AugSplicing: Synchronized Behavior Detection in Streaming Tensors
  How can we track synchronized behavior in a stream of time-stamped tuples,
such as mobile devices installing and uninstalling applications in the
lockstep, to boost their ranks in the app store? We model such tuples as
entries in a streaming tensor, which augments attribute sizes in its modes over
time. Synchronized behavior tends to form dense blocks (i.e. subtensors) in
such a tensor, signaling anomalous behavior, or interesting communities.
However, existing dense block detection methods are either based on a static
tensor, or lack an efficient algorithm in a streaming setting. Therefore, we
propose a fast streaming algorithm, AugSplicing, which can detect the top dense
blocks by incrementally splicing the previous detection with the incoming ones
in new tuples, avoiding re-runs over all the history data at every tracking
time step. AugSplicing is based on a splicing condition that guides the
algorithm (Section 4). Compared to the state-of-the-art methods, our method is
(1) effective to detect fraudulent behavior in installing data of real-world
apps and find a synchronized group of students with interesting features in
campus Wi-Fi data; (2) robust with splicing theory for dense block detection;
(3) streaming and faster than the existing streaming algorithm, with closely
comparable accuracy.
