key: cord-155440-7l8tatwq
authors: Malinovskaya, Anna; Otto, Philipp
title: Online network monitoring
date: 2020-10-19
journal: nan
DOI: nan
sha: 
doc_id: 155440
cord_uid: 7l8tatwq

The application of network analysis has found great success in a wide variety of disciplines; however, the popularity of these approaches has revealed the difficulty in handling networks whose complexity scales rapidly. One of the main interests in network analysis is the online detection of anomalous behaviour. To overcome the curse of dimensionality, we introduce a network surveillance method bringing together network modelling and statistical process control. Our approach is to apply multivariate control charts based on exponential smoothing and cumulative sums in order to monitor networks determined by temporal exponential random graph models (TERGM). This allows us to account for potential temporal dependence, while simultaneously reducing the number of parameters to be monitored. The performance of the proposed charts is evaluated by calculating the average run length for both simulated and real data. To prove the appropriateness of the TERGM to describe network data some measures of goodness of fit are inspected. We demonstrate the effectiveness of the proposed approach by an empirical application, monitoring daily flights in the United States to detect anomalous patterns.

The digital information revolution offers a rich opportunity for scientific progress; however, the amount and variety of data available requires new analysis techniques for data mining, interpretation and application of results to deal with the growing complexity. As a consequence, these requirements have influenced the development of networks, bringing their analysis beyond the traditional sociological scope into many other disciplines, as varied as are physics, biology and statistics (cf. Amaral et al. 2000; Simpson et al. 2013; Chen et al. 2019 ).

One of the main interests in network study is the detection of anomalous behaviour. There are two types of network monitoring, differing in the treatment of nodes and links: fixed and random network surveillance (cf. Leitch et al. 2019) . We concentrate on the modelling and monitoring of networks with randomly generated edges across time, describing a surveillance method of the second type. When talking about anomalies in temporal networks, the major interest is to find the point of time when a significant change happened and, if appropriate, to identify the vertices, edges or graph subsets which considerably contributed to the change (cf. Akoglu et al. 2014 ). Further differentiating depends on at least two factors: characteristics of the network data and available time granularity.

Hence, given a particular network to monitor it is worth first defining what is classified as "anomalous".

To analyse the network data effectively and plausibly, it is important to account for its complex structure and the possibly high computational costs. Our approach to mitigate these issues and simultaneously reflect the stochastic and dynamic nature of networks is to model them applying a temporal random graph model. We consider a general class of Exponential Random Graph Models (ERGM) (cf. Frank and Strauss 1986; Robins et al. 2007; Schweinberger et al. 2020) , which was originally designed for modelling cross-sectional networks. This class includes many prominent random network configurations such as dyadic independence models and Markov random graphs, enabling the ERGM to be generally applicable to many types of complex networks. Hanneke et al. (2010) developed a powerful dynamic extension based on ERGM, namely the Temporal Exponential Random Graph Model (TERGM). These models contain the overall functionality of the ERGM, additionally enabling time-dependent covariates. Thus, our monitoring procedure for this class of models allows for many applications in different disciplines which are interested in analysing networks of medium size, such as sociology, political science, engineering, economics and psychology (cf. Carrington et al. 2005; Ward et al. 2011; Das et al. 2013; Jackson 2015; Fonseca-Pedrero 2018) .

In the field of change detection, according to Basseville et al. (1993) there are three classes of problems: online detection of a change, off-line hypotheses testing and off-line estimation of the change time. Our method refers to the first class, meaning that the change point should be detected as soon as possible after it occurred. In this case, real-time monitoring of complex structures becomes necessary: for instance, if the network is observed every minute, the monitoring procedure should be faster than one minute. To perform online surveillance for real-time detection, the efficient way is to use tools from the field of Statistical Process Control (SPC). SPC corresponds to an ensemble of analytical tools originally developed for industrial purposes, which is applied for achievement of process stability and variability reduction (e.g., Montgomery 2012) .

The leading SPC tool for analysis is a control chart, which exists in various forms in terms of the number of variables, data type and different statistics being of interest. For example, the monitoring of network topology statistics applying the Cumulative Sum (CUSUM) chart and illustrating its effec- present a comparative study of univariate and multivariate EWMA for social network monitoring. An overview of further studies is provided by Noorossana et al. (2018) .

In this paper, we present an online monitoring procedure based on the SPC concept, which enables one to detect significant changes in the network structure in real time. The foundations of this approach together with the description of the selected network model and multivariate control charts are discussed in Section 2. Section 3 outlines the simulation study and includes performance evaluation of the designed control charts. In Section 4 we monitor daily flights in the United States and explain the detected anomalies. We conclude with a discussion of outcomes and present several directions for future research.

Network monitoring is a form of an online surveillance procedure to detect deviations from a so-called in-control state, i.e., the state when no unaccountable variation of the process is present. This is done by sequential hypothesis testing over time, which has a strong connection to control charts. In other words, the purpose of control charting is to identify occurrences of unusual deviation of the observed process from a prespecified target (or in-control) process, distinguishing common from special causes of variation (cf. Johnson and Wichern 2007) . To be precise, the aim is to test the null hypothesis H 0,t : The network observed at time point t is in its in-control state against the alternative H 1,t : The network observed at time point t deviates from its in-control state.

In this paper, we concentrate on monitoring of networks, which are modelled by the TERGM that is briefly described below.

The network (also interchangeably called "graph") is presented by its adjacency matrix Y := (Y i j ) i, j=1,...,N , where N represents the total number of nodes. Two vertices (or nodes) i, j are adjacent if they are connected by an edge (also called a tie or link). In this case, Y i j = 1, otherwise, Y i j = 0. In case of an undirected network, Y is symmetric. The connections of a node with itself are mostly not applicable to the majority of the networks, therefore, we assume that Y ii = 0 for all i = 1, . . . , N. Formally, we define a network model as a collection {P θ (Y ), Y ∈ Y : θ ∈ Θ}, where Y denotes the ensemble of possible networks, P θ is a probability distribution on Y and θ is a vector of parameters, ranging over possible values in the real-valued space Θ ⊆ IR p with p ∈ IN (Kolaczyk, 2009 ). This stochastic mechanism determines which of the N(N − 1) edges (in case of directed labelled graphs) emerge, i.e., it assigns probabilities to each of the 2 N(N−1) graphs (see Cannings and Penman, 2003) .

The ERGM functional representation is given by

where Y is the adjacency matrix of an observed graph with s : Y → IR p being a p-dimensional statistic describing the essential properties of network based on Y (cf. Frank, 1991; Wasserman and Pattison, 1996) . There are several types of network terms, including dyadic dependent terms, for example, a statistic capturing transitivity, and dyadic independent terms, for instance, a term describing graph density (Morris et al., 2008) . The parameters θ can be defined as respective coefficients of s(Y ) which are of considerable interest in understanding the structural properties of a network. They reflect, on the network-level, the tendency of a graph to exhibit certain sub-structures relative to what would be expected from a model by chance, or, on the tie-level, the probability to observe a specific edge, given the rest of the graph (Block et al., 2018) . The last interpretation follows from the representation of the problem as a log-odds ratio. The normalising constant in the denominator ensures that the sum of probabilities is equal to one, meaning it includes all possible network configurations

In dynamic network modelling, a random sequence of Y t for t = 1, 2, . . . with Y t ∈ Y defines a stochastic process for all t. It is possible that the dimensions of Y t differ across the time stamps.

To conduct surveillance over Y t , we propose to consider only the dynamically estimated parameters of a random graph model in order to reduce computational complexity and to allow for real-time monitoring. In most of the cases, the dynamic network models serve as an extension of well-known static models. Similarly, the discrete temporal expansion of the ERGM is known as TERGM (cf. Hanneke et al., 2010) and can be seen as further advancement of a family of network models proposed by Robins and Pattison (2001) .

The TERGM defines the probability of a network at the discrete time point t both as a function of counted subgraphs in t and by including the network terms based on the previous graph observations until the particular time point t − v, that is

where v represents the maximum temporal lag, capturing the networks which are incorporated into the θ estimation at t, hence, defining the complete temporal dependence of Y t . We assume the Markov structure between the observations, meaning (Y t ⊥ ⊥ {Y 1 , . . . , Y t−2 }|Y t−1 ) (Hanneke et al., 2010) . In this case, the network statistics s(·) include "memory terms" such as dyadic stability or reciprocity (Leifeld et al., 2018) .

The creation of a meaningful configuration of sufficient network statistics s(Y ) replicates its ability to represent and reproduce the observed network close to the reality. Its dimension can differ over the time, however, we assume that in each time stamp t we have the same network statistics s(·).

In general, the selection of terms extensively depends on the field and context, although the statistical modelling standards such as avoidance of linear dependencies among the terms should be also considered (Morris, Handcock, and Hunter, 2008 ). An improper selection can often lead to a degenerate model, i.e., when the algorithm does not converge consistently (cf. Handcock, 2003; Schweinberger, 2011) . In this case, as well as fine-tuning the configuration of statistics, one can modify some settings which design the estimation procedure of the model parameter, for example, the run time, the sample size or the step length (Morris et al., 2008) . Currently, there are two widely used approaches:

Chain Monte Carlo (MCMC) ML estimation (Leifeld et al., 2018) . Another possibility would be to add some robust statistics such as Geometrically-Weighted Edgewise Shared Partnerships (GWESP) (Snijders et al., 2006) . However, the TERGM is less prone to the degeneracy issues as ascertained by Leifeld and Cranmer (2019) and Hanneke et al. (2010) . Regarding the selection of network terms, we assume that most of the network surveillance studies can reliably estimate beforehand the type of anomalies which are possible to occur. This assumption guides the choice of terms in the models throughout the paper.

Let p be the number of network statistics, which describe the in-control state and can reflect the deviations in the out-of-control state. Thus, there are p variablesθ t = (θ 1t , . . . ,θ pt ) , namely the estimates of the network parameters θ at time point t. That is, we apply a moving window approach, where the coefficients are estimated at each time point t using the current and past z observed networks.

Moreover, let F θ 0 ,Σ be the target distribution of these estimates with θ 0 = E 0 (θ 1 , . . . ,θ p ) being the expected value and Σ the respective p × p variance-covariance matrix (Montgomery, 2012) . We also assume that the temporal dependence is fully captured by the past z observed networks. Thus,

where τ denotes a change point to be detected and θ = θ 0 . If τ = ∞ the network is set to be incontrol, whereas it is out of control in the case of τ ≤ t < ∞. Furthermore, we assume that the estimation precision of the parameters does not change across t, i.e., Σ is constant for the in-control and out-of-control state. Hence, the monitoring procedure is based on the expected values ofθ t . In fact, we can specify the above mentioned hypothesis as follows

Typically, a multivariate control chart consists of the control statistic depending on one or more characteristic quantities, plotted in time order, and a horizontal line, called the upper control limit (UCL) that indicates the amount of acceptable variation. A hypothesis H 0 is rejected if the control statistic is equal to or exceeds the value of the UCL. Hence, to perform monitoring a suitable control statistic and UCL are needed. Subsequently, we discuss several control statistics and present a method to determine the respective UCLs.

The strength of the multivariate control chart over the univariate control chart is the ability to monitor several interrelated process variables. It implies that the corresponding test statistic should take into account the correlations of the data, be dimensionless and scale-invariant, as the process variables can considerably differ from each other. The squared Mahalanobis distance, which represents the general form of the control statistic, fulfils these criteria and is defined as

being the part of the respective "data depth" expression -Mahalanobis depth that measures a deviation from an in-control distribution (cf. Liu, 1995) . Hence, D

(1) t maps the p-dimensional characteristic quantityθ t to an one-dimensional measure. It is important to note that the characteristic quantity at time point t is usually the mean of several samples at t, but in our case, we only observe one network at each instant of time. Thus, the characteristic quantityθ t is the value of the obtained estimates and not the average of several samples.

Firstly, multivariate CUSUM (MCUSUM) charts (cf. Woodall and Ncube, 1985; Joseph et al. (1990) ; Ngai and Zhang, 2001 ) may be used for network monitoring. One of the widely used version was proposed by Crosier (1988) and is defined as follows

where

given that r 0 = 0 and k > 0. The respective chart statistic is

and it signals if D

(2) t is greater than or equals the UCL. Certainly, the values k and UCL considerably influence the performance of the chart. The parameter k, also known as reference value or allowance, reflects the variation tolerance, taking into consideration δ -the deviation from the mean measured in the standard deviation units we aim to detect. According to Page (1954) and Crosier (1988) , the chart is approximately optimal if k = δ /2.

Secondly, we consider multivariate charts based on exponential smoothing (EWMA). Lowry et al. (1992) proposed a multivariate extension of the EWMA control chart (MEWMA), which is defined as follows

with the 0 < λ ≤ 1 and l 0 = 0 (cf. Montgomery, 2012) . The corresponding chart statistic is

where the covariance matrix is defined as

Together with the MCUSUM, the MEWMA is an advisable approach for detecting relatively small but persistent changes. However, the detection of large shifts is also possible by setting k or λ high.

For instance, in case of the MEWMA with λ = 1, the chart statistic coincides with D

(1) t . Thus, it is equivalent to the Hotelling's T 2 control procedure, which is suitable for detection of substantial deviations. It is worth to mention that the discussed methods are directionally invariant, therefore, the investigation of the data at the signal time point is necessary if the change direction is of particular interest.

is equal to or exceeds the UCL, it means that the charts signal a change. To determine the UCLs, one typically assumes that the chart has a predefined (low) probability of false alarms, i.e., signals when the process is in control, or a prescribed in-control Average Run Length ARL 0 , i.e., the number of expected time steps until the first signal. To compute the UCLs corresponding to ARL 0 , a prevalent number of multivariate control charts require a normally distributed target process (cf. Johnson and Wichern, 2007; Porzio and Ragozini, 2008; Montgomery, 2012) . In our case, this assumption would need to be valid for the estimates of the network model parameters.

However, while there are some studies on the distributions of particular network statistics (cf. Yan and Xu, 2013; Yan et al., 2016; Sambale and Sinulis, 2018) , only a few results are obtained about the distribution of the parameter estimates. Primarily, the difficulties to determine the distribution is that the assumption of i.i.d. (independent and identically distributed) data is violated in the ERGM case. In addition, the parameters depend on the choice of the model terms and network size (He and Zheng, 2015) . Kolaczyk and Krivitsky (2015) proved asymptotic normality for the ML estimates in a simplified context of the ERGM, pointing out the necessity to establish a deeper understanding of the distributional properties of parameter estimates. Thus, we do not rely on any distributional assumption, but determine the UCLs via Monte-Carlo simulations in Section 3.2.

To verify the applicability and effectiveness of the discussed approach, we design a simulation study followed by the surveillance of real-world data with the goal to obtain some insights into its temporal development.

In practice, the in-control parameters θ 0 and Σ are usually unknown and therefore have to be estimated. Thus, one subdivides the sequence of networks into Phase I and Phase II. In Phase I, the process must coincide with the in-control state. Thus, the true in-control parameters θ 0 and Σ can be estimated by the sample mean vectorθ and the sample covariance matrix S of the estimated parametersθ t in Phase I. Using these estimates, the UCL is determined via simulations of the in-control networks, as we will show in the following part.

It is important that the Phase I replicates the natural behaviour of a network, so that if the network constantly grows, then it is vital to consider this aspect in Phase I. Similarly, if the type of network is prone to stay unchangeable in terms of additive connections or topological structure, this fact should be captured in Phase I for reliable estimation and later network surveillance. After the necessary estimators of θ 0 , Σ and the UCL are obtained, the calibrated control chart is applied to the actual data in Phase II. In specific cases of the constantly growing/topologically changing networks, we recommend to recalibrate the control chart after the length of ARL 0 to guarantee a trustworthy detection of the outliers.

To be able to computeθ and S, we need a certain number of in-control networks. For this purpose, we generate 2300 temporal graph sequences of desired length T < τ, where each graph consists of N = 100 nodes. The parameter τ defines the time stamp when an anomalous change is implemented.

The simulation of synthetic networks is based on the Markov chain principle: in the beginning, a network which is called the "base network" is simulated by applying an ERGM with predefined network terms, so that it is possible to control the "network creation" indirectly. In our case, we select three network statistics, namely an edge term, a triangle term and a parameter that defines asymmetric dyads. Subsequently, a fraction φ of elements of the adjacency matrix are randomly selected and set where m i j,0 denotes the probability of a transition from i to j in the in-control state. Next, we need to guarantee that the generated samples of networks behave according to the requirements of Phase I, i.e., capturing only the usual variation of the target process. For this purpose, we can exploit Markov chain properties and calculate its steady state equilibrium vector π, as it follows that the expected number of edges and non-edges is given by π. Using eigenvector decomposition, we find the steady state to be π = (0.8, 0.2) . Consequently, the expected number of edges in the graph in its steady state is 1980. There are several possibilities to guarantee a generation of appropriate networks. In our case, we simulate 400 networks in a burn-in period, such that the in-control state of Phase I starts at t = 401. Nevertheless, the network density is only one of the aspects to define the in-control process, as the temporal development and the topology are also involved in the network creation.

Each network in time point Y t is simulated from the network Y t−1 by repeating the steps described above. After the generation stage, the coefficients of the network statistics and of an additional term which describes the stability of both edges and non-edges over time with v = 1 are estimated by applying a TERGM with a certain window size z. The chosen estimation method is the bootstrap MPLE which is appropriate to handle a relatively large number of nodes and time points (Leifeld et al., 2018) . Eventually, we calibrate different control charts by computingθ, S, and the respective UCL via the bisection method. For two window sizes z = {7, 14}, Table 1 

In the next step, we analyse the performance of the proposed charts in terms of their detection speed.

For this reason, we generate samples from Phase II, where t ≥ τ. The focus is on the detection of mean shifts, which are driven by an anomalous change in following three parameters: the vector of coefficients related to network termsθ t , the fraction of the randomly selected adjacency matrix entries φ and the transition matrix M . Hence, we subdivide these scenarios into three different anomaly types which are briefly described in the chart flow presented in Figure 1 .

We define a Type 1 anomaly as a persistent change in the values of M . That is, there is a transition matrix M 1 = M 0 when t ≥ τ. Furthermore, we consider anomalies of Type 2 by introducing a new value φ 1 in the generation process when t ≥ τ. Anomalies of Type 3 differ from the previous two as it represents a "point change" -the abnormal behaviour occurs only at a single point of time but its outcome affects further development of the network. We recreate this type of anomalies by converting a fraction ζ of asymmetric edges into mutual links. This process happens at time point τ only. Afterwards, the new networks are created similar to Phase I by applying M 0 and φ 0 up until the anomaly is detected. All cases of different magnitude are summarised in Table 3 .

As a performance measure we calculate the conditional expected delay (CED) of detection, conditional on a false signal not having been occurred before the ( should be detected (Case 2.2, 2.3). Again, the reference/smoothing parameter should be chosen according to the expected shift size.

For changes of the proportion of mutual edges, anomalies of Type 3, the charts have different behaviour. First of all, the MEWMA chart outperforms in all cases except 3.1 and 3.2 with z = 14.

However, the Hotelling's chart functions clearly worse in the first two cases having a shorter window size. Thus, we would recommend choosing λ = 0.1 if the change in the network topology is relatively small as in Case 3.1. In the opposite case of a larger change, λ could be chosen higher depending on the expected size of the shift, so that the control statistic also incorporates previous values.

The disadvantage of both approaches is that small and persistent changes are not detected quickly when the parameters k or λ are not optimally chosen. For example, in Figure 2 , we can notice that the CED slightly exceeds the ARL 0 reflecting the poor performance. However, a careful selection of the parameters and the window size can overcome this problem.

To summarise, the effectiveness of the presented charts to detect structural changes depends significantly on the accurate estimation of the anomaly size one aims to detect. Thus, to ensure that no anomalies were missed, it can be effective to apply paired up charts and benefit from the strengths of each of them to detect varying types and sizes of anomalies, if the information on the possible change is not available or not reliable.

To demonstrate applicability of the described method, the daily flight data of the United States through territories which allow travelling. That means, instead of having a direct journey from one geographical point to another, currently the route passes through several locations, which can be interpreted as nodes. Thus, the topology of the graph has changed: instead of directed mutual links, the number of intransitive triads and asymmetric links start to increase significantly. We can incorporate both terms, together with the edge term and a memory term (v = 1), and expect the estimates of the respective coefficients belonging to the first two statistics to be close to zero or strongly negative in the in-control case.

Initially, we need to decide which data are suitable to define observations coming from Phase I, the estimates θ t of the TERGM described by a series of boxplots in Figure 6 , we can observe extreme changes in the values.

Before proceeding with the analysis, it is important to evaluate whether a TERGM fits the data well . For each of the years, we randomly selected one period of the length z and simulated 500 networks based on the parameter estimates from each of the corresponding networks. To select appropriate control charts, we need to take into consideration specifications of the flight network data. Firstly, it is common to have 3-4 travel peaks per year around holidays, which are not explicitly modelled, so that we can detect these changes as verifiable anomalous patterns.

It is worth noting that one could account for such seasonality by including nodal or edge covariates.

Secondly, as we aim to detect considerable deviations from the in-control state, we are more interested The horizontal red line corresponds to the upper control limit and the red points to the occurred signals.

in sequences of signals. Thus, we have chosen k = 1.5 for MCUSUM and λ = 0.9 for the MEWMA chart. The target ARL 0 is set to 100 days, therefore, we could expect roughly 3.65 in-control signals per year by construction of the charts. To identify smaller and more specific changes in the daily flight data of the US, one could also integrate nodal and edge covariates which would refer to further aspects of the network. Alternatively, control charts with smaller k and λ can be applied.

Statistical methods can be remarkably powerful for the surveillance of networks. However, due to the complex structure and possibly large size of the adjacency matrix, traditional tools for multivariate process control cannot directly be applied, but the network's complexity must be reduced first. For instance, this can be done by statistical modelling of the network. The choice of the model is crucial as it decides constraints and simplifications of the network which later influence the types of changes we are able to detect. In this paper, we show how multivariate control charts can be used to detect changes in TERGM networks. The proposed methods can be applied in real time. This general approach is applicable for various types of networks in terms of the edge direction and topology, as well as allows for the integration of nodal and edge covariates. Additionally, we make no assumptions on distribution and account for temporal dependence.

The performance of our procedure is evaluated for different anomalous scenarios by comparing the CED of the calibrated control charts. According to the classification and explanation of anomalies provided by Ranshous et al. (2015) , the surveillance method presented in this paper is applicable for event and point change detection in temporal networks. The difference between these problems lies in the duration of the abnormal behaviour: while change points indicate a time point when the anomaly is persistent until the next change point, events indicate short-term incidents, after that the network returns to its natural state.

Eventually, we illustrated the applicability of our approach by monitoring daily flights in the United States. Both control charts were able to detect the beginning of the lock-down period due to the COVID-19 pandemic. The MEWMA chart signalled a change just two days after a Level 4 "no travel" warning was issued.

Despite the benefits of the TERGM, such as incorporation of the temporal dimension and representation of the network in terms of its sufficient statistics, there are several considerable drawbacks.

Other than the difficulty to determine a suitable combination of the network terms, the model is not suitable for networks of large size (Block et al., 2018) . Furthermore, the temporal dependency statistics in the TERGM depend on the selected temporal lag and the size of the time window over which the data is modelled (Leifeld and Cranmer, 2019) . Thus, the accurate modelling of the network strongly relies on the analyst's knowledge about its nature. A helpful extension of the approach would be the implementation of the Separable Temporal Exponential Random Graph Model (STERGM) that subdivides the network changes into two distinct streams (cf. Krivitsky and Handcock, 2014; Fritz et al., 2020) . In this case, it could be possible to monitor the dissolution and formation of links separately, so that the interpretation of changes in the network would become clearer.

Regarding the multivariate control charts, there are also some aspects to consider. Referring to Montgomery (2012) , the multivariate control charts perform well if the number of process variables is not too large, usually up to 10. Also, a possible extension of the procedure is to design a monitoring process when the values for Σ can vary between the in-control and out-of-control states. Whether this factor would beneficially enrich the surveillance remains open for future research. In our case, we did not rely on any distributional assumptions of the parameters, but we used simulation methods to calibrate the charts. Hence, further development of adaptive control charts with different characteristics is interesting as they could remarkably improve the performance of the anomaly detection (cf. Sparks and Wilson, 2019).

Graph based anomaly detection and description: a survey

Classes of small-world networks

Detection of abrupt changes: theory and application

Change we can believe in: Comparing longitudinal network models on consistency, interpretability and predictive power

Models of random graphs and their applications

Models and methods in social network analysis

Tail event driven networks of SIFIs

Multivariate generalizations of cumulative sum quality-control schemes

The topological structure of the odisha power grid: a complex network analysis

A statistical approach to social network monitoring

Network analysis in psychology

Statistical analysis of change in networks

Markov graphs

Tempus volat, hora fugit: A survey of tie-oriented dynamic network models in discrete and continuous time

Assessing degeneracy in statistical models of social networks

Discrete temporal models of social networks

GLMLE: graph-limit enabled fast computation for fitting exponential random graph models to large social networks

Performance evaluation of EWMA and CUSUM control charts to detect anomalies in social networks using average and standard deviation of degree measures

Goodness of fit of social network models

The past and future of network analysis in economics

Applied multivariate statistical analysis, 6th edn

Comparisons of multivariate CUSUM charts

On assessing the performance of sequential procedures for detecting a change

Statistical analysis of network data

On the question of effective sample size in network modeling: An asymptotic inquiry. Statistical science: a

A separable model for dynamic networks

A theoretical and empirical comparison of the temporal exponential random graph model and the stochastic actor-oriented model

Temporal exponential random graph models with btergm: Estimation and bootstrap confidence intervals

Toward epidemic thresholds on temporal networks: a review and open questions

Control charts for multivariate processes

Analyzing dynamic change in social network based on distribution-free multivariate process control method

A multivariate exponentially weighted moving average control chart

Detecting change in longitudinal social networks

Statistical Quality Control

Specification of exponential-family random graph models: terms and computational aspects

Multivariate cumulative sum control charts based on projection pursuit

An overview of dynamic anomaly detection in social networks via control charts

Continuous inspection schemes

Multivariate control charts from a data mining perspective. Recent Advances in Data Mining of Enterprise Data

Anomaly detection in dynamic networks: a survey

Random graph models for temporal processes in social networks

An introduction to exponential random graph (p*) models for social networks

Monitoring of social network and change detection by applying statistical process: ERGM

Change point detection in social networks using a multivariate exponentially weighted moving average chart

Logarithmic Sobolev inequalities for finite spin systems and applications

Instability, sensitivity, and degeneracy of discrete exponential families

Exponential-family models of random graphs: Inference in finite-, super-, and infinite population scenarios

Analyzing complex functional brain networks: Fusing statistics and network science to understand the brain

New specifications for exponential random graph models

Monitoring communication outbreaks among an unknown team of actors in dynamic networks

Network analysis and political science

Logit models and logistic regressions for social networks: I. An introduction to markov graphs and p*

Modeling and detecting change in temporal networks via the degree corrected stochastic block model

Multivariate cusum quality-control procedures

A central limit theorem in the β -model for undirected random graphs with a diverging number of vertices

Asymptotics in directed exponential random graph models with an increasing bi-degree sequence