Paragon Science used a combination of network analysis, community detection, topic detection, sentiment analysis, and anomaly detection to find key influencers and viral topics in two recent Twitter data sets: one of 7.9 M tweets regarding ISIS and a second set consisting of 13 M tweets about the recent primary elections.

1. Finding Key Influencers and
Viral Topics in Twitter Networks
Related to ISIS and to the
2016 Primary Elections
Steve Kramer, Ph.D.
President & Chief Scientist
Paragon Science, Inc.
March 2016
Copyright © 2006-2016 Paragon Science, Inc. All rights reserved.

2. Overview
 Background Information about Paragon Science
 Example 1: ISIS Twitter Network Analysis
 Example 2: 2016 Election Twitter Network Analysis
 Q & A
Paragon Science, Inc. 2

3. About Paragon Science
 Advisory Board Company
• Analysis of Healthcare Data
 Digital Motorworks/CDK Global
• Vehicle Pricing Analytics
 Houston Law Firm
• Email Analysis for Patent Lawsuit
 Place IQ
• Mobile Phone Data Analysis
 RetailMeNot
• Web Analytics for Online Coupons
 Vast.com
• Web User Click Patterns
Paragon Science, Inc. 3
 Founder: Dr. Steve Kramer
• PhD in computational physics (nonlinear
dynamics)
• Self-funded data science entrepreneur
• 22 years of research and high-tech
experience
• Manager and consultant at software
companies
• Reviewer for scientific journals and
conferences
• Member of StartOut Austin steering
committee
http://affinityincmagazine.com/paragon-science-puts-patented-technology
/

4. Paragon Science, Inc. 4
 Using our patented anomaly detection software to find the
“unknown unknowns”: unusual changes that represent
revenue opportunities to exploit or risks to mitigate
 Many possible application areas:
• Social media alerting and sentiment change detection
• Pricing and market trend analysis and alerting
• Fraud prevention (banking, insurance, online auctions,…)
 Key advantages
• No machine learning or training required
• Robust to missing or erroneous data
• Highly scalable and parallelizable
What Are We Doing?

5. Paragon Science, Inc. 5
How Is It Done Today?
 Existing approaches
• Standard SNA metrics
• Rule-based systems (transaction profiling, etc.)
• Bayesian and other statistical/probabilistic models
• Machine learning tools (neural nets, HMMs, etc.)
 Some limitations of existing methods
• Training requirements can be large for neural nets.
• For rule-based systems, it is difficult to effectively predict or define
new “bad” anomalies or patterns in advance.
• Many current methods are not scalable to real-world operational
requirements.

6. Paragon Science, Inc. 6
What Is New in Our Patented Approach?
 A powerful anomaly detection approach that
incorporates nonlinear time series analysis methods
• US Patent #8738652 (1.usa.gov/1kkyVD9)
“Systems and Methods for Dynamic Anomaly Detection”
 Key questions answered:
• Which entities behave or evolve differently than others in the
data set?
• Which entities have shifted their behavior unexpectedly?

7. Paragon Science, Inc. 7
What Is New in Our Approach? (Cont’d.)
 Our framework inherently captures the dynamics of the entities under
study, without having to specify in advance normal vs. abnormal
behavior.
 We can simultaneously analyze the time evolution of
• Network structures
• Any associated attributes (text terms, geospatial position, etc.)
 Our technique is robust with respect to missing or erroneous data.
 As result, we can
• Find key players in rapidly changing networks
• Provide early warning of viral videos and online documents
• Focus attention on the most-anomalous events or transactions

8. Paragon Science, Inc. 8
Dynamic Anomaly Detection Overview
 A general approach that incorporates nonlinear time series
analysis methods
• Complexity measures
• Finite-time Lyapunov exponents (FTLEs)
 Input data
• Communications or transactional data streams
• General time-dependent data sets
 Key questions
• Which entities behave or evolve differently than others in the data
set?
• Which entities have shifted their behavior unexpectedly?

9. Paragon Science, Inc. 9
Finite-Time Lyapunov Exponents (FTLEs)
 General dynamical system
 Flow map
• Advects points in the state
space
• Describes the time
evolution of the system

10. Paragon Science, Inc. 10
 FTLEs characterize the amount of stretching or contraction
about a point x0 during a time interval T
• Stability
• Predictability
 Definition
Finite-Time Lyapunov Exponents (FTLEs)

11. Paragon Science, Inc. 11
 Similarly, characteristic vectors derived from the flow map’s
Jacobian can describe the generalized directions of the
local stretching or contraction.
 Possible derivation approaches:
• Weight-based column sampling
• Singular value decomposition (SVD)
• Principal component analysis (PCA)
Derived Jacobian Vectors

12. Paragon Science, Inc. 12
Paragon Dynamic Anomaly Detection
Representation
of Data at t=ti
Cluster
Resolution
Feature Vector
Encoding
Outlier Detection
at t=ti
3+Time
Intervals?
Yes
No
Clustering /
Segmentation
Dynamic Anomaly Detection
Nonlinear Time Series Analysis
FTLEs, Dynamic Thresholds, etc.
Pattern
Classification
Outlier
Detection
Domain-Specific Filtering
Threat Signatures,
Risk Profiles, etc.

13. Overview
 Background Information about Paragon Science
 Example 1: ISIS Twitter Network Analysis
 Example 2: 2016 Election Twitter Network Analysis
 Q & A
Paragon Science, Inc. 13

14. Example 1: ISIS-Related Twitter Analysis
Initial data set from Twitter API collected using twittertap:
Date range: 11/30/2015 – 12/10/2015
2,541,812 tweets
7,802,210 generated links with hashtags, URLs, and user replies
Research plan
Perform k-core decomposition
Run anomaly detection software on sub-networks of nodes in the
central core to find the most influential users and most viral URLs
Carry out community detection, topic detection, and sentiment
analysis
Paragon Science, Inc. 14

15. Example 1: ISIS-Related Twitter Network
Paragon Science, Inc. 15
User A User B
User C
replies to
mentions
URL 1 URL 2
Hash Tag 1
Hash Tag 2
references
uses
uses
references
Link Type # Links
User links to URL 2,014,572
User mentions user 2,867,633
User references hashtag 2,699,875
User references symbol 2,636
User replies to user 215,343

16. K-core Decomposition
The k-core of a graph is a maximal subgraph in which each
vertex has at least degree k.
The coreness of a vertex is k if it belongs to the k-core but not to
the (k+1)-core.
The k-core decomposition is performing by recursively removing
all the vertices (along with their respective edges) that have
degrees less than k.
The k-core decomposition of a network can be very
effective in identifying the individuals within a network who
are best positioned to spread or share information.
M. Kitska, et al., “Identifying influential spreaders in complex networks,”
arXiv:1001.5285v1 [physics.soc-ph] (2010).
16

17. K-Core Decomposition of the ISIS Network
Paragon Science, Inc. 17
http://sourceforge.net/projects/lanet-vi/

18. Central Core of the ISIS Network
Paragon Science, Inc. 18
Users at the center
of the k-core
decomposition are
positioned well to
spread information
and influence the
network.

19. Top URLs in the Central Core
Paragon Science, Inc. 19
URL Web Page Title Coreness # Links
http://www.mirror.co.uk/news/uk-news/isis-
would-love-you-bomb-
6941441#ICID=sharebar_twitter
ISIS would love you to bomb them to bring
about apocalyptic final fight, says journalist who
lived among terrorists - Jurgen Todenhofer -
Mirror Online
89 398
https://www.youtube.com/watch?
v=nVDiK3J9PKQ
How to Paralyse & Eliminate ISIS in Less Than 24
Hours - Younus AlGohar - YouTube
89 384
http://shr.gs/Um8lnCZ Jihadi BILLIONAIRES: ISIS top terror rich list“ but
how are they blowing all the dough?
89 349
https://www.youtube.com/watch?v=FS9iPz-cPlY Humanity Under Attack! What Must Be Done
Now? - Younus AlGohar - YouTube
89 331
http://is.gd/txNkng How to Paralyse & Eliminate ISIS in Less Than 24
Hours - Younus AlGohar
89 327
http://bbc.in/aggad Paris attacks: Bataclan third attacker identified -
BBC News
89 317
http://ti.me/1XPKXcx London Subway Attacker Had ISIS Images on
Phone: Officials
89 317
http://dailym.ai/1NFIp5L ISIS releases its latest video as they execute two
˜sorcerers” in Libya | Daily Mail Online
89 298
http://youtu.be/mXOSQj4xjPY Fitna-e-Khwarij - YouTube 89 259
http://www.telegraph.co.uk/news/worldnews/
northamerica/usa/12037849/
Majority-of-Americans-support-sending-ground-
troops-to-fight
Majority of Americans support sending ground
troops to fight Isil
89 255

20. Top 5 URLs in the Central Core
20

21. Top Users in the Central Core
Paragon Science, Inc. 21
User Coreness # Links
MailOnline 89 6255
David_Cameron 89 3330
Telegraph 89 2072
TarekFatah 89 1907
BBCWorld 89 992
younusalgohar 89 977
mehdifoundation 89 830
rafu007 89 791
TIMEWorld 89 700
niallboylan4fm 89 667

22. Topic Detection in the ISIS
Twitter Network
Paragon Science, Inc. 22
User A User B
User C
replies to
mentions
URL 1 URL 2
references
Term 1
Term 2
Term N
Term 3
Topic 1
Topic 2
Topic M
 146 Topics Detected

23. Title-to-Term Network for Topic Detection
23Paragon Science, Inc.

24. Title-to-Term Network for Topic Detection
24Paragon Science, Inc.

25. Topic 3 Communities of Users
25Paragon Science, Inc.

26. Topic 3 Top 10 Web Sites
26Paragon Science, Inc.

27. Topic 3 Selected Users
27Paragon Science, Inc.

28. Topic 4 Top Web Sites
28Paragon Science, Inc.

29. Incorporating Sentiment Analysis
• Incorporate sentiment analysis scores as an input to dynamic
anomaly detection in order to track the propagation of
references to websites with particular emotions.
• Use the LIWC (Linguistic Inquiry and Word Count) tool to
calculate the sentiment scores of the web pages.
– Prof. James Pennebaker from UT Austin (http://liwc.wpengine.com/)
– Sample categories
• Positive emotion
• Negative emotion
• Anger
• Anxiety
Paragon Science, Inc.

30. Top Web Pages by Anxiety
Web Page Title URL Anxiety Score
Watch Daniel Scavino Jr.'s Vine "POTUS
on terrorism."
https://vine.co/v/i71FvOKlYgv 11.11
*WARNING: New ISIS VIDEO: Muslim
Children Execute Captives, Obama, we
will behead you, as we will do to all the
Jews | Pamela Geller
http://bit.ly/1TMcgif 6.51
The Mastermind Of The San Bernardino
Massacre Has All The Hallmarks Of An
ISIS Terrorist Attack... - Linkis.com
http://ln.is/shoebat.com/2015/
12/PGcNB
5.56
The Far-Reaching Effects of Global
Terrorism - YouTube
http://youtu.be/L_qr01yHoQs 4.85
Terrorism isn't scaring Americans;
Obama is by Andrew Malcolm -
Investors.com
http://news.investors.com/poli
tics-andrew-malcolm/120715-
784023-obama-isis-speech-no-
new-strategy.htm
4.03
57 Paris airport workers on terror
watch list, “Allahu akbar” scrawled on
fuel tank
http://www.jihadwatch.org/20
15/12/57-paris-airport-
workers-on-terror-watch-list-
allahu-akbar-scrawled-on-fuel-
tank
3.03
DIA Emails: ISIS was deliberately armed
and funded by Obama & Hillary Clinton
http://ian56.blogspot.com/201
5/06/the-terrorist-threat-has-
been.html?m=1
2.94
Paragon Science, Inc.

31. Top Web Pages by Negative Emotion Ratio
Web Page Title URL Negative/
Positive
Emotion Score
Russian airstrike 'kills family in their car' as bombs
obliterate ISIS oil convoy | Daily Mail Online
http://dailym.ai/1IIU2Yz 21.9
Study: Unprecedented support for ISIS in the U.S. -
CNNPolitics.com
http://cnn.it/1XF0p61 13.3
US-led coalition not striking ISIS oil trucks despite
evidence – Russia’s General Staff” RT News
http://on.rt.com/6y9c 12.1
ISIS PARIS TERRORIST Recruited Fighters at Hungarian
Refugee Camp - YouTube
https://www.youtube.com/watch?
v=88TJBvH1zzg
11.9
U.S. rejects Russia’s claim of Turkey’s cooperation with
ISIS
http://goo.gl/Q9MWGk 11.8
Islamic State's Sinai chief said in Gaza to coordinate with
Hamas | The Times of Israel
http://bit.ly/1N6bqZa 10.0
Is ISIS Entering US Through Mexico? Amid Islamic State
Fears, Border Patrol Captures Afghan, Pakistani Men
Being Smuggled Into Country
http://bit.ly/1l9Mxo1 9.8
Why Can't White House Just Say ISIS Beheaded Christians?
- Investors.com
http://ift.tt/1zMpWNz 8.6
For the Record: How Stubborn U.S. Leaders May Be
Hurting the Fight Against ISIS on Vimeo
https://vimeo.com/147860012 8.4
Just 0.4 Percent of Syrian Refugees Admitted to U.S. Since
Paris Attacks Are Christian - Breitbart
http://www.breitbart.com/big-
government/2015/12/08/just-0-4-
percent-syrian-refugees-admitted-
u-s-since-paris-attacks-christian/
8.1

32. Paragon Science, Inc. 32
Mapping Anomalies to Source Data
Anomalies
Discrete/Continuous
Attribute Distributions
Related Source
Data
Where and
when are the
hotspots of
changes?
Which nodes
and attributes
were involved in
each
anomalous
peak?

33. Anomaly Detection Results for Websites with
Negative Emotions
Paragon Science, Inc. 33
Surge of Twitter user links to
web page with high negative
emotion score: “The ISIS
Trail of Death - NBC News”

34. Summary of Top 50 Negative Emotion Anomalies
34
Web Page Title Peak Start Peak End Max Change
Metric
#
Anomalies
The ISIS Trail of Death - NBC News 2015-12-08
03:36:39
2015-12-09
13:36:39
3.01 24
Russia strikes ISIS targets in Syria from
sub in Mediterranean for first time
(VIDEO) RT News
2015-12-09
07:36:39
2015-12-09
16:36:39
2.33 8
US Air Force running out of bombs to
fight ISIS | Fox News
2015-12-06
07:36:39
2015-12-06
21:36:39
2.10 2
If you keep saying Saudi Arabia is like
ISIS, you might get sued - The
Washington Post
2015-12-02
04:36:39
2015-12-07
09:36:39
2.01 11
Everyone knows what’s going on:
Istanbul residents on Turkey-ISIS oil
trade — RT News
2015-12-04
15:36:39
2015-12-04
16:36:39
1.96 2
Is ISIS Entering US Through Mexico?
Amid Islamic State Fears, Border Patrol
Captures Afghan, Pakistani Men Being
Smuggled Into C
2015-12-03
15:36:39
2015-12-03
15:36:39
1.91 1
Iran news in brief, 30 November 2015 -
YouTube
2015-12-01
17:36:39
2015-12-01
17:36:39
1.90 1
No Christians: All 132 Syrian Refugees
Admitted to U.S. Since Paris Attacks Are
Sunni Muslims
2015-12-01
19:36:39
2015-12-01
19:36:39
1.89 1

35. Most-Anomalous Negative Emotion ISIS Web
Page Shared by Twitter Users
35

36. Animation of ISIS Twitter Network
Paragon Science, Inc. 36
Many thanks to Cambridge
Intelligence for a trial license
to their KeyLines software.
https://www.youtube.com/watch?v=j7Sof3BdDSY

37. Overview
 Background Information about Paragon Science
 Example 1: ISIS Twitter Network Analysis
 Example 2: 2016 Election Twitter Network Analysis
 Q & A
Paragon Science, Inc. 37

38. Example 2: Election 2016 Twitter Network
Paragon Science, Inc. 38
Data set from Twitter API collected using twittertap:
Date range: 2/24/2016-3/4/2016
13 M tweets sent by 2.8 M users
22.6 M generated links with hashtags, URLs, and user replies
K-core decomposition:
Performed once for each day
Maximum coreness of 88
Central part of the network created by selecting the three
innermost shells for each day

39. K-Core Decomposition of the Innermost
Election 2016 Twitter Network
Paragon Science, Inc. 39

40. Detail View of the Central Core
Paragon Science, Inc. 40

41. Top 10 Users in the Central Core
Paragon Science, Inc. 41

42. Top 10 URLs in the Central Core
Paragon Science, Inc. 42
URL Degree
http://www.infowars.com/report-trump-supporters-in-texas-see-votes-switched-to-
rubio/ 2334
http://www.bostonherald.com/news/us_politics/2016/02/amid_trump_surge_nearly_2
0000_mass_voters_quit_democratic_party 1665
http://newsninja2012.com/gov-nikki-haley-just-became-a-liability-for-rubio-after-this-
was-published-to-social-media/ 1340
http://www.thepoliticalinsider.com/donald-trump-quietly-helped-marine-whom-
obama-ignored/ 1203
https://www.donaldjtrump.com/press-releases/donald-j.-trump-demands-retraction-
of-misleading-ads-produced-by-marco-rubi 1172
http://m.washingtontimes.com/news/2016/feb/29/victims-illegal-immigrant-violence-
gop-no-rubio/ 1136
http://goo.gl/cTEFYR 978
http://drudge.tw/1ngE3Mt 778
https://www.washingtonpost.com/news/post-politics/wp/2016/02/21/donald-trump-
consults-with-rudy-giuliani-as-he-builds-political-kitchen-cabinet/ 770

43. Top URL in the Central Core
Paragon Science, Inc. 43

44. Top 10 URLs in the Entire Network
Paragon Science, Inc. 44
URL Coreness Degree
https://www.youtube.com/watch?v=DnpO_RTSNmQ 63 17524
https://amp.twimg.com/v/077834f2-a406-49cd-bfd4-
e6b64274e885 36 17162
https://www.youtube.com/watch?v=DnpO_RTSNmQ 67 12703
https://amp.twimg.com/v/077834f2-a406-49cd-bfd4-
e6b64274e885 23 12229
https://amp.twimg.com/v/077834f2-a406-49cd-bfd4-
e6b64274e885 26 11687
http://cnn.it/1RxbzsD 64 6795
http://www.usatoday.com/story/news/politics/elections/2016/02/2
9/
donald-trump-georgia-rally-valdosta/81129964/ 71 6692
https://vine.co/v/i6AX96L7Xgi 12 6061
https://vine.co/v/i6AX96L7Xgi 10 5962

45. Top URL in the Entire Network
Paragon Science, Inc. 45

46. Community Detection in the Central Core
Paragon Science, Inc. 46
10 communities detected

47. Hillary Clinton Sub-Network
Paragon Science, Inc. 47

48. Mark Rubio Sub-Network
Paragon Science, Inc. 48

49. Bernie Sanders Sub-Network
Paragon Science, Inc. 49

50. Donald Trump Sub-Network
Paragon Science, Inc. 50

51. Paragon Science, Inc. 51
What Are the Payoffs?
 Find the “unknown unknowns” in dynamic data sets
 Quickly identify key influencers and trends in online
networks
 Provide early warning of viral videos, anomalous web
events, or unusual network traffic
 Enable enhanced business intelligence without having to
specify normal vs. abnormal behavior in advance

52. Third-Party Software Acknowledgements
 Paragon Science gratefully acknowledges the following researchers and software
providers:
• Cytoscape (http://www.cytoscape.org/)
• KeyLines (http://www.keylines.com)
• Lanet-vi (http://sourceforge.net/projects/lanet-vi/)
◦ J. Alvarez-Hamelin, et al. "Understanding Edge Connectivity in the Internet through
Core Decomposition," Internet Mathematics 7 (1): 45–66, 2011.
• Louvain community detection software (http://perso.crans.org/aynaud/communities/)
◦ V. Blondel, et al., “Fast Unfolding of Communities in Large Networks,” Journal of
Statistical Mechanics: Theory and Experiment, 10, P10008, 2008.
• Networkx (https://networkx.github.io/)
◦ A Hagberg, D Conway, "Hacking social networks using the Python programming
language (Module II - Why do SNA in NetworkX)", Sunbelt 2010: International
Network for Social Network Analysis.
Paragon Science, Inc. 52

53. Overview
 Background Information about Paragon Science
 Example 1: ISIS Twitter Network Analysis
 Example 2: 2016 Election Twitter Network Analysis
 Q & A
Thanks for your interest!
Steve Kramer
@ParagonSci_Inc
Paragon Science, Inc. 53