[Paper Review] Multiple Infection Sources Identification with Provable Guarantees

Hung T. Nguyen, Preetam Ghosh+2 more|arXiv (Cornell University)|Aug 23, 2016

Complex Network Analysis Techniques14 references4 citations

TL;DR

This paper proposes SISI, the first approximation algorithm with provable guarantees for identifying multiple infection sources in general graphs without prior knowledge of the number of sources. It minimizes the symmetric difference between observed infected nodes and cascade simulations using Truncated Reverse Infection Sampling and a primal-dual approach, achieving a $\frac{2}{(1-\epsilon)^2}\Delta$-approximation with high probability and outperforming state-of-the-art methods in F1-measure and symmetric difference.

ABSTRACT

Given an aftermath of a cascade in the network, i.e. a set $V_I$ of "infected" nodes after an epidemic outbreak or a propagation of rumors/worms/viruses, how can we infer the sources of the cascade? Answering this challenging question is critical for computer forensic, vulnerability analysis, and risk management. Despite recent interest towards this problem, most of existing works focus only on single source detection or simple network topologies, e.g. trees or grids. In this paper, we propose a new approach to identify infection sources by searching for a seed set $S$ that minimizes the \emph{symmetric difference} between the cascade from $S$ and $V_I$, the given set of infected nodes. Our major result is an approximation algorithm, called SISI, to identify infection sources \emph{without the prior knowledge on the number of source nodes}. SISI, to our best knowledge, is the first algorithm with \emph{provable guarantee} for the problem in general graphs. It returns a $\frac{2}{(1-ε)^2}Δ$-approximate solution with high probability, where $Δ$ denotes the maximum number of nodes in $V_I$ that may infect a single node in the network. Our experiments on real-world networks show the superiority of our approach and SISI in detecting true source(s), boosting the F1-measure from few percents, for the state-of-the-art NETSLEUTH, to approximately 50\%.

Motivation & Objective

• To address the challenge of identifying multiple infection sources in general graphs, where prior methods assume single sources or simple topologies.
• To develop a method that does not require prior knowledge of the number of infection sources.
• To minimize the symmetric difference between the observed infected set and the cascade from candidate sources.
• To provide a provably accurate approximation algorithm for the multiple infection source detection problem in general graphs.

Proposed method

• Formulates infection source detection as minimizing the symmetric difference between the observed infected set $V_I$ and the cascade from a seed set $S$.
• Introduces Truncated Reverse Infection Sampling (TRIS) to efficiently generate random reachability sets that encode the infection landscape.
• Applies a primal-dual algorithm for Submodular-cost Covering to solve the optimization problem under the symmetric difference objective.
• Uses a sampling-based approach to handle the stochastic nature of the infection process and reduce computational complexity.
• Employs a randomized algorithm that returns a $\frac{2}{(1-\epsilon)^2}\Delta$-approximate solution with high probability.
• Extends the framework to work under the Independent Cascade (IC) model and incomplete observations, with minor modifications to the sampling procedure.

Experimental results

Research questions

• RQ1 Can we identify multiple infection sources in general graphs without knowing the number of sources in advance?
• RQ2 Is it possible to design an approximation algorithm with provable performance guarantees for multiple infection source detection in arbitrary network topologies?
• RQ3 How does minimizing symmetric difference between observed and simulated cascades improve source detection accuracy compared to existing criteria like MDL or degree?
• RQ4 Can a sampling-based method effectively approximate the optimal source set while handling the stochasticity of epidemic processes?
• RQ5 How does the performance of the proposed method compare to state-of-the-art approaches like NETSLEUTH and k-effector under varying numbers of sources and infection sizes?

Key findings

• SISI achieves an F1-measure of approximately 50% in detecting true infection sources on real-world networks, a significant leap from NETSLEUTH’s 0%.
• SISI reduces the symmetric difference by more than half compared to the k-effector method under the Independent Cascade model, with values of 6.6 vs. 18.4 for one source.
• In experiments with $|V_I| = 1000$, SISI detected over 70% of true sources, while NETSLEUTH and Max-Degree detected 0%.
• SISI-relax, a faster variant, maintains strong performance, detecting over 50% of true sources and achieving symmetric difference values close to SISI.
• SISI runs slower than NETSLEUTH but provides vastly superior accuracy, with the trade-off being justified by its provable approximation guarantee.
• The algorithm demonstrates robustness across different network types and infection sizes, consistently outperforming heuristic-based methods like Greedy and Max-Degree.