Acar Tamersoy

Understanding variations in pediatric asthma care processes in the emergency department using visual analytics

Health care delivery processes consist of complex activity sequences spanning organizational, spatial, and temporal boundaries. Care is human-directed so these processes can have wide variations in cost, quality, and outcome making systemic care process analysis, conformance testing, and improvement challenging. We designed and developed an interactive visual analytic process exploration and discovery tool and used it to explore clinical data from 5784 pediatric asthma emergency department patients.

Generating Graph Snapshots from Streaming Edge Data

We study the problem of determining the proper aggregation granularity for a stream of time-stamped edges. Such streams are used to build time-evolving networks, which are subsequently used to study topics such as network growth. Currently, aggregation lengths are chosen arbitrarily, based on intuition or convenience. We describe ADAGE, which detects the appropriate aggregation intervals from streaming edges and outputs a sequence of structurally mature graphs. We demonstrate the value of ADAGE in automatically finding the appropriate aggregation intervals on edge streams for belief propagation to detect malicious files and machines.

Large-scale insider trading analysis: patterns and discoveries

How do company insiders trade? Do their trading behaviors differ based on their roles (e.g., chief executive officer vs. chief financial officer)? Do those behaviors change over time (e.g., impacted by the 2008 market crash)? Can we identify insiders who have similar trading behaviors? And what does that tell us? This work presents the first academic, large-scale exploratory study of insider filings and related data, based on the complete Form 4 fillings from the U.S. Securities and Exchange Commission. We analyze 12 million transactions by 370 thousand insiders spanning 1986–2012, the largest reported in academia. We explore the temporal and network-based aspects of the trading behaviors of insiders, and make surprising and counterintuitive discoveries. We study how the trading behaviors of insiders differ based on their roles in their companies, the types of their transactions, their companies’ sectors, and their relationships with other insiders. Our work raises exciting research questions and opens up many opportunities for future studies. Most importantly, we believe our work could form the basis of novel tools for financial regulators and policymakers to detect illegal insider trading, help them understand the dynamics of the trades, and enable them to adapt their detection strategies toward these dynamics.

Visual Graph Query Construction and Refinement

Locating and extracting subgraphs from large network datasets is a challenge in many domains, one that often requires learning new querying languages. We will present the first demonstration of VISAGE, an interactive visual graph querying approach that empowers analysts to construct expressive queries, without writing complex code (see our video: https://youtu.be/l2L7Y5mCh1s). VISAGE guides the construction of graph queries using a data-driven approach, enabling analysts to specify queries with varying levels of specificity, by sampling matches to a query during the analysts interaction. We will demonstrate and invite the audience to try VISAGE on a popular film-actor-director graph from Rotten Tomatoes.

Inside insider trading: patterns & discoveries from a large scale exploratory analysis

How do company insiders trade? Do their trading behaviors differ based on their roles (e.g., CEO vs. CFO)? Do those behaviors change over time (e.g., impacted by the 2008 market crash)? Can we identify insiders who have similar trading behaviors? And what does that tell us? This work presents the first academic, large-scale exploratory study of insider filings and related data, based on the complete Form 4 fillings from the U.S. Securities and Exchange Commission (SEC). We analyzed 12 million transactions by 370 thousand insiders spanning 1986 to 2012, the largest reported in academia. We explore the temporal and network-centric aspects of the trading behaviors of insiders, and make surprising and counter-intuitive discoveries. We study how the trading behaviors of insiders differ based on their roles in their companies, the transaction types, the company sectors, and their relationships with other insiders. Our work raises exciting research questions and opens up many opportunities for future studies. Most importantly, we believe our work could form the basis of novel tools for financial regulators and policymakers to detect illegal insider trading, help them understand the dynamics of the trades and enable them to adapt their detection strategies towards these dynamics.

VIGOR: Interactive Visual Exploration of Graph Query Results

Finding patterns in graphs has become a vital challenge in many domains from biological systems, network security, to finance (e.g., finding money laundering rings of bankers and business owners). While there is significant interest in graph databases and querying techniques, less research has focused on helping analysts make sense of underlying patterns within a group of subgraph results. Visualizing graph query results is challenging, requiring effective summarization of a large number of subgraphs, each having potentially shared node-values, rich node features, and flexible structure across queries. We present VIGOR, a novel interactive visual analytics system, for exploring and making sense of query results. VIGOR uses multiple coordinated views, leveraging different data representations and organizations to streamline analysts sensemaking process. VIGOR contributes: (1) an exemplar-based interaction technique, where an analyst starts with a specific result and relaxes constraints to find other similar results or starts with only the structure (i.e., without node value constraints), and adds constraints to narrow in on specific results; and (2) a novel feature-aware subgraph result summarization. Through a collaboration with Symantec, we demonstrate how VIGOR helps tackle real-world problems through the discovery of security blindspots in a cybersecurity dataset with over 11,000 incidents. We also evaluate VIGOR with a within-subjects study, demonstrating VIGORs ease of use over a leading graph database management system, and its ability to help analysts understand their results at higher speed and make fewer errors.

Identifying Successful Investors in the Startup Ecosystem

Who can spot the next Google, Facebook, or Twitter? Who can discover the next billion-dollar startups? Measuring investor success is a challenging task, as investment strategies can vary widely. We propose InvestorRank, a novel method for identifying successful investors by analyzing how an investors collaboration network change over time. InvestorRank captures the intuition that a successful investor achieves increasingly success in spotting great startups, or is able to keep doing so persistently. Our results show potential in discovering relatively unknown investors that may be the success stories of tomorrow.

Interactive Querying over Large Network Data: Scalability, Visualization, and Interaction Design

Given the explosive growth of modern graph data, new methods are needed that allow for the querying of complex graph structures without the need of a complicated querying languages; in short, interactive graph querying is desirable. We describe our work towards achieving our overall research goal of designing and developing an interactive querying system for large network data. We focus on three critical aspects: scalable data mining algorithms, graph visualization, and interaction design. We have already completed an approximate subgraph matching system called MAGE in our previous work that fulfills the algorithmic foundation allowing us to query a graph with hundreds of millions of edges. Our preliminary work on visual graph querying, Graphite, was the first step in the process to making an interactive graph querying system. We are in the process of designing the graph visualization and robust interaction needed to make truly interactive graph querying a reality.

Analysis of Smoking and Drinking Relapse in an Online Community

Online communities and social media are known to play an important role in improving health efficacy and well-being. In this paper, we examine the role of such platforms in promoting smoking and drinking cessation. We focus on two support communities on Reddit, StopSmoking and StopDrinking, to analyze relapse events among several thousand individuals. For this purpose, we formulate and identify the key engagement and linguistic characteristics of abstainers and relapsers based on participation in the communities spanning almost nine years, and we employ a robust statistical methodology based on survival analysis to examine how participation and these characteristics relate to likelihood of relapse. Our results show that half of the population is at a high risk of relapse within 1-2 months of cessation attempts; however, individuals who continue to abstain beyond three years tend to maintain high likelihood of sustained abstinence. Furthermore, we find positive affect and increased social engagement to be predictors of abstinence. We discuss the implications of our work in tracking effectiveness of online health communities and for designing health interventions.

Smoke Detector: Cross-Product Intrusion Detection With Weak Indicators

The central task of a Security Incident and Event Manager (SIEM) or Managed Security Service Provider (MSSP) is to detect security incidents on the basis of tens of thousands of event types coming from many kinds of security products. We present Smoke Detector, which processes trillions of security events with the Random Walk with Restart (RWR) algorithm, inferring high order relationships between known security incidents and imperfect secondary security events (smoke) to find undiscovered security incidents (fire). By finding previously undetected incidents, Smoke Detectors RWR algorithm is able to increase the MSSPs critical incident count by 19% with a 1.3% FP rate. Perhaps equally importantly, our approach offers significant benefits beyond increased incident detection: (1) It provides a robust approach for leveraging Big Data sensor nets to increase adversarial resistance of protected networks; (2) Our event-scoring techniques enable efficient discovery of primary indicators of compromise; (3) Our confidence scores provide intuition and tuning capabilities for Smoke Detectors discovered security incidents, aiding incident display and response.