Anna Sapienza

Non-Negative Tensor Factorization for Human Behavioral Pattern Mining in Online Games

Multiplayer online battle arena is a genre of online games that has become extremely popular. Due to their success, these games also drew the attention of our research community, because they provide a wealth of information about human online interactions and behaviors. A crucial problem is the extraction of activity patterns that characterize this type of data, in an interpretable way. Here, we leverage the Non-negative Tensor Factorization to detect hidden correlated behaviors of playing in a well-known game: League of Legends. To this aim, we collect the entire gaming history of a group of about 1000 players, which accounts for roughly 100K matches. By applying our framework we are able to separate players into different groups. We show that each group exhibits similar features and playing strategies, as well as similar temporal trajectories, i.e., behavioral progressions over the course of their gaming history. We surprisingly discover that playing strategies are stable over time and we provide an explanation for this observation.

Detecting Anomalies in Time-Varying Networks Using Tensor Decomposition

New data sources from sensor networks and Internet-of-Things applications promise a wealth of interaction data that can be naturally represented as time-varying networks. This brings forth new challenges for the identification and removal of time-varying graph anomalies that entail complex correlations of topological features and temporal activity patterns. Here we present an anomaly detection approach for temporal graph data, based on an iterative tensor decomposition and masking procedure. We test this approach using high-resolution social network data from wearable proximity sensors. The dataset includes metadata that allow to independently build a ground truth, used to validate the anomaly detection method. Our approach achieves high accuracy in identifying meso-scale network anomalies due to sensor wearing protocol, proving the practical viability of the method for a real-world application.

Early Warnings of Cyber Threats in Online Discussions

We introduce a system for automatically generating warnings of imminent or current cyber-threats. Our system leverages the communication of malicious actors on the darkweb, as well as activity of cyber security experts on social media platforms like Twitter. In a time period between September, 2016 and January, 2017, our method generated 661 alerts of which about 84% were relevant to current or imminent cyber-threats. In the paper, we first illustrate the rationale and workflow of our system, then we measure its performance. Our analysis is enriched by two case studies: the first shows how the method could predict DDoS attacks, and how it would have allowed organizations to prepare for the Mirai attacks that caused widespread disruption in October 2016. Second, we discuss the methods timely identification of various instances of data breaches.

DISCOVER: Mining Online Chatter for Emerging Cyber Threats

Widespread adoption of networking technologies has brought about tremendous economic and social growth, but also exposed individuals and organization to new threats from malicious cyber actors. Recent attacks by WannaCry and NotPetya ransomware crypto-worms, infected hundreds of thousands of computer systems world wide, compromising data and critical infrastructure. In order to limit their impact, it is, therefore, critical to detect---and even predict---cyber attacks before they spread. Here, we introduce DISCOVER, an early cyber threat warning system, that mines online chatter from cyber actors on social media, security blogs, and darkweb forums, to identify words that signal potential cyber attacks. We evaluate DISCOVER and find that it can identify terms related to emerging cyber threats with precision above

Extracting the multi-timescale activity patterns of online financial markets

80%

Individual performance in team-based online games

. DISCOVER also generates a time line of related online discussions on different Web sources that can be useful for analyzing emerging cyber threats.

Performance Dynamics and Success in Online Games

Online financial markets can be represented as complex systems where trading dynamics can be captured and characterized at different resolutions and time scales. In this work, we develop a methodology based on non-negative tensor factorization (NTF) aimed at extracting and revealing the multi-timescale trading dynamics governing online financial systems. We demonstrate the advantage of our strategy first using synthetic data, and then on real-world data capturing all interbank transactions (over a million) occurred in an Italian online financial market (e-MID) between 2001 and 2015. Our results demonstrate how NTF can uncover hidden activity patterns that characterize groups of banks exhibiting different trading strategies (normal vs. early vs. flash trading, etc.). We further illustrate how our methodology can reveal “crisis modalities” in trading triggered by endogenous and exogenous system shocks: as an example, we reveal and characterize trading anomalies in the midst of the 2008 financial crisis.

Estimating the outcome of spreading processes on networks with incomplete information: a mesoscale approach

Complex real-world challenges are often solved through teamwork. Of special interest are ad hoc teams assembled to complete some task. Many popular multiplayer online battle arena (MOBA) video-games adopt this team formation strategy and thus provide a natural environment to study ad hoc teams. Our work examines data from a popular MOBA game, League of Legends, to understand the evolution of individual performance within ad hoc teams. Our analysis of player performance in successive matches of a gaming session demonstrates that a player’s success deteriorates over the course of the session, but this effect is mitigated by the player’s experience. We also find no significant long-term improvement in the individual performance of most players. Modelling the short-term performance dynamics allows us to accurately predict when players choose to continue to play or end the session. Our findings suggest possible directions for individualized incentives aimed at steering the player’s behaviour and improving team performance.