Discovering and Explaining Abnormal Nodes in Semantic Graphs

Abstract—An important problem in the area of homeland security is to identify abnormal or suspicious entities in large datasets. Although there are methods from data mining and social network analysis focusing on finding patterns or central nodes from networks or numerical datasets, there has been little work aimed at discovering abnormal instances in large and complex semantic graphs, whose nodes are richly connected with many different types of links. In this paper, we describe a novel unsupervised framework to identify such instances. Besides discovering abnormal instances, we believe that to complete the process, a system has to also provide users with understandable explanations for its findings. Therefore, in the second part of the paper we describe an explanation mechanism to automatically generate human-understandable explanations for the discovered results. To evaluate our discovery and explanation systems, we perform experiments on several different semantic graphs. The results show that our discovery system outperforms state-ofthe-art unsupervised network algorithms used to analyze the 9/11 terrorist network and other graph-based outlier detection algorithm by a significant margin. Additionally, the human study we conducted demonstrates that our explanation system, which provides natural language explanations for the system’s findings, allowed human subjects to perform complex data analysis in a much more efficient and accurate manner. Index Terms—Anomaly detection, data mining, knowledge and data engineering tools and techniques, semantic graphs. I