Post-Doctoral position in Anomaly Detection in Temporal Networks - 12 month contract

Job description

IMT Atlantique

1. Context

Présentation of IMT Atlantique :

IMT Atlantique, internationally recognized for the quality of its research, is a leading general engineering school under the authority of the Ministry of Industry and Digital Technologies, ranked in the 3 main international rankings (THE, SHANGAI, QS). With three campuses in Brest, Nantes and Rennes, IMT Atlantique aims to combine digital technology and energy to transform society and industry through training, research and innovation.

Job environment :

The project partners are the DECIDE and MOTEL teams of Lab-Sticc (UMR CNRS 6285).

The DECIDE team provides decision support solutions to decision makers faced with heterogeneous and complex data. These data - texts, signals, images, sensor flows, interactions in social networks, but also decision-making contexts, decision-makers' preferences, spatial decisions, and even previous decisions - are the starting point of DECIDE's research activities (data mining, decision support, operations research, information quality and fusion, data visualisation, etc.). The project is led by Cécile BOTHOREL and Laurent BRISSON, associate professors in Computer Science, specialising in the study of complex networks, community detection and their dynamics.

The MOTEL « MOdels and Tools for Enhanced Learning » team takes part of the research community EIAH (in French, Environnements Informatiques pour l’Apprentissage Humain”) - Computing Environments for Human Learning. MOTEL works on several subjects that contribute with computing human-centred tools, methods and models for Education using an experimental approach. Jean-Marie GILLIOT and Grégory SMITS, permanent members of the MOTEL team, will contribute to this project and bring their expertise on data analysis and especially anomaly detection.

2. Objective

In many applicative contexts, data can be modelled by temporal graphs, including interactions (between objects, between proteins, between individuals, etc.). Detecting anomalies in these graphs allows finding atypical or unusual behaviours, such as important and undesirable activity. In the case of messaging networks, regular users can be harmed by malicious messages, such as phishing, or by suspicious accounts.

Detecting anomalies automatically is a specific problem in that these deviant points are usually not a learning class, especially due to their low frequency of occurrence. Many methods have been proposed to detect these anomalies, in particular for temporal graphs, as shown by the numerous reviews on the subject, e.g. [Ranshous 2015, Suri 2019]. When anomaly detection is inserted in a decision support framework, it then becomes essential to combine automatic anomaly detection methods with explanation techniques [Yepmo 2021]. These explanations make explicit the abnormal properties of certain points. Considering the dynamicity of interaction graphs, these explanations are an important element to differentiate between anomalies and emerging phenomena, and thus allow a decision maker to either raise an alert (and take corrective measures) or observe to understand the new behaviours. Explaining the anomaly, understanding what is atypical, allows to better support the decision-making.

In this context, the objective of the project is to simultaneously address 3 challenges: 1) "understand" normal behaviours while managing a potentially large data history, 2) identify anomalies that reflect structural (unlikely interactions), temporal (increase in the intensity of interactions between two individuals) but also spatiotemporal (change of community of an individual, increase in interaction within a community) changes and 3) complete this anomaly detection with explanations of where they come from to allow a decision maker to distinguish between emerging phenomena and real anomalies.

This research is funded by Carnot TSN "Digital 2023" whose objective is to support groundbreaking exploratory projects or emerging from the state of the art combining digital technology and application fields. Particular attention will be given to the interpretation of these anomalies in the context of two application fields, "Learning Analytics" and "Cybersecurity".

The recruited person will have to invest mainly on the domain of anomaly detection in temporal networks, for specific contexts where explications are expected, i.e. where a decision has to be made regarding the detected anomalies and their properties. Part of the mission is the study and the synthesis of the recent works in both fields (anomaly detection in temporal graphs and anomaly explicability). The candidate will propose new methods, with a focus on unsupervised edge stream approaches [Latapy 2018, Chang 2021].

To support the theoretical work of this project, we will test our methods and tools with academic datasets: networking data dedicated to anomaly detection, e.g. TwitterSecurity2014 and generated data, e.g. by CDR-Generator. A case study with interaction data from a learning management system can be conducted if we have access to this data during the project.


[Chang 2021] Yen-Yu Chang, et al. "F-fade: Frequency factorization for anomaly detection in edge streams." Proceedings of the 14th ACM International Conference on Web Search and Data Mining. 2021

[Latapy 2018] Latapy, Matthieu, Tiphaine Viard, and Clémence Magnien. "Stream graphs and link streams for the modeling of interactions over time." Social Network Analysis and Mining 8.1 (2018): 1-29.

[Ranshous 2015] Stephen Ranshous, Shitian Shen, Danai Koutra, Steve Harenberg, Christos Faloutsos, and Nagiza F Samatova. 2015. Anomaly detection in dynamic networks: a survey. Wiley Interdisciplinary Reviews: Computational Statistics (2015), 223–247

[Suri 2019] Suri, N. M. R., Murty, M. N., & Athithan, G. (2019). Outlier detection: techniques and applications. Springer Nature.

[Yepmo 2022] Yepmo, V., Smits, G., & Pivert, O. (2022). Anomaly explanation: A review. Data & Knowledge Engineering, 137, 101946.


Job requirements

3. Training and skills

Training

  • PhD less than 3 years old in Computer Science, Machine Learning

Knowledge & Skills

The candidate should have strong skills in Machine Learning (model design, deep learning approaches) and Python and a strong interest in Complex Networks Analysis and Explicable AI.

Benefits

  • 49 days of annual leave and time off
  • Partial telecommuting possible
  • Public transport paid for
  • Sustainable mobility package (for carpooling or cycling)
  • Family supplement
  • Wide range of social benefits

Additional information and application

  • Application deadline : December 4th, 2022
  • Start of contract : early 2023
  • Type of contract : Fixed-term contract under public law
  • Duration of the contract : 12months,
  • Geographic location : IMT Atlantique - 655 Av. du Technopôle, 29280 Plouzané
  • Project : Digital 2023
  • The positions offered for recruitment are open to all with, upon request, accommodations for candidates with disabilities
  • Hierarchical Category: Category II trade P of the LMI management cadre
  • For more information, please contact : Cécile Bothorel (cecile.bothorel@imt-atlantique.fr)

Application documents

  • Resume with list of publications
  • Cover letter
  • Names and emails of referees that may be contacted
  • PDF of a representative article (or slide show) by the candidate related to this project.