Intelligent Data Analytics for Terror Threat Prediction. Группа авторов

It is observed that complete observation gives better results to provide knowledge about states of nodes but works only in small scale networks [39] not in large scale network. To overcome this problem another model is used called as snapshot observation.

1.5.1.2.2 Snapshot Observation

It provides limited information about states of nodes in network at given time interval. To avoid this problem, instead of one or two snapshots, taking multiple snapshots will give better knowledge about nodes in different time intervals. Disadvantages of taking multiple snapshots may consume much time, and although it provides correct information about lone contaminated nodes, it cannot distinguish between recovered or susceptible [37]. So it is difficult to understand about nodes in these states i.e. either they received rumor and ignored it or not received yet.

Figure 1.7 Network topology.

1.5.1.2.3 Monitor Observation

      Monitor observation means monitoring the network by inserting monitor or sensor nodes in it which works as an observer in network [36]. These sensor nodes gather information about states of nodes and pass this to administrator. The administrator will maintain all gathered data about each node state in a database. But there is chance of missing information in monitor observation as sensor nodes are inserted in a few places of network. Also, there may be a loss of information about some nodes where sensor nodes are not available. Due to unavailability of information of some nodes in network it reduces the accuracy of system, as system is based on number of nodes. If number of nodes increases then accuracy may increase but reduces performance of system due heavy load on network.

      These are three types of network observations which help to understand states of nodes and network structure. Network topology and network observation both are used to understand the structure of network. Network structure is one of the best factors that are considered in source identification. Other factors also considered are diffusion model which is mandatory in source identification as discussed in Section 1.5.2.

1.5.2 Diffusion Models

      Diffusion models are also one of the factors considered in source identification as they give information about how fast information diffusion occurs in network [2]. There are four diffusion models namely susceptibleinfected (SI), susceptible-infected-susceptible (SIS), susceptible-infectedrecovered (SIR), and susceptible-infected-recovered-susceptible (SIRS). All these come under epidemic models, which can spread deceases widely from person to other or group of people. These epidemic models are discussed in the following section as well as how they spread and the differences between them.

       1.5.2.1 SI Model

SI model is one of the oldest epidemic models where S stands for susceptible and I for infected. Initially, for complex networks SI model was proposed by Ref. [12]. If complex networks use SI model then state of nodes is either susceptible or infected. Once a node is infected it could remain in same state throughout life as shown in Figure 1.8. But this model is not practical. There is little chance that a susceptible infected node can be recovered and again in future. In social networks once rumor is received by any user, he/she believes it at that particular time and in the future they may know the truth and recover from it, which is not possible in SI model. The models SIS, SIR and SIRS deal with this issue and these models are discussed in the succeeding sections.

Figure 1.8 SI model.

       1.5.2.2 SIS Model

The SI model is not practically applicable, as it doesn’t allow infected users to be recovered. The SIS model addresses this problem [13, 14], and focuses on number of persons infected and number of persons cured as well. Once anyone is infected they may be cured and become susceptible in the future. Figure 1.9 explains the same problem where susceptibility of infection is possible [38]. In social networks once a rumor is received by a user he/she may believe or ignore as they knew fact and can become susceptible in the future.

       1.5.2.3 SIR Model

      SIR model is one of the simplest diffusion models. It has three states where S stands for number of susceptible, I for number of infectious, and R for number of recovered or removed. Total number of people is considered collectively from these three states susceptible, infected, and recovered [15].

Figure 1.9 SIS model.

Figure 1.10 SIR model.

In social networks, once rumor is diffused and received by any user he/she becomes infectious if doesn’t know truth about rumor. If they knew truth, he/she recover by ignoring rumor or not passing to neighbors. This is ignored in SI and SIS models. Recovery from rumors is only between SIR and SIS models. Figure 1.10 shows how users are transforming from one state to other.

       1.5.2.4 SIRS Model

      In SIR model once a person recovered from disease he/she remains in same state in future. In general once a person is cured from any disease there is chance that they may be reinfected with same decease in future, which is ignored in SIR model. SIRS model addresses this problem where once a person is infected and have recovered by having immunity or medical treatment, they couldn’t be in same recovered state in future. After recovery, there is possibility that again infected by same decease [16].

In social networks, once a rumor is diffused and received by any user, if believed, user is infected; otherwise if fact is known about rumor, user recovers by ignoring or not passing to neighbors. There is possibility that this recovered node again will be reinfected in the future on social networks. For further details see Figure 1.11.

      All these diffusion models are explained in Ref. [41]. There are independent cascade models to find rumor sources by analyzing network diffusion in reverse direction [42].

Figure 1.11 SIRS model.

      1.5.3 Centrality Measures