function of the mean λ . Indeed, w e find from simulation that the threshold h G ( n Ω t , λ ) is not a function of λ ; hence, even in the heterogeneous case we can use a plan with the threshold h G ( n Ω t ). W e describ e ho w to choose the v alue h G ( n Ω t ) in the App endix. Thus for heterogeneous net works, we flag an outbreak in the team Ω t when q GEWMA t − s X i ∈ Ω t X j ∈ Ω t e λ i,j,t > h G ( n Ω t ) . (6) In practice, a target team Ω t ma y purp osefully reduce their communication levels prior to, say , planning a crime, which may hamp er early detection when using the GEWMA t statistic defined in ( 4 ). T o a v oid this scenario, one can alternativ ely use a reflective b oundary GEWMA statistic defined as GEWMA ∗ t = X i ∈ Ω t X j ∈ Ω t y ∗ i,j,t , (7) and apply an analogous plan as defined in ( 6 ). 3.2 Ω t Has a Dominan t Leader W e now consider the scenario in which the target team Ω t has a known dominan t leader ν ∈ [ n ]. W e exp ect that ν will ha ve a high level of communication with the mem b ers of Ω t , but unlik e the collab orativ e team setting, the mem b ers of Ω t do not neccessarily significan tly interact with one another. In this case, an outbreak is signalled when there is either a significan t rate of comm unications b etw een ν and the mem b ers of Ω t , or b y a significant rate of interactions among the members of Ω t . As w e primarily need to b e concerned with the comm unications b et w een a single actor and a collection of actors, w e 8 dev elop a monitoring strategy that exploits sparsity in the in teractions among the mem b ers of Ω t . At time t , w e monitor only the collection of actors that (a) significantly communicate with the dominan t leader ν , and (b) significan tly communicate with one another. That is, w e identify the dominant leader team Ω t b y following tw o steps. First w e identify the team W ν,t that contains all individuals in [ n ] with a significan t num b er of interactions with ν , namely W ν,t = { i 6 = ν ∈ [ n ] : q y ∗ ν,i,t + y ∗ i,ν,t − q e λ ν,i,t + e λ i,ν,t > k } . (8) Next we refine the team W ν,t to include only those mem b ers who share a significan t n um b er of communications. W e set Ω t = { i, j ∈ W ν,t : q y ∗ i,j,t − q e λ i,j,t > k or q y ∗ j,i,t − q e λ j,i,t > k } . (9) The v alue k is a suitable constant that helps iden tify members of the target group and is chosen to control the size of the team Ω t . W e consider the choice of k in our sim ulation study in Section 5 . T o monitor Ω t , we use the dominan t leader EWMA (DEWMA) statistic, defined as DEWMA ν,t = X i ∈ W ν,t  y ∗ i,ν,t + y ∗ ν,i,t  + X i ∈ Ω t X j ∈ Ω t y ∗ i,j,t . (10) When ν is known, w e can use the DEWMA statistic from ( 10 ) to flag outbreaks in a dominan t leader team. In the case that Y is homogeneous, w e flag an outbreak when q DEWMA ν,t − q 2 n W ν,t λ + n 2 Ω t λ > h D ( n λ, Ω t , λ ) . (11) Ab o v e, h D ( n Ω t , λ ) is chosen to control false discov ery . Once again sim ulations suggest that the square ro ot transformation rids the dep endence of the threshold h D ( n Ω t , λ ) on λ . Th us, we use the following general surveillance plan for heterogeneous net w orks when ν is kno wn q DEWMA ν,t − s X i ∈ W ν,t  e λ i,ν,t + e λ ν,i,t  + X i ∈ Ω t X j ∈ Ω t e λ i,j,t > h D ( n Ω t ) , (12) 9 W e note that when the team and dominan t leader are b oth unknown, the plan in ( 12 ) is complicated by the fact that we m ust estimate ν and Ω t . W e discuss our strategy to handle this in Section 4 . 3.3 Global Outbreaks W e no w consider the case when there is a significant increase in the n umber of in teractions among every pair of actors in the netw ork, i.e., when Ω t ≡ [ n ] for all t . One can generally detect this anomaly early b y monitoring the aggregated in teractions ov er the target net work. T o monitor the net work for a global outbreak, one can directly extend the GEWMA t statistic from ( 4 ) to the entire netw ork. Note that in the case that Ω t ≡ [ n ], we hav e from ( 3 ) that µ [ n ] = P i ∈ [ n ] P j ∈ [ n ] e λ i,j,t . F ollowing our previous developmen t of the GEWMA t statistic in ( 4 ), w e define the total-EWMA (TEWMA) statistic using the following recursion TEWMA t = max   α X i ∈ [ n ] X j ∈ [ n ] e y i,j,t + (1 − α ) TEWMA t − 1 , µ [ n ]   , (13) where TEWMA 1 = P i ∈ [ n ] P j ∈ [ n ] e y i,j, 1 , and α ∈ [0 , 1] is c hosen to smo oth the TEWMA pro cess. Using the statistic in ( 13 ), we flag a global outbreak in homogeneous netw orks when q TEWMA t − n √ λ > h T ( λ, n ) . (14) The threshold h T ( n, λ ) designed to give the plan a low enough false discov ery rate, and is chosen in the same manner as plan ( 5 ). As b efore, h T ( n, λ ) do es not dep end on the exp ected comm unication counts due to the square ro ot transform. Hence, in general we flag an outbreak in heterogeneous netw orks when q TEWMA t − s X i ∈ [ n ] X j ∈ [ n ] e λ i,j,t > h T ( n ) . (15) T o a void issues arising from sudden oscillations in coun ts, w e can instead use the reflected- b oundary TEWMA statistic 10 TEWMA ∗ t = X i ∈ [ n ] X j ∈ [ n ] y ∗ i,j,t , (16) and apply the plan given in ( 15 ). 4 Monitoring of an Unkno wn T eam of A ctors In man y applications, Ω t is not known a priori . In this situation, there are tw o primary difficulties that one must address. First, the unknown team m ust b e efficiently estimated. An exhaustive search for an anomalous team has complexity of order n n Ω t ; th us, it is im- p ortan t to emplo y scalable approac hes for estimation. When Ω t is known, the GEWMA t and DEWMA ν,t statistics are in v arian t to v ariations in the comm unication means. Ho wev er, when Ω t is unknown these statistics are no longer in v arian t to heterogeneous comm unication rates through time. Th us the second complication comes in adapting the monitoring plan for a changing mean in heterogeneous net w orks. In this section we describ e a lo cal search strategy to identify densely connected teams on whic h our prop osed statistics can b e used for monitoring. Since the global outbreak plan in ( 15 ) is in v ariant to mean c hanges, w e only need to consider the scenarios when Ω t is either a collab orativ e team or a dominant leader team. 4.1 Estimating Unkno wn T eams Here, w e describ e our lo cal searc h strategy to estimate collab orativ e teams as w ell as teams with a dominant leader. 4.1.1 Collab orativ e T eams When the target team is unkno wn and collaborative, we prop ose monitoring a collection of densely connected teams Ω C,t := { b Ω `,t : ` ∈ [ n ] } at each time t . W e define a candidate team b Ω `,t as one in which all constituent members significan tly interact. In particular, for eac h ` ∈ [ n ] and eac h time t , we identify the candidate team b Ω `,t = { i ∈ [ n ] : q y ∗ i,`,t − q e λ i,`,t > k , or q y ∗ `,i,t − q e λ `,i,t > k } . (17) 11 Ab o v e, k is a suitable constan t with go o d detection prop erties and is chosen via simulation. Our sp ecification of each candidate team b Ω `,t is motiv ated b y empirical prop erties of real net w orks. One can view b Ω `,t structurally as a hub with cen ter no de ` . Hub structures commonly arise in sparse so cial and biological net works as w ell as the well-studied scale-free family of netw orks ( Barab´ asi and Alb ert , 1999 ; T an et al. , 2014 ). Thus if the unknown team is susp ected to be a collab orative team, we prop ose monitoring at most n densely connected teams. 4.1.2 Dominan t Leader T eams When the dominant leader ν and target team Ω t is unkno wn, we monitor a collection of candidate dominan t leader teams Ω D,t := { b Ω ν,t : ν ∈ [ n ] } at eac h time t . Lik e the iden tification of dominant leader teams in Section 3 , w e identify a collection of candidate dominan t leader teams that ha v e a significantly large rate of comm unication. First for a fixed leader ν ∈ [ n ] w e identify a team c W ν,t b y finding all individuals in [ n ] with a significant n um b er of interactions with ν given by c W ν,t = { i 6 = ν ∈ [ n ] : q y ∗ ν,i,t + y ∗ i,ν,t − q e λ ν,i,t + e λ i,ν,t > k } (18) W e next refine the team c W ν,t to include only those members who share a significant n um b er of interactions. Namely , w e sp ecify the team b Ω ν,t as b Ω ν,t = { i, j ∈ c W ν,t : q y ∗ i,j,t − q e λ i,j,t > k or q y ∗ j,i,t − q e λ j,i,t > k } (19) The v alue k is a suitable constan t that helps iden tify members of the target group with larger than exp ected communications with the dominant leader ν . W e note that rather than a normal standardized score to iden tify Ω t , w e use a ‘signal-to-noise’ team identification sc heme in ( 18 ) as this strategy can efficiently av oid unusual changes that inv olve very low comm unication levels. 12 4.2 A dapting the Plans for Heterogeneous Netw orks Once the candidate teams Ω C,t = { b Ω `,t : ` ∈ [ n ] } and Ω D,t = { b Ω ν,t : ν ∈ [ n ] } hav e b een estimated for each time t , w e can develop a monitoring plan. F or `, ν ∈ [ n ], define the follo wing lo cal GEWMA and DEWMA statistics GEWMA ∗ `,t = X i ∈ b Ω `,t X j ∈ b Ω `,t y ∗ i,j,t (20) DEWMA ∗ ν,t = X i ∈ b W ν,t  y ∗ i,ν,t + y ∗ ν,i,t  + X i ∈ b Ω ν,t X j ∈ b Ω ν,t y ∗ i,j,t . (21) When the observ ed net w ork is homogeneous, one can readily monitor collab orative and dominan t leader teams by using plans ( 6 ) and ( 11 ), resp ectively , for the lo cal GEWMA and DEWMA statistics in ( 20 ) and ( 21 ). When the net work is heterogeneous, w e dev elop an adaptiv e plan for surveillance as follo ws. Note that for a fixed candidate collab orative team b Ω `,t , the plan in ( 6 ) can b e re-expressed as r GEWMA ∗ `,t /h 2 G ( λ, n b Ω `,t ) − v u u t X i ∈ b Ω `,t X j ∈ b Ω `,t λ i,j,t /h 2 G ( λ, n b Ω `,t ) > 1 (22) Imp ortan tly the threshold in plan ( 22 ) no longer dep ends on the observed data. W e ex- ploit this prop ert y and define an adaptiv e plan using the lo cal adaptive group-EWMA (A GEWMA) statistic: A GEWMA `,t = GEWMA ∗ `,t /h 2 G ( e λ i,j,t , n b Ω `,t ) . (23) F or an unkno wn team Ω t , a comm unication outbreak is flagged when q A GEWMA `,t − v u u t X i ∈ b Ω `,t X j ∈ b Ω `,t e λ i,j,t /h 2 G ( e λ i,j,t , n b Ω `,t ) > 1 , (24) for any ` ∈ [ n ]. Here, the team m ust b e re-estimated at each time p erio d t . This adaptiv e plan in ( 24 ) has the same in-control A TS v alue used to design the homogeneous plans for all λ i,j,t . W e can use a similar adaptive plan to iden tify comm unication outbreaks in candidate 13 dominan t leader teams. Define the lo cal adaptiv e dominant leader - EWMA (ADEWMA) statistic b y ADEWMA ν,t = X i ∈ b W ν,t   y ∗ i,ν,t h D ( e λ i,ν,t , n b Ω ν,t ) + y ∗ j,ν,t h D ( e λ j,ν,t , n b Ω ν,t )   + X i ∈ b Ω ν,t X j ∈ b Ω ν,t y ∗ i,j,t h D ( e λ i,j,t , n b Ω ν,t ) . (25) Using an analagous argumen t as ab ov e for the adaptive GEWMA plan, we flag a com- m unication outbreak among dominant leader teams when q ADEWMA ν,t − v u u u t X i ∈ b W ν,t   e λ ∗ i,ν,t h D ( e λ i,ν,t , n b Ω ν,t ) + e λ ∗ j,ν,t h D ( e λ j,ν,t , n b Ω ν,t )   + X i ∈ b Ω ν,t X j ∈ b Ω ν,t e λ ∗ i,j,t h D ( e λ i,j,t , n b Ω ν,t ) > 1 (26) for an y ν ∈ [ n ]. There are tw o distinct scenarios in which an outbreak will b e flagged b y the plan ( 26 ). In the first scenario, an outbreak is detected if the team size of any candidate team significan tly increases. This is lik ely to happ en when, for instance, a leader of an organized crime is trying to recruit a team. In the second scenario, an outbreak is detected when the n um b er of in teractions within an y candidate team significan tly increases. This can o ccur in t w o wa ys: (i) when individuals within the same team in teract more with individuals outside of their curren t group, or (ii) members of the group in teract significan tly more frequently among themselv es. Com binations of (i) and (ii) ma y also flag communication outbreaks. 5 Sim ulation Study W e no w access the utility of our prop osed surv eillance plans on a test b ed of simulated net w orks. W e consider tw o types of communication outbreaks among small target teams. In the first scenario, w e simulate a collab orative team outbreak, where every actor in a small and unkno wn team is in v olved in the outbreak. In the second scenario, the target team has an unkno wn dominan t leader whose communication lev els with the remaining team undergo es an outbreak. F or each of these cases, we in vestigate the effectiveness of the GEWMA and 14 DEWMA strategies. F or each sim ulation, we generate 100 in-control net w orks follo w ed by 500 net w orks that ha v e undergone an outbreak. W e record the time to signal - the num b er of netw orks after the c hange un til a signal is flagged - of the DEWMA and GEWMA plans and rep eat the exp erimen t 10000 times for the collab orativ e team outbreak and 1000 times for the dominant leader outbreak. T o ev aluate the p erformance of a plan, we record the a verage time to signal (A TS) o ver the collection of simulations. W e presen t the results for all simulations in T ables 1 - 12 in the App endix. 5.1 Collab orativ e T eam Outbreaks T ables 1 through 10 outline the detection prop erties of sim ulated collab orativ e team outbreaks for net w orks of size n = 100. T o sim ulate an outbreak, w e select a fixed but hidden team Ω ⊆ { 1 , . . . , 100 } . In the first 100 in-con trol netw orks, communication coun ts among the no des in Ω hav e mean λ . In the remaining net w orks, the no des in Ω ha v e an increased mean comm unication count of (1 + δ ) λ . W e sim ulate netw orks with target teams of size n Ω = 6 , 7 , 8 , 9 , and 10. F or each time series of netw orks, w e estimate candidate collab orative teams and dominant leader teams via ( 17 ) and ( 19 ) and then apply the GEWMA and DEWMA plans from ( 5 ) and ( 11 ), resp ectively . 5.1.1 The GEWMA t Plan In the first part of our study , w e sim ulate homogeneous target net w orks with mean comm unication counts of either λ = 0 . 20 or 0 . 70. W e in v estigate significance thresholds k b et w een 0.05 and 0.40 in increments of 0.05. T able 1 explores c hanges in comm unication coun ts in a team of size 6. T able 1 rev eals that k = 0 . 40 pro vides the b est p erformance for b oth λ v alues. W e extend the first simulation to seek the b est plan for detecting the collab orative team Ω, when n Ω = 6 and n = 100. W e in vestigate significance thresholds of k b et ween 0 . 40 and 0 . 70 for exp ected communication rates of λ = 0 . 20 , 0 . 40 and 0 . 70. T ogether, T ables 1 and 2 indicate that k = 0 . 60 is the b est c hoice for all λ and Ω inv olving 6 of the 100 actors. F urthermore we find that the p erformance of the GEWMA plan strongly dep ends on 15 an appropriate choice of k ; the detection p erformance of the GEWMA plan is dramatically impro v ed for k = 0 . 60. W e rep eat the collab orative team outbreak sim ulation for a target team of size 7, 8, 9, and 10. In each simulation, we seek the b est significance threshold k for homogeneous net w orks with mean communication λ = 0 . 20 , 0 . 40 and 0 . 70. W e report the A TS o v er 10000 sim ulations for eac h of these settings in T ables 3 - 6. Our results suggest that k = 0 . 50 is the b est choice for all λ when n Ω is 8, 9, or 10, while k = 0 . 50 or 0.60 is most suitable for net w orks where the target team is of size 7. This result suggests that there is an in verse relationship b etw een the optimal v alue of k and the size of the target team. This is helpful in deciding the c hoice of k for the GEWMA plan, and it app ears that k = 0 . 50 is a robust c hoice for the outbreaks considered in this study . 5.1.2 The DEWMA ν,t Plan T ables 7 - 10 rep ort the results of the DEWMA surveillance plan on the collab orative team outbreaks describ ed ab o v e for target teams of size 6, 7, 8, and 9. F or eac h setting, k = 0 . 45 tends to b e the b est choice for significance threshold. The only exception is in the case that the team is of size 9 and the mean communication is λ = 0 . 70, in whic h case k = 0 . 40 is the b etter choice. 5.1.3 Comparison of the GEWMA t and DEWMA ν,t Plans In comparing the results for the GEWMA and DEWMA plans on the collab orative team outbreak simulation, we find that in general the GEWMA plan outp erforms the DEWMA plan. In particular, the GEWMA strategy detects the collab orativ e team so oner than its coun terpart. F or example when δ = 1 and λ = 0 . 2, the strategy based on GEWMA t in T able 2 had an A TS equal to 11.62 ( k = 0 . 60) whereas the technology based on DEWMA ν,t in T able 7 had an A TS equal to 12.90 ( k = 0 . 45). Similarly , when δ = 0 . 50 and λ = 0 . 70; the GEWMA t strategy had an A TS equal to 8.54 ( k = 0 . 50); whereas, the DEWMA ν,t plan had an A TS of 8.87 ( k = 0 . 40). 16 5.1.4 Is the Metho dology fit-for-purp ose? In order to judge whether the tec hnology is fit for purp ose w e consider the monitoring of a crime. T o b e effective, we w ould lik e our strategy to flag the planning of a crime within sev en days. W e assume the following sp ecifications of team b ehavior: 1. In order to plan a crime, team members should call each other at least 0.5 p er day during the planning phase. W e consider this to b e the low est level of comm unication necessary to plan a crime. 2. The planning stage of the crime w ould result in at least a doubling of their usual comm unication intensit y during this planning stage. 3. The usefulness sp ecification is that detection should b e well within 7 da ys of the start (i.e., the out-of-con trol A TS < 7). The last sp ecification allows la w enforcement agencies enough time for appropriate de- tectiv e w ork to b e carried out and p oten tially a v oid catastrophic ev ents suc h as terrorism. The optimal plan for λ = 0 . 4 and 0.7 pass the usefulness test b y flagging within sev en days on a v erage for all groups (e.g., with λ = 0 . 4, k = 0.6 the GEWMA t statistics detect the out- break on av erage in 6.93 days). On the other hand, when the o v erall communication in the net w ork is relatively sparse ( λ = 0 . 2), this fit for purp ose test is only met for collab orativ e teams ha ving 8 or more members. 5.2 Dominan t Leader T eam Outbreaks W e no w in v estigate the p erformance of the GEWMA and DEWMA plans when the out- break o ccurs among a fixed but unkno wn dominant leader team in a homogeneous dynamic net w ork. W e simulate the netw orks with the same sp ecifications as the collab orative team study in Section 5.1 , except no w the outbreak only o ccurs on a fixed subset of communi- cations in the team (rather than throughout the entire team as in the collab orative team scenario). In particular, we consider four different dominant leader teams where a commu- nication outbreak o ccurs on the directed edges shown in Figure 5.2 . In eac h of these four teams, team mem b er 6 is assumed to b e the dominan t leader and comm unicates with all other mem b ers of the team. 17 Sim ulation 1 Sim ulation 2 1 3 2 6 5 4 1 3 2 6 5 4 7 Sim ulation 3 Sim ulation 4 1 3 2 6 5 4 7 8 1 3 2 6 5 4 7 8 9 Figure 1: Dominant leader target teams for the sim ulation study . T eams are of size 6, 7, 8, and 9 among a net w ork of size 100. F or eac h simulation, a communication outbreak o ccurs only on the directed edges shown. In each simulation, no de 6 is the dominan t leader and comm unicates with every member of the team. W e assess the p erformance of the GEWMA and DEWMA plans on these dominant leader outbreaks and rep ort the results in T ables 11 and 12. Our results suggest that again the c hoice of k pla ys an imp ortan t role in establishing the b est p erforming monitoring strategy . F urthermore, across all v alues of λ k , and n Ω , we found that the DEWMA metho d out- p erformed the GEWMA strategy in this sim ulation study . Both metho ds witness improv ed p erformance as the signal to noise ratio ( δ ) increases. Our results provide empirical evidence that the DEWMA plan is an effectiv e strategy when the target team has a dominant leader, or when the team is more sparsely connected than a collab orativ e team. 18 5.3 Heterogeneous Net w orks with no Outbreak W e no w assess the p erformance of the ADEWMA plan from ( 26 ) on heterogeneous net w orks that undergo no outbreak, but whose size changes through time. Without loss of generalit y , w e fix the mean communication count b et ween no de i and j at time t as λ i,j,t = a | i − j | + 0 . 90 , for a fixed constant a < 0. This sp ecification gives a higher likelihoo d of communication b et ween no des that are close to one another in the ordering of the no des. T o v ary the size of the net w ork through time, we fix lo wer ( m L ) and upp er b ounds ( m H ) and select the size of the t th net w ork n t b y randomly dra wing a discrete v alue uniformly from the in terv al [ m L , m H ]. As there is no outbreak in our sim ulated collection of net w orks, we seek a plan that iden tifies no c hange for some fixed n um b er of time steps. By in v estigating this asp ect of the ADEWMA plan, we can b etter understand ho w to con trol the num b er of false disco veries un- der a null model where no outbreak is presen t. F or our curren t study , w e seek an AD EWMA plan that delivers an A TS of 100. W e note that one could alternatively seek an A TS of 370 to match the standard three sigma strategy of Shewhart con trol charts, but the choice is arbitrary . W e v ary the v alues of a , m L , and m H and identify the threhold adjustmen t that acquires the desired A TS o v er 1000 simulations. The threshold adjustments and calculated A TS are pro vided in T able 13. The sim ulation results in T able 13 rev eal that the ADEWMA plan with threshold 0.984 has an in-control A TS closest to the desired v alue of 100 when m H > 135. On the other hand, when m H ≤ 135 selecting a threshold of 1 deliv ers the b est plan. These results suggest that the ADEWMA plan is robust to large c hanges in the size of the netw ork from one time to the next. In many applications (lik e our application in Section 6 ), the size n t is likely to hav e a small v ariation o ver time. W e find that in these situations the ADEWMA plan witnesses an impro vemen t in ov erall robustness. 6 Application to U.S. Congressional V oting W e now apply the GEWMA monitoring plan from ( 6 ) to inv estigate the dynamic rela- tionship b et w een Republican and Demo cratic senators in the U.S. Congress. W e analyze the v oting habits of each U.S. senator according to his or her vote (ya y , na y , or abstain) on each 19 bill that wen t to Congress. W e inv estigate these v oting habits from 1857 (Congress 35) to 2015 (Congress 113). W e generated a dynamic net w ork to mo del the co-v oting patterns among U.S. Senators in the following manner. W e first collected the raw roll call voting data for eac h bill from http://voteview.com . F or eac h Congress, w e generate a new net w ork, where the senators of that Congress are the no des, and the edge weigh t b et ween t w o senators is the n umber of bills for which those t w o senators v oted concurrently in that Congress. W e restrict our analysis to Republican and Demo crat senators only (th us ignoring the Indep enden t party and other affiliations). Predictable b eha vior is regarded as in-control. T o mo del in-con trol b eha vior, we use a logistic regression mo del to predict whether tw o senators will vote the same on a newly submitted bill. W e fit a logistic mo del to estimate the probabilit y that a senator (Senator A) w ould vote the same as another senator (Senator B) using the follo wing predictors: (a) the p olitical affiliation of each senator (Senators A and B), (b) which party had a ma jorit y in the Congress, (c) the prop ortion of that ma jorit y , and (d) the prop ortion of represen tation of Senator A’s p olitical affiliation. The exp ected num b er of votes from Senator A to Senator B was calculated by m ultiplying the predicted probabilit y from the logistic regression by the total n um b er of votes for that senator. This coun t was assumed to b e P oisson distributed with in-con trol mean given by this exp ected coun t. In this application w e are interested in b oth un usually high counts and unusually lo w coun ts. Therefore we run t wo one-sided c harts. In particular, for a target team Ω t w e analyze the GEWMA t statistic from ( 4 ), as w ell as the low er GEWMA (L-GEWMA t ) statistic defined b y L-GEWMA t = min( α X i ∈ Ω t X j ∈ Ω t e y i,j,t + (1 − α ) L-GEWMA t − 1 , µ Ω t ) , where α was fixed to b e 0.075. The plans are trained using sim ulation to deliver an in- con trol false alarm rate of 200. The GEWMA and L-GEWMA curves w ere calculated from t w o sources (i) the likelihoo d of Republicans v oting with Demo crats, and (ii) the likelihoo d of Demo crats voting with Republicans. W e do not exp ect our co-voting patterns to remain in- con trol and predictable; thus, we are particularly in terested in identifying sustained p eriods 20 of un usual b eha vior. The GEWMA and L-GEWMA curves are plotted in Figure 7 . These plots reveal several in teresting trends in the Congressional co-voting net work. First, the tendency for Republican and Demo cratic senators to vote with one another has b een significantly lo w b eginning from Congress 103. This finding supp orts the p olitical polarization theory observ ed in Moo dy and Muc ha ( 2013 ), who noted that the Republican and Demo crat sc hism b egan around the time of Bill Clin ton’s first term as president (Congress 103). Second, there w as a sustained coher- ence of v oting b et w een opp osing p olitical parties b et w een Congress 85 (1957) and Congress 100 (1987). During this time, the lik eliho o d of one part y concurrently v oting with the other opp osing party w as significantly high. Muc h of this time p erio d coincides with the so-called “Ro c k efeller Republican” era (1960 - 1980) in which Republican party mem b ers w ere known to hold particularly mo derate views like the former gov ernor of New Y ork, Nelson Ro ck e- feller ( Rae , 1989 ; Smith , 2014 ). This finding was also identified using netw ork surveillance tec hniques in Wilson et al. ( 2016 ). 7 Discussion This pap er introduces nov el and computationally feasible surveillance plans for identi- fying communication outbreaks in dynamic netw orks. In the worst-case scenario when the target team is unknown, the prop osed metho d monitors at most n 2 candidate teams, whic h dramatically impro v es the computational memory needed for an exhaustiv e search. Our new plan uses a general multiv ariate EWMA approac h to accumulate temp oral memory of com- m unication coun ts. The approac h can easily b e extended to situtations with more than one comm unication c hannel. Plans w ere extended to handle netw orks with heterogeneous mean coun ts (as in the application) and the v alue of our prop osed plans w as further demonstrated with sim ulated applications. In our simulation study , we found that our new approach is able to effectiv ely iden tify 21 Demo crat Prop ensit y to V ote with Republicans 40 60 80 100 −1.5 −1.0 −0.5 0.0 0.5 1.0 1.5 Congress EWMA signal−to−noise ratio(S/LS) 35 40 45 50 55 60 65 70 75 80 85 90 95 100 105 110 Republican Prop ensit y to V ote with Demo crats 40 60 80 100 −1.5 −1.0 −0.5 0.0 0.5 1.0 1.5 Congress EWMA signal−to−noise ratio(S/LS) 35 40 45 50 55 60 65 70 75 80 85 90 95 100 105 110 Figure 2: GEWMA and L-GEWMA con trol charts for monitoring (TOP): the likelihoo d of Demo cratic senators to v ote with Republican senators, and (BOTTOM): the lik eliho o d of Republican senators to vote with Demo cratic senators. Red dotted lines mark the control limits of the GEWMA signal to noise v alue for each Congress. In eac h plot, the upp er curve represen ts the GEWMA statistic and the low er curve represen ts the L-GEWMA statistic o v er time. 22 outbreaks even when the outbreak cov ers a small num b er of comm unications ( < 1% of total comm unications). These results suggest that the technology will b e particularly useful in crime managemen t as crime is t ypically committed b y gangs of a small size ( A Morgan and W Shelley , 2014 ). F urthermore, we b eliev e that law enforcemen t agencies would v alue our prop osed technique as it could b e used to help gain insigh ts on p ersons of interest, e.g., it could b e applied juv enile crime rings as a prev en tative to ol to help reduce rep eat offenders. W e found that when the outbreak is global across all communications of the targeted p eople, using the TEWMA t plan is the b est approach and this plan is inv ariant of the distribution of communication coun ts in the target net w ork. If the comm unication outbreaks in v olves a small sub-group of the targeted p eople then the group-EWMA (GEWMA t ) plan has b est p erformance. As the size of the outbreak group is seldom known in adv ance, applying these plans sim ultaneously in a single plan may offer a more robust means to detect the full range of p oten tial outbreaks. Our prop osed tec hnique motiv ates sev eral areas of future research. F or example, future w ork should explore the p otential of extending this approac h to cov er geographic dimensions (see Carley et al. ( 2013 )) to account for the spatial nature of observed dynamic systems. F urthermore, one can explore other w ays of estimating the target team for monitoring. New approac hes could inv olve defining p eople in the targeted net w ork with either increased connectivit y or historically a high connectivity . The target group itself could b e regarded as v arying according to whether they ac hieve a certain level of connectivit y with the leaders, or av erage connectivit y within the target group. In principle, one could also estimate teams of individuals that are most densely connected at time t using a comm unity detection or extraction algorithm on the netw ork Y t ( Lancic hinetti et al. , 2010 ; Zhao et al. , 2011 ; Wilson et al. , 2014 ). Alternatively , one could identify candidate teams in a netw ork with statistically significan t edges using a p-v alue technique lik e that dev elop ed in Wilson et al. ( 2013 ). Finally , this pap er arbitrarily selected the temp oral smo othing parameter α = 0 . 075. Therefore future research effort could b e devoted to selecting an appropriate v alue for the m ultiv ariate temp oral smo othing. W e b eliev e that this effort should b e dev oted either to establishing an appropriate robust choice for α , or to alternatively v arying the c hoice of α for each communication coun t so as to exploit lo cal trends in the netw ork such as the work done in Capizzi and Masarotto ( 2003 ). 23 App endix Sp ecification of Threshold V alues Sim ulation metho ds were used to estimate the thresholds for the DEWMA ν,t and GEWMA t plans so as to deliver an in-control A TS of appro ximately 100. The thresholds for b oth the collab orativ e team and the dominant leader team were established in the iden tical manner. T o a v oid redundancy , we will describ e the simulation pro cedure to determine thresholds in the collab orativ e team scenario. F or the DEWMA ν,t plan, we simulated netw orks of size n = 100 , 125 , 150 , . . . , 375 , 400. F or each netw ork, we fixed the temp oral memory as α = 0 . 10 and generated homogeneous net w orks with mean counts equal to λ = 0 . 01 , 0 . 02 , 0 . 03 , . . . , 0 . 10 , 0 . 15 , 0 . 20 , . . . , 0 . 95 , 1 . 0. F or eac h combination, the thresholds h D ( λ, n ) are estimated to obtain the fixed A TS. These v alues w ere then used to build the follo wing regression mo del: log( h D ( λ, n )) = β 0 + β 1 n + β 2 n 2 + β 3 n 3 + β 4 λ + β 5 λ 2 + β 6 I ( λ < 0 . 95) + β 7 I ( λ < 0 . 95) λ + β 8 log( λ ) + β 9 n log ( λ ) + β 10 nλ + β 11 nλ 2 + error . Once fitted, the ab o v e regression mo del w as used to estimate the thresholds for the DEWMA ν,t plan for homogeneous net w orks with mean coun t λ and size n . The ab o v e fitted mo del deliv ers an in-control A TS within 100 ± 15 for the range of 100 ≤ n ≤ 400, 0 . 01 ≤ λ ≤ 1 . 0 and α = 0 . 10. The standard error of the mo del w as 0.0043 and the correlation b et w een the mo del fitted v alues and the corresponding actual simulated h D ( λ, n ) v alues was 0.9996. F or the GEWMA t plan, w e estimated the threshold h G ( λ, n ) in a similar wa y as ab o ve. W e generated net works of size n = 100 , 125 , 150 , . . . , 975 , 1000, fixed α = 0 . 10, and sim ulated homogeneous netw orks with mean coun ts λ = 0 . 01 , 0 . 02 , 0 . 3 , . . . , 0 . 1 , 0 . 15 , 0 . 2 , . . . , 0 . 95 , 1 . 0. F or eac h combination, we estimated the threshold h G ( λ, n ) through sim ulation, and then used these estimates to build the following regression mo del: 24 1 /h G ( λ, m ) = β 0 + β 1 log( λ ) + β 2 n + β 3 n 2 + β 4 n 3 + β 5 λ + β 6 λ 2 + β 7 λ 3 + β 8 log( n ) + β 9 log( λ ) n + β 10 log( λ ) n 2 + β 11 log( λ ) n 3 + β 12 nλ + β 13 n 2 λ + β 14 n 3 λ + β 15 λ 4 + β 15 λ log ( n ) + β 16 λ 5 + β 17 λ 2 log( n ) + β 18 λ 3 log( n ) + error The ab o ve model estimates the thresholds for the GEWMA t for homogeneous coun ts and obtained an in-con trol A TS of 100 ± 7 for 100 ≤ n ≤ 1000, 0 . 01 ≤ λ ≤ 1 and α = 0 . 10. The standard error of the mo del w as 0.0007 and the correlation b et w een the mo del fitted v alues and the corresp onding actual simulated h D ( λ ) v alues w as 0.99999. Sim ulation Study Results Belo w, we provide tables for the sim ulation results describ ed in Section 5 . 25 T able 1: Collab orativ e team A TS p erformance for GEWMA t with n Ω t = 6 Comm unication outbreaks in team of size 6 from a netw ork of size 100 λ 0.2 0.7 k 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 δ A TS 0 . 5 70.60 75.33 76.30 74.83 74.11 72.61 53.71 43.36 55.29 57.67 58.23 55.59 47.71 33.97 23.70 17.41 1 . 0 50.25 56.20 57.65 48.34 45.86 34.02 20.27 16.08 27.69 33.63 37.48 34.24 24.05 14.30 9.19 6.59 2 . 0 28.15 33.89 34.26 28.32 19.64 12.62 8.05 6.16 15.57 18.32 19.46 16.79 11.60 6.60 4.29 3.09 3 . 0 19.12 23.48 23.51 19.35 12.67 7.87 5.20 3.95 10.32 12.23 12.96 11.01 7.77 4.50 2.89 2.12 4 . 0 14.70 15.10 17.46 14.37 9.91 5.78 3.74 2.94 8.23 9.57 10.18 8.22 5.69 3.52 2.24 1.80 5 . 0 12.06 14.30 13.88 11.30 7.56 4.68 3.13 2.39 6.70 7.89 8.17 6.60 4.69 2.91 1.88 1.41 6 . 0 10.31 12.15 12.14 9.35 6.29 3.96 2.60 2.11 5.72 6.68 7.03 5.68 3.89 2.46 1.69 1.07 7 . 0 8.97 10.55 10.33 7.77 5.43 3.41 2.28 1.89 5.22 5.84 5.96 4.83 3.37 2.13 1.46 1.00 8 . 0 8.05 9.41 9.30 7.25 4.81 3.01 2.01 1.76 4.40 5.26 5.40 4.34 3.02 1.94 1.21 1.00 26 T able 2: Collab orativ e team A TS p erformance for GEWMA t with n Ω t = 6 pt. 2 Comm unication outbreaks in team of size 6 from a netw ork of size 100 λ 0.2 0.4 0.7 k 0.4 0.45 0.5 0.6 0.7 0.4 0.45 0.5 0.6 0.7 0.4 0.45 0.5 0.6 0.7 δ A TS 0 . 5 43.36 42.98 41.90 39.75 50.45 43.36 24.01 21.39 20.42 21.61 17.41 14.30 12.98 12.23 13.64 1 . 0 16.08 12.91 11.87 11.62 12.64 9.28 7.78 7.24 6.93 7.74 6.59 5.50 5.10 5.02 5.56 2 . 0 6.16 5.29 4.91 4.70 5.40 4.17 3.55 3.38 3.28 3.65 3.09 2.71 2.51 2.49 2.71 3 . 0 3.95 3.37 3.18 3.11 3.52 2.74 2.42 2.27 2.23 2.47 2.12 1.92 1.84 1.83 1.96 4 . 0 2.94 2.63 2.46 2.43 2.66 2.16 1.95 1.81 1.82 1.95 1.80 1.55 1.39 1.39 1.58 5 . 0 2.39 2.13 2.06 2.03 2.18 1.87 1.72 1.57 1.52 1.68 1.41 1.10 1.06 1.06 1.19 6 . 0 2.11 1.89 1.84 1.75 1.86 1.66 1.32 1.19 1.21 1.40 1.07 1.02 1.00 1.00 1.03 7 . 0 1.89 1.68 1.60 1.56 1.72 1.31 1.08 1.05 1.05 1.14 1.00 1.00 1.00 1.00 1.00 8 . 0 1.76 1.46 1.36 1.35 1.54 1.11 1.02 1.00 1.00 1.04 1.00 1.00 1.00 1.00 1.00 27 T able 3: Collab orativ e team A TS p erformance for GEWMA t with n Ω t = 7 Comm unication outbreaks in team of size 7 from a netw ork of size 100 λ 0.2 0.4 0.7 λ TEWMA GEWMA TEWMA GEWMA TEWMA GEWMA k 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 δ A TS 0 . 25 57.26 45.36 40.46 38.98 43.89 0 . 5 53.45 41.97 34.38 32.10 42.06 43.36 30.71 17.07 16.95 19.56 34.25 13.34 10.70 10.69 12.26 1 . 0 31.84 12.16 9.83 9.96 11.58 22.00 9.73 6.12 6.16 6.90 16.08 5.44 4.48 4.52 5.02 2 . 0 14.93 4.986 4.26 4.26 4.80 9.65 4.16 2.98 2.96 3.30 6.68 2.65 2.25 2.30 2.54 3 . 0 8.99 3.29 2.86 2.91 3.16 5.89 2.81 2.08 2.06 2.26 4.23 1.92 1.72 1.74 1.83 4 . 0 6.25 2.57 2.18 2.22 2.47 4.19 2.11 1.72 1.72 1.84 3.08 1.53 1.18 1.22 1.33 5 . 0 4.83 2.06 1.68 1.78 2.01 3.31 1.88 1.36 1.34 1.59 2.49 1.07 1.01 1.02 1.09 6 . 0 3.95 1.83 1.37 1.39 1.79 2.75 1.63 1.06 1.08 1.24 2.12 1.00 1.00 1.00 1.01 7 . 0 3.36 1.68 1.15 1.20 1.59 2.39 1.34 1.00 1.01 1.06 1.89 1.00 1.00 1.00 1.00 8 . 0 2.94 1.45 1.02 1.05 1.10 2.11 1.10 1.00 1.00 1.00 1.39 1.00 1.00 1.00 1.00 28 T able 4: Collab orativ e team A TS p erformance for GEWMA t with n Ω t = 8 Comm unication outbreaks in team of size 8 from a netw ork of size 100 λ 0.2 0.4 0.7 TEWMA GEWMA TEWMA GEWMA TEWMA GEWMA k 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 δ A TS 0 . 25 48.55 30.51 31.99 33.17 38.11 0 . 5 44.73 30.51 27.60 27.06 32.37 34.98 16.79 14.07 14.50 17.12 25.38 9.89 9.26 9.54 10.91 1 . 0 24.32 9.89 8.60 8.70 10.34 16.21 6.38 5.60 5.71 6.42 11.20 4.36 4.05 4.13 4.60 2 . 0 10.44 4.36 3.87 3.95 4.49 6.90 3.30 2.71 2.73 3.11 4.89 2.92 2.09 2.14 2.41 3 . 0 6.36 2.92 2.62 2.61 2.97 4.33 2.13 1.93 1.94 2.15 3.19 2.20 1.55 1.62 1.77 4 . 0 4.58 2.20 2.04 2.10 2.33 3.19 1.78 1.58 1.59 1.73 2.38 1.88 1.06 1.11 1.33 5 . 0 3.62 1.88 1.77 1.79 1.91 2.55 1.37 1.14 1.18 1.41 2.01 1.69 1.00 1.00 1.04 6 . 0 3.02 1.69 1.49 1.50 1.69 2.15 1.09 1.03 1.03 1.14 1.68 1.43 1.00 1.00 1.00 7 . 0 2.57 1.43 1.20 1.25 1.47 1.88 1.01 1.00 1.00 1.02 1.52 1.19 1.00 1.00 1.00 8 . 0 2.29 1.19 1.06 1.09 1.24 1.71 1.00 1.00 1.00 1.00 1.34 1.02 1.00 1.00 1.00 29 T able 5: Collab orativ e team A TS p erformance for GEWMA t with n Ω t = 9 Comm unication outbreaks in team of size 9 from a netw ork of size 100 λ 0.2 0.4 0.7 TEWMA GEWMA TEWMA GEWMA TEWMA GEWMA k 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 δ A TS 0 . 25 38.20 28.93 25.89 26.56 33.81 0 . 5 38.23 24.63 22.25 23.50 30.47 27.38 12.45 12.34 13.17 15.19 20.06 9.07 8.54 8.62 9.97 1 . 0 18.64 8.29 7.58 8.00 9.50 12.01 4.93 4.86 5.14 6.01 8.54 3.94 3.71 3.86 4.07 2 . 0 7.91 3.83 3.53 3.65 4.15 5.27 2.48 2.47 2.58 2.91 3.87 2.06 1.90 2.02 2.14 3 . 0 4.89 2.56 2.45 2.46 2.82 3.39 1.82 1.80 1.87 2.01 2.52 1.54 1.38 1.48 1.77 4 . 0 3.56 2.04 1.89 1.95 2.17 2.52 1.40 1.40 1.47 1.70 2.00 1.05 1.01 1.05 1.33 5 . 0 2.84 1.80 1.63 1.66 1.81 2.05 1.05 1.05 1.09 1.33 1.64 1.00 1.00 1.00 1.04 6 . 0 2.39 1.51 1.30 1.40 1.56 1.76 1.00 1.00 1.01 1.08 1.44 1.00 1.00 1.00 1.00 7 . 0 2.08 1.21 1.07 1.14 1.38 1.58 1.00 1.00 1.00 1.00 1.27 1.00 1.00 1.00 1.00 8 . 0 1.86 1.07 1.02 1.03 1.14 1.43 1.00 1.00 1.00 1.00 1.09 1.00 1.00 1.00 1.00 30 T able 6: Collab orativ e team A TS p erformance for GEWMA t with n Ω t = 10 Comm unication outbreaks in team of size 10 from a netw ork of size 100 λ 0.2 0.4 0.7 TEWMA GEWMA TEWMA GEWMA TEWMA GEWMA k 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 0.4 0.5 0.6 0.7 δ A TS 0 . 25 52.79 43.36 37.06 43.40 50.28 35.88 23.48 22.57 23.55 28.32 0 . 50 30.94 21.23 19.82 21.63 25.36 21.69 12.45 10.84 11.64 15.91 10.80 8.30 7.27 7.89 8.89 1 . 00 14.38 7.25 7.02 7.33 8.60 9.42 4.93 4.67 4.80 6.63 4.62 3.64 3.43 3.66 4.07 2 . 00 6.12 3.39 3.26 3.47 3.87 4.12 2.47 2.35 2.45 2.81 3.03 1.94 1.90 1.96 2.14 3 . 00 3.89 2.37 2.20 2.39 2.63 2.70 1.82 1.76 1.81 1.93 2.09 1.35 1.23 1.38 1.63 4 . 00 2.88 1.90 1.83 1.86 1.99 2.09 1.40 1.27 1.38 1.65 1.26 1.00 1.00 1.02 1.14 5 . 00 2.32 1.64 1.51 1.62 1.77 1.73 1.04 1.02 1.04 1.23 1.41 1.01 1.00 1.00 1.00 6 . 00 1.99 1.30 1.18 1.28 1.49 1.51 1.00 1.00 1.00 1.04 1.22 1.00 1.00 1.00 1.00 7 . 00 1.75 1.06 1.03 1.09 1.25 1.35 1.00 1.00 1.00 1.00 1.08 1.00 1.00 1.00 1.00 8 . 00 1.57 1.04 1.00 1.02 1.09 1.22 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 31 T able 7: Collab orativ e team A TS p erformance for DEWMA ν,t with n Ω t = 6 Comm unication outbreaks in team of size 6 from a netw ork of size 100 λ 0.2 0.4 0.7 k 0.4 0.45 0.5 0.4 0.45 0.5 0.4 0.45 0.5 δ A TS 0 . 5 25.14 22.27 14.94 13.50 14.57 1 . 0 13.80 12.90 13.56 8.02 7.78 8.0 5.78 5.25 5.69 2 . 0 5.51 5.34 5.50 3.60 3.57 3.74 2.80 2.66 2.78 3 . 0 360 3.37 3.55 2.49 2.41 2.51 1.99 1.92 1.97 4 . 0 2.75 2.55 2.63 1.99 1.91 1.98 1.65 1.60 1.61 5 . 0 2.23 2.12 2.20 1.71 1.61 1.69 1.15 1.14 1.20 6 . 0 1.98 1.91 1.94 1.42 1.38 1.40 1.01 1.01 1.03 7 . 0 1.75 1.71 1.75 1.19 1.18 1.18 1.00 1.00 1.00 8 . 0 1.58 1.51 1.54 1.04 1.03 1.03 1.00 1.00 1.00 32 T able 8: Collab orativ e team A TS p erformance for DEWMA ν,t with n Ω t = 7 Comm unication outbreaks in team of size 7 from a netw ork of size 100 λ 0.2 0.4 0.7 k 0.4 0.45 0.5 0.4 0.45 0.5 0.4 0.45 0.5 δ A TS 0 . 5 38.72 18.44 16.89 19.57 11.97 11.36 12.56 1 . 0 10.56 10.52 11.18 6.72 6.66 7.42 4.78 4.82 5.57 2 . 0 4.67 4.61 4.90 3.20 3.19 3.44 2.44 2.46 2.76 3 . 0 3.12 3.09 3.21 2.26 2.18 2.36 1.84 1.86 1.96 4 . 0 2.43 2.35 2.47 1.85 1.85 1.91 1.33 1.29 1.60 5 . 0 1.96 1.93 1.99 1.45 1.45 1.60 1.04 1.04 1.20 6 . 0 1.83 1.73 1.81 1.17 1.14 1.33 1.01 1.00 1.04 7 . 0 1.59 1.54 1.62 1.04 1.03 1.13 1.00 1.00 1.00 8 . 0 1.36 1.32 1.40 1.00 1.00 1.04 1.00 1.00 1.00 33 T able 9: Collab orativ e team A TS p erformance for DEWMA ν,t with n Ω t = 8 Comm unication outbreaks in team of size 7 from a netw ork of size 100 λ 0.2 0.4 0.7 k 0.4 0.45 0.5 0.4 0.45 0.5 0.4 0.45 0.5 δ A TS 0 . 25 32.18 35.76 37.24 0 . 5 32.78 32.88 33.92 15.66 15.29 16.32 10.07 10.16 10.34 1 . 0 9.54 9.64 10.26 6.09 6.20 6.32 4.36 4.24 4.62 2 . 0 4.14 4.17 4.32 2.84 2.90 3.02 2.42 2.31 2.35 3 . 0 2.78 2.74 2.94 2.01 2.03 2.14 1.70 1.68 1.76 4 . 0 2.12 2.10 2.35 1.66 1.65 1.78 1.21 1.19 1.28 5 . 0 1.86 1.86 1.90 1.32 1.28 1.40 1.01 1.01 1.02 6 . 0 1.68 1.63 1.71 1.05 1.04 1.09 1.00 1.00 1.00 7 . 0 1.37 1.36 1.50 1.00 1.00 1.01 1.00 1.00 1.00 34 T able 10: Collab orativ e team A TS p erformance for DEWMA ν,t with n Ω t = 9 Comm unication outbreaks in team of size 9 from a netw ork of size 100 λ 0.2 0.4 0.7 k 0.4 0.45 0.5 0.4 0.45 0.5 0.4 0.45 0.5 δ A TS 0 . 25 54.90 48.93 52.01 28.93 26.74 29.78 0 . 5 22.27 21.86 25.7 14.26 13.10 14.06 8.87 8.94 9.33 1 . 0 8.47 8.14 9.05 5.51 5.38 5.76 3.91 4.04 4.16 2 . 0 3.81 3.80 3.96 2.73 2.60 2.84 2.14 2.15 2.19 3 . 0 2.59 2.59 2.84 1.94 1.91 2.01 1.52 1.58 1.70 4 . 0 2.04 2.04 2.13 1.48 1.48 1.68 1.04 1.10 1.13 5 . 0 1.80 1.79 1.86 1.19 1.19 1.26 1.00 1.00 1.00 6 . 0 1.49 1.48 1.62 1.03 1.03 1.02 1.00 1.00 1.00 7 . 0 1.25 1.19 1.32 1.00 1.00 1.00 1.00 1.00 1.00 8 . 0 1.09 1.06 1.10 1.00 1.100 1.00 1.00 1.00 1.00 35 T able 11: Dominan t leader team outbreaks inv olving teams of size 6 to 9 DEWMA GEWMA DEWMA GEWMA λ 0.2 0.4 n Ω 6 7 8 9 6 7 8 9 6 7 8 9 6 7 8 9 k 0.45 0.6 0.45 0.6 δ A TS 0 . 25 62.66 54.82 98.60 83.27 0 . 50 49.48 39.94 34.19 33.78 72.00 63.46 44.72 39.01 27.42 22.54 20.24 15.94 32.74 24.59 21.99 17.97 1 . 00 15.99 13.19 11.29 10.51 16.91 14.32 13.24 11.44 9.99 8.49 7.27 6.59 9.03 8.42 7.42 6.73 2 . 00 6.26 5.65 5.09 4.62 6.27 5.68 5.43 4.65 4.29 3.86 3.46 3.16 4.18 3.73 3.67 3.16 3 . 00 4.25 3.77 3.31 2.39 4.17 3.68 3.48 3.00 2.90 2.56 2.42 2.19 2.83 2.59 2.42 2.21 4 . 00 3.20 2.83 2.62 1.73 3.18 2.73 2.66 2.38 2.28 2.09 1.90 1.70 2.17 2.06 1.92 1.79 5 . 00 2.66 2.28 2.11 1.32 2.55 2.39 2.22 1.95 1.94 1.70 1.56 1.36 1.84 1.71 1.59 1.42 6 . 00 2.16 2.00 1.64 1.06 2.19 2.06 1.86 1.74 1.65 1.48 1.32 1.16 1.61 1.48 1.30 1.18 7 . 00 1.89 1.78 1.43 1.00 2.01 1.72 1.67 1.52 1.43 1.29 1.10 1.04 1.34 1.29 1.13 1.07 8 . 00 1.64 1.36 1.24 1.00 1.70 1.61 1.48 1.35 1.22 1.04 1.01 1.00 1.17 1.06 1.00 1.00 36 T able 12: Dominan t leader team outbreaks inv olving teams of size 6 to 9 DEWMA GEWMA λ 0.7 n Ω 6 7 8 9 6 7 8 9 k 0.45 0.6 δ A TS 0 . 25 53.61 46.84 40.94 33.88 98.12 80.02 67.48 44.12 0 . 50 16.95 13.82 12.72 10.51 18.12 15.48 14.72 10.94 1 . 00 6.77 6.01 5.25 4.62 6.38 5.88 5.47 4.81 2 . 00 3.28 2.90 2.66 2.38 3.04 2.84 2.74 2.46 3 . 00 2.28 2.03 1.93 1.73 2.17 1.98 2.00 1.83 4 . 00 1.82 1.70 1.51 1.32 1.76 1.66 1.56 1.39 5 . 00 1.53 1.21 1.16 1.06 1.40 1.31 1.19 1.09 6 . 00 1.23 1.09 1.02 1.00 1.13 1.01 1.01 1.00 7 . 00 1.02 1.00 1.00 1.00 1.02 1.00 1.00 1.00 37 T able 13: The ADEWMA plans for heterogeneous netw orks with no outbreak m L m H Threshold A djustment A TS a 100 135 1.005 102.9 -0.0030 115 135 1.0037 103.1 -0.0030 110 150 0.982 104.0 -0.0060 130 150 0.984 102.2 -0.0060 100 175 0.984 100.9 -0.0050 115 175 0.984 102.2 -0.0050 135 175 0.982 103.3 -0.0050 155 175 0.982 101.6 -0.0050 135 250 0.985 99.4 -0.0035 200 250 0.983 102.4 -0.0035 150 275 0.985 100.9 -0.0030 215 275 0.985 103.6 -0.0030 305 315 0.981 101.6 -0.0027 250 350 0.986 99.3 -0.0025 38 References A Morgan, K. and W. W Shelley (2014). Juvenile street gangs. The Encyclop e dia of Crim- inolo gy and Criminal Justic e . Aiello, W., F. Chung, and L. Lu (2000). A random graph mo del for massive graphs. In Pr o c e e dings of the thirty-se c ond annual A CM symp osium on The ory of c omputing , pp. 171–180. A cm. Ak oglu, L. and C. F aloutsos (2013). Anomaly , even t, and fraud detection in large net w ork datasets. In Pr o c e e dings of the sixth A CM international c onfer enc e on W eb se ar ch and data mining , pp. 773–774. ACM. Azarnoush, B., K. Pa ynabar, J. Bekki, and G. Runger (2016). Monitoring temp oral homo- geneit y in attributed netw ork streams. Journal of Quality T e chnolo gy 48 (1), 28–43. Barab´ asi, A.-L. and R. Alb ert (1999). Emergence of scaling in random net works. Sci- enc e 286 (5439), 509–512. Bartlett, M. (1936). The square ro ot transformation in analysis of v ariance. Supplement to the Journal of the R oyal Statistic al So ciety 3 (1), 68–78. Capizzi, G. and G. Masarotto (2003). An adaptive exp onentially weigh ted moving av erage con trol chart. T e chnometrics 45 (3), 199–207. Carley , K. M., J. Pfeffer, H. Liu, F. Morstatter, and R. Go olsby (2013). Near real time assessmen t of so cial media using geo-temp oral netw ork analytics. In A dvanc es in So cial Networks A nalysis and Mining (ASONAM), 2013 IEEE/A CM International Confer enc e on , pp. 517–524. IEEE. Chau, D. H., S. Pandit, and C. F aloutsos (2006). Detecting fraudulen t p ersonalities in net w orks of online auctioneers. In K now le dge Disc overy in Datab ases: PKDD 2006 , pp. 103–114. Springer. Erd¨ os, P . and A. R´ en yi (1960). { On the evolution of random graphs } . Public ations of the Mathematic al Institute of Hungarian A c ademy of Scienc es 5 , 17–61. 39 Gan, F. (1993). Exp onentially w eighted mo ving a v erage con trol c harts with reflecting bound- aries. Journal of statistic al c omputation and simulation 46 (1-2), 45–67. Golden b erg, A., A. X. Zheng, S. E. Fien b erg, and E. M. Airoldi (2010). A surv ey of statistical net w ork mo dels. F oundations and T r ends R  in Machine L e arning 2 (2), 129–233. Heard, N. A., D. J. W eston, K. Platanioti, and D. J. Hand (2010). Ba yesian anomaly detection metho ds for so cial net w orks. The A nnals of Applie d Statistics 4 (2), 645–662. Kim, Y. and M. O‘ Kelly (2008). A b o otstrap based space–time surv eillance mo del with an application to crime o ccurrences. Journal of Ge o gr aphic al Systems 10 (2), 141–165. Krebs, V. E. (2002). Mapping netw orks of terrorist cells. Conne ctions 24 (3), 43–52. Lancic hinetti, A., F. Radicchi, and J. Ramasco (2010). Statistical significance of communities in net works. Physic al R eview E 81 (4), 046110. Liu, X., J. Bollen, M. L. Nelson, and H. V an de Somp el (2005). Co-authorship net works in the digital library research communit y . Information pr o c essing & management 41 (6), 1462–1480. Mo o dy , J. and P . J. Mucha (2013). P ortrait of p olitical party p olarization. Network Sci- enc e 1 (01), 119–121. Naka y a, T. and K. Y ano (2010). Visualising crime clusters in a space-time cub e: An ex- ploratory data-analysis approach using space-time kernel densit y estimation and scan statistics. T r ansactions in GIS 14 (3), 223–239. Neill, D. B. (2009). Exp ectation-based scan statistics for monitoring spatial time series data. International Journal of F or e c asting 25 (3), 498–517. P andit, S., D. H. Chau, S. W ang, and C. F aloutsos (2007). Netprob e: a fast and scalable sys- tem for fraud detection in online auction netw orks. In Pr o c e e dings of the 16th international c onfer enc e on W orld Wide W eb , pp. 201–210. ACM. P ark er, K. S., J. D. Wilson, J. Marschall, P . J. Muc ha, and J. P . Henderson (2015). Netw ork analysis reveals sex-and an tibiotic resistance-asso ciated antivirulence targets in clinical uropathogens. A CS Infe ctious Dise ases 1 (11), 523–532. 40 P eel, L. and A. Clauset (2014). Detecting c hange p oin ts in the large-scale structure of ev olving netw orks. arXiv pr eprint arXiv:1403.0989 . P orter, M. D. and G. White (2012). Self-exciting hurdle mo dels for terrorist activit y . The A nnals of A pplie d Statistics 6 (1), 106–124. Prusiewicz, A. (2008). A multi-agen t system for computer netw ork security monitoring. In A gent and Multi-A gent Systems: T e chnolo gies and Applic ations , pp. 842–849. Springer. Rae, N. C. (1989). The De cline and F al l of the Lib er al R epublic ans: fr om 1952 to the Pr esent . Oxford Univ ersity Press, USA. Reid, E., J. Qin, Y. Zhou, G. Lai, M. Sageman, G. W eimann, and H. Chen (2005). Collecting and analyzing the presence of terrorists on the web: A case study of jihad w ebsites. In Intel ligenc e and se curity informatics , pp. 402–411. Springer. Sa v age, D., X. Zhang, X. Y u, P . Chou, and Q. W ang (2014). Anomaly detection in online so cial net w orks. So cial Networks 39 , 62–70. Smith, R. N. (2014). On his own terms: A life of Nelson Ro ckefel ler . Random House. Sparks, R. and E. P atric k (2014). Detection of m ultiple outbreaks using spatio- temp oral ewma-ordered statistics. Communic ations in Statistics-Simulation and Com- putation 43 (10), 2678–2701. Sparks, R. S., T. Keighley , and D. Muscatello (2009). Improving EWMA plans for detecting un usual increases in Poisson counts. A dvanc es in De cision Scienc es 2009 . Sparks, R. S., T. Keighley , and D. Muscatello (2010). Early w arning CUSUM plans for surv eillance of negative binomial daily disease coun ts. Journal of A pplie d Statistics 37 (11), 1911–1929. T an, K. M., P . London, K. Mohan, S.-I. Lee, M. F azel, and D. Witten (2014). Learning graphical mo dels with h ubs. The Journal of Machine L e arning R ese ar ch 15 (1), 3297– 3331. 41 W eiß, C. H. (2007). Controlling pro cesses of p oisson counts. Quality and r eliability engi- ne ering international 23 (6), 741–754. W eiß, C. H. (2009). EWMA monitoring of correlated pro cesses of Poisson coun ts. Quality T e chnolo gy and Quantitative Management 6 (2), 137–153. Wilson, J., S. Bhamidi, and A. Nob el (2013). Measuring the statistical significance of lo cal connections in directed net w orks. Neur al Information Pr o c essing Systems: F r ontiers of Network A nalysis: Metho ds, Mo dels and A pplic ations . Wilson, J. D., N. T. Stevens, and W. H. W o o dall (2016). Mo deling and estimating change in temp oral net w orks via a dynamic degree corrected sto chastic blo c k mo del. arXiv pr eprint arXiv:1605.04049 . Wilson, J. D., S. W ang, P . J. Muc ha, S. Bhamidi, and A. B. Nob el (2014). A testing based extraction algorithm for identifying significant communities in netw orks. The A nnals of A pplie d Statistics 8 (3), 1853–1891. W o o dall, W. H., M. Zhao, K. Pa ynabar, R. Sparks, and J. D. Wilson (2016). An o v erview and p ersp ectiv e on so cial netw ork monitoring. IIE T r ansactions , In press. arXiv preprint Zeng, D., W. Chang, and H. Chen (2004). A comparative study of spatio-temp oral hotsp ot analysis tec hniques in security informatics. In Intel ligent T r ansp ortation Systems, 2004. Pr o c e e dings. The 7th International IEEE Confer enc e on , pp. 106–111. IEEE. Zhao, Y., E. Levina, and J. Zhu (2011). Comm unity extraction for so cial netw orks. Pr o c e e d- ings of the National A c ademy of Scienc es 108 (18), 7321–7326. Zhou, Q., C. Zou, Z. W ang, and W. Jiang (2012). Lik eliho o d-based EWMA c harts for monitoring p oisson coun t data with time-v arying sample sizes. Journal of the A meric an Statistic al A sso ciation 107 (499), 1049–1062. 42