Information Source Detection in the SIR Model: A Sample Path Based Approach

Transcription

1 Information Sorce Detection in the SIR Model: A Sample Path Based Approach Kai Zh and Lei Ying School of Electrical, Compter and Energy Engineering Arizona State University Tempe, AZ, United States, kzh7@ased, leiying2@ased arxiv:206542v2 [cssi] 9 Feb 203 Abstract This paper stdies the problem of detecting the information sorce in a network in which the spread of information follows the poplar Ssceptible-Infected-Recovered SIR model We assme all nodes in the network are in the ssceptible state initially except the information sorce which is in the infected state Ssceptible nodes may then be infected by infected nodes, and infected nodes may recover and will not be infected again after recovery Given a snapshot of the network, from which we know all infected nodes bt cannot distingish ssceptible nodes and recovered nodes, the problem is to find the information sorce based on the snapshot and the network topology We develop a sample path based approach where the estimator of the information sorce is chosen to be the root node associated with the sample path that most likely leads to the observed snapshot We prove for infinite-trees, the estimator is a node that minimizes the maximm distance to the infected nodes A reverse-infection algorithm is proposed to find sch an estimator in general graphs We prove that for g-reglar trees sch that gq >, where g is the node degree and q is the infection probability, the estimator is within a constant distance from the actal sorce with a high probability, independent of the nmber of infected nodes and the time the snapshot is taken Or simlation reslts show that for tree networks, the estimator prodced by the reverse-infection algorithm is closer to the actal sorce than the one identified by the closeness centrality heristic We then frther evalate the performance of the reverse infection algorithm on several real world networks I INTRODUCTION Diffsion processes in networks refer to the spread of information throghot the networks, and have been widely sed to model many real-world phenomena sch as the otbreak of epidemics, the spreading of gossips over online social networks, the spreading of compter virs over the Internet, and the adoption of innovations Important properties of diffsion processes sch as the otbreak thresholds [] and the impact of network topologies [2] have been intensively stdied In this paper, we are interested in the reverse of the diffsion problem: given a snapshot of the diffsion process at time t, can we tell which node is the sorce of the diffsion? The answer to this problem has many important applications, and can help s answer the following qestions: who is the rmor sorce in online social networks? which compter is the first one infected by a compter virs? who is the one who ploaded contraband materials to the Internet? and where is the sorce of an epidemic? We call this problem information sorce detection problem This information sorce detection problem has been stdied in [3] [5] nder the Ssceptible-Infected SI model, in which ssceptible nodes may be infected bt infected nodes cannot recover The athors formlated the problem as a maximm likelihood estimation MLE problem, and developed novel algorithms to detect the sorce In this paper, we adopt the Ssceptible-Infected-Recovered SIR model, a standard model of epidemics [6], [7] The network is assmed to be an ndirected graph and each node in the network has three possible states: ssceptible S, infected I, and recovered R Nodes in state S can be infected and change to state I, and nodes in state I can recover and change to state R Recovered nodes cannot be infected again We assme that initially all nodes are in the ssceptible state except one infected node called the information sorce The information sorce then infects its neighbors, and the information starts to spread in the network Now given a snapshot of the network, in which we can identify infected nodes and healthy ssceptible and recovered nodes we assme ssceptible nodes and recovered nodes are indistingishable, the qestion is which node is the information sorce We remark that it is very important to take recovery into consideration since recovery can happen de to varios reasons in practice For example, a contraband material ploader may delete the file, a compter may recover from a virs attack after anti-virs software removes the virs, and a ser may delete the rmor from her/his blog In order to solve the information sorce detection problem in these scenarios, we stdy the SIR model in this paper, which makes the problem significantly more challenging than that in the SI model as we will explain in the related work section A Main Reslts The main reslts of this paper are smmarized below Similar to the SI model, the information sorce detection problem can be formalized as an MLE problem Unfortnately, to solve the MLE problem, we need to consider all possible infection sample paths, and for each sample path, we need to specify the infection time and recovery time for each healthy node and the infection time for each infected node, so the nmber of possible sample paths is at the order of Ωt N, where N is the network size

2 and t is the time the snapshot is obtained Therefore, the MLE problem is difficlt to solve even when t is known The problem becomes mch harder when t is nknown, which is the assmption of this paper To overcome this difficlty, we propose a sample path based approach We propose to find the sample path which most likely leads to the observed snapshot and view the sorce associated with that sample path as the information sorce We call this problem optimal sample path detection problem We investigate the strctre properties of the optimal sample path in trees Defining the infection eccentricity of a node to be the maximm distance from the node to infected nodes, we prove that the sorce node of the optimal sample path is the node with the minimm infection eccentricity Since a node with the minimm eccentricity in a graph is called the Jordan center, we call the nodes with the minimm infection eccentricity the Jordan infection centers Therefore, the sample path based estimator is one of the Jordan infection centers We propose a low complexity algorithm, called reverse infection algorithm, to find the sample path based estimator in general graphs In the algorithm, each infected node broadcasts its identity in the network, the node who first collect all identities of infected nodes declares itself as the information sorce, breaking ties based on the sm of distances to infected nodes The rnning time of this algorithm is eqal to the minimm infection eccentricity, and the nmber of messages each node receives/sends at each iteration is bonded by the degree of the node We analyze the performance of the reverse infection algorithm on g-reglar trees, and show that the algorithm can otpt a node within a constant distance from the actal sorce with a high probability, independent of the nmber of infected nodes and the time the snapshot is taken We condct extensive simlations over varios networks to verify the performance of the reverse infection algorithm The detection rate over reglar trees is fond to be arond 60%, and is higher than that of the infection closeness centrality or called distance centrality heristic The infection closeness of a node is defined to be the inverse of the sm of distances to infected nodes and the infection closeness centrality heristic is to claim the node with the maximm infection closeness as the sorce Note that in [3] [5], the athors proved the node with the maximm infection closeness is the MLE on reglar trees For real world networks, or experiments also show that the reverse infection algorithm otperforms random gesses significantly We then frther evalate the performance of the reverse infection algorithm on several real world networks B Related Work There have been extensive stdies on the spread of epidemics in networks based on the SIR model see [], [2], [8], [9] and references within The work most related to this paper is [3] [5], in which the information sorce detection problem was stdied nder the SI model [0], [] considers the problem of detecting mltiple information sorces nder the SI model This paper considers the SIR model, where infection nodes may recover, which can occr in many practical scenarios as we have explained Becase of node recovery, the information sorce detection problem nder the SIR model differs significantly from that nder the SI model The differences are smmarized below The set of possible sorces in the SI model [3] [5] is restricted to the set of infected nodes In the SIR model, all nodes are possible information sorces becase we assme ssceptible nodes and recovered nodes are indistingishable and a healthy node may be a recovered node so can be the information sorce Therefore, the nmber of candidate sorces is mch larger in the SIR model than that in the SI model A key observation in [3] [5] is that on reglar trees, all permitted permtations of infection seqences a infection seqence specifies the order at which nodes are infected are eqally likely nder the SI model The nmber of possible permtations from a fixed root node, therefore, decides the likelihood of the root node being the sorce However, nder the SIR model, different infection seqences are associated with different probabilities, so conting the nmber of permtations are not sfficient [3] [5] proved that the node with the maximm closeness centrality is the an MLE on reglar-trees We define the infection closeness centrality to be the inverse of the sm of distances to infected nodes Or simlations show that the sample path based estimator is closer to the actal sorce than the nodes with the maximm infection closeness Other related works inclde: detecting the first adopter of innovations based on a game theoretical model [2] in which the athors derived the MLE bt the comptational complexity is exponential in the nmber of nodes, 2 network forensics nder the SI model [3], where the goal is to distingish an epidemic infection from a random infection, and 3 geospatial abdction problems see [4], [5] and references within II PROBLEM FORMULATION A The SIR Model for Information Propagation Consider an ndirected graph G = {V, E}, where V is the set of nodes and E is the set of ndirected edges Each node v V has three possible states: ssceptible S, infected I, and recovered R We assme a time slotted system Nodes change their states at the beginning of each time slot, and the state of node v in time slot t is denoted by X v t Initially, all nodes are in state S except node v which is in state I and is the information sorce At the beginning of each time slot, each infected node infects each of its ssceptible neighbors with probability q, independent of other nodes, ie, a ssceptible node is infected with probability

3 4 2 6 Figre ,2 2,- 3 2,3 4 2,- 5 -,- 6 3,- 7 3,- An Example of Information Propagation q n if it has n infected neighbors Each infected node recovers with probability p, ie, its state changes from I to R with probability p In addition, we assme a recovered node cannot be infected again Since whether a node gets infected only depends on the states of its neighbors and whether a node becomes a recovered node only depends on its own state in the previos time slot, the infection process can be modeled as a discrete time Markov chain Xt where Xt = {X v t, v V} is the states of all the nodes at time slot t The initial state of this Markov chain is X v 0 = S for v v and X v 0 = I B Information Sorce Detection We assme Xt is not flly observable since we cannot distingish ssceptible nodes and recovered ones So at time t, we observe Y = {Y v, v V} sch that {, if v is in state I; Y v = 0, if v is in state S or R The information sorce detection problem is to identify v given the graph G and Y, where t is an nknown parameter Figre is an example of the infection process The left figre shows the information propagation over time The nodes on each dotted line are the nodes which are infected at that time slot, and the arrows indicate where the infection comes from eg, node 4 is infected by node 2 The figre on the right is the network we observe, where the shaded nodes are infected nodes and others are ssceptible or recovered nodes The pair of nmbers next to each node are the corresponding infection time and recovery time For example, node 3 was infected at time slot 2 and recovered at time slot 3 indicates that the infection or recovery has yet occrred Note that these two pieces of information are not available to s, and we inclde them in the figre to illstrate the infection and recovery processes If we observe the network at the end of time slot 3, then the snapshot of the network is Y = {0,, 0,, 0,, }, where the states are ordered according to the indices of the nodes C Maximm Likelihood Detection We define X[0, t] = {Xτ : 0 < τ t} to be a sample path of the infection process from 0 to t In addition, we define fnction F sch that {, if Xv t = I; F X v t = 0, otherwise We say FX[t] = Y if F X v t = Y v for all v Identifying the information sorce can be formlated as a maximm likelihood detection problem as follows: v arg max v V X[0,t]:FXt=Y PrX[0, t] v = v, where PrX[0, t] v = v is the probability to obtain sample path X[0, t] given the information sorce is node v We note the difficlty of solving this maximm likelihood problem is the crse of dimensionality For each v sch that Y v = 0, we need to decide its infection time and recovery time the node is in ssceptible state if the infection time is > t, ie, Ot 2 possible choices; for each v sch that Y v =, we need to decide the infection time, ie, Ot possible choices Therefore, even for a fixed t, the nmber of possible sample paths is at least at the order of t N, where N is the nmber of nodes in the network This crse of dimensionality makes it comptationally expensive, if not impossible, to solve the maximm likelihood problem To overcome this difficlty, we propose a sample path based approach which is discssed below D Sample Path Based Detection Instead of sing the MLE, we propose to identify the sample path X [0, t ] that most likely leads to Y, ie, X [0, t ] = arg max t,x[0,t] X t Pr X[0, t], where X t = {X[0, t] FXt = Y} The sorce node associated with X [0, t ] is then viewed as the information sorce III SAMPLE PATH BASED DETECTION ON TREE NETWORKS The optimal sample paths for general graphs are still difficlt to obtain In this section, we focs on tree networks and derive strctre properties of the optimal sample paths First, we introdce the definition of eccentricity in graph theory [6] The eccentricity ev of a vertex v is the maximm distance between v and any other vertex in the graph The Jordan centers of a graph are the nodes which have the minimm eccentricity For example, in Figre 2, the eccentricity of node v is 4 and the Jordan center is v 2, whose eccentricity is 3 Following a similar terminology, we define the infection eccentricity ẽv given Y as the maximm distance between v and any infected nodes in the graph Define the Jordan infection centers of a graph to be the nodes with the minimm infection eccentricity given Y In Figre 2, nodes v 3, v 0, v 3 and v 4 are observed to be infected The infection eccentricities of v, v 2, v 3, v 4 are 2, 3, 4, 5, respectively, and the Jordan infection center is v We will show that the sorce associated with the optimal sample path is a node with the minimm infection eccentricity We derive this reslt sing three steps: first, assming the information sorce is v r, we analyze t v r sch that t v r = arg t max t,x[0,t] PrX[0, t] v = v r,

4 Figre 2 An Example Illstrating the Infection Eccentricity ie, t v r is the time dration of the optimal sample path in which v r is the information sorce It trns ot that t v r eqals to the infection eccentricity of node v r Considering Figre 2 if the sorce is v, then the time dration of the optimal sample path starting from v is 2 In the second step, we consider two neighboring nodes, say nodes v and v 2 We will prove that if ẽv < ẽv 2, then the optimal sample path rooted at v occrs with a higher probability than the optimal sample path rooted at v 2 Finally, at the third step, we will show that given any two nodes and v, if v has the minimm infection eccentricity and has a larger infection eccentricity, then there exists a path from to v along which the infection eccentricity monotonically decreases, which implies that the sorce of the optimal sample path mst be a Jordan infection center For example, in Figre 2, node v 4 has a larger infection eccentricity than v and v 4 v 3 v 2 v is the path along which the infection eccentricity monotonically decreases from 5 to 2 A The Optimal Time Lemma Consider a tree network rooted at v r and with infinitely many levels Assme the information sorce is the root, and the observed infection topology is Y which contains at least one infected node If ẽv r t < t 2, then the following ineqality holds max PrX[0, t ] > max PrX[0, t 2], X[0,t ] X t X[0,t 2] X t 2 where X t = {X[0, t] FXt = Y} In addition, t v r = ẽv r = max I dv r,, where dv r, is the length of the shortest path between v r and and also called the distance between v r and, and I is the set of infected nodes Proof: We start from the case where the time difference of two sample paths is one, ie, we will show that max PrX[0, t] > max PrX[0, t + ] X[0,t] X t X[0,t+] X t+ 2 We divide all possible infection topologies Y into contable sbsets {Y k } where Y k is the set of infection topologies where the largest distance from v r to an infected node is k Y 0 is the topology where there is only one infected node the root node v r Note that if no infected node is observed, no algorithm performs better than a random gess To prove 2, we se indction over k Step : First, we consider the case k = 0 All the sample paths considered in step lead to observation Y Y 0 We denote by T vr the tree rooted in v r and T vr the tree rooted at bt withot the branch from v r For example, Figre 3 shows, Tv vr 2, Tv vr 3 and Tv vr 4 The sample path from time slot 0 to t restricted to T vr is denoted by X[0, t], T vr Frthermore, denote by Cv the set of children of v We have T vr v PrX[0, t] = PrX vr s = I, 0 s t PrX[0, t], T vr X vr t = I Cv r = p t Cv r PrX[0, t], T vr X vr t = I, where the last eqality holds since v r is the only infected node in the network at time t, which reqires X vr s = I for 0 s t Node Cv r has two possible states S or R Step a is ssceptible if it was not infected within t time slots In each time slot, v r tries to infect with probability q The probability that is ssceptible at time slot t is which implies that q t, PrX[0, t], T vr X vr t = I = q t 3 if X t = S Step b If is in the recovered state, we denote by t I and t R its infection and recovery times, respectively Then, we have if X t = R, PrX[0, t], T vr X vr t = I = q ti q p tr ti p Pr X[0, t], Tw t I, t R, w C where q ti q p tr ti p is the probability that node was infected at time t I, and recovered at time t R Since Tw is also an infinite tree, there exists at least one node ξ Tw sch that the node is in the ssceptible state bt its parent node say node γ is in the recovered state We denote by Tw the set of nodes that are on sbtree Tw \T γ ξ bt not on sbtree T γ ξ Then, Pr X[0, t], Tw t I, t R = Pr X[0, t], Tw \T γ ξ t I, t R Pr X[0, t], T γ ξ t I γ, t R γ = Pr X[0, t], Tw \T γ ξ t I, t R q tr γ ti γ 7 q, 8

5 Y restricted to sbtree T vr In Figre 3, T h = {Tv vr 4 } and T i = {Tv vr, Tv vr 2, Tv vr 3 } We note that given t R v r, the infection processes on the sb-trees are mtally independent Step 2a Recall that T h is the set of sbtrees having no infected nodes Following the argment for the k = 0 case, we can obtain that if T vr T h, then { q tr vr, qp q C } PrX [0, t], T vr t R v r = max Figre 3 Example of Lemma where eqation 7 holds becase ξ remained to be ssceptible dring the time slots at which γ was in the infected state and 8 holds becase t R γ t I γ The maximm vale of Pr X[0, t], Tw t I, t R can be achieved in the sample path in which was infected and then recovered in the next time slot so that w was vlnerable to infection only in one time slot Frthermore, q ti q p tr ti p is maximized when t I =, t R = 2 ie, was infected at the first time slot and recovered in the second time slot Therefore, if X t = R, PrX[0, t], T vr X vr t = I qp q C 9 Step c Define X [0, t] to be the optimal soltion to max PrX[0, t] X[0,t] X t For t =, since all Cv r are in the ssceptible state, Pr X [0, t] = p q Cvr 0 For t 2, according to 3 and 9, Pr X [0, t] { = p t max q t, qp q C } 2 Cv r Note that t is fixed in this optimization problem and 2 is a none-increasing fnction of t Since C, Pr X [0, 2] p 2 max { q 2 Cvr, qp q Cvr } < p q Cvr = Pr X [0, ] In a smmary, Pr X [0, t] is a none-increasing fnction of t [, when k = 0 Step 2: Assme 2 holds for k n, and consider k = n+ Clearly t n + for each X[0, t] sch that FX[0, t] Y n+ Frthermore, the set of sbtrees T = {T vr divided into two sbsets: T h = {T vr I = } and T i = T \T h, where YT vr Cv r } are Cv r, YT vr is the vector of when t t R v r and PrX [0, t], T vr t R v r = max { q t, qp q C } when t < t R v r So PrX[0, t], T vr t R v r is non-increasing in t given any t R v r Step 2b For T vr T i, given the sample path X[0, t + ], T vr, we will constrct a sample path X[0, t], T vr which occrs with a higher probability Denote the infection time of in sample path X[0, t], T vr by t I We let t I denote the infection time in sample path X[0, t + ], T vr If t I >, we choose t I = t I, ie, is infected one time slot later in X[0, t + ] than that in X[0, t] Assme the infection processes after was infected are the same in the two sample paths X[0, t], T vr and X[0, t + ], T vr Therefore, we have Pr X[0, t+], T vr and PrX[0, t], T vr = q t I q Pr X[0, t+], T vr t I, = q ti q PrX[0, t], T vr t I where PrX[0, t], T vr t I is the probability of X[0, t], T vr after was infected Since the sample paths X[0, t], T vr and X[0, t + ], T vr are the same after was infected, we obtain PrX[0, t], T vr Therefore, with t I = t I, we get t I = Pr X[0, t + ], T vr t I Pr X[0, t + ], T vr < PrX[0, t], T vr If t I =, we set t I = t I = Based on the indction assmption, for k n since YT vr Y m, m n, we have X[0,t],T vr max X t,t vr > max X[0,t+],T vr PrX[0, t], T vr X t+,t vr Pr X[0, t + ], T vr, where X t, T vr = {X[0, t], T vr : FX[0, t], T vr = YT vr } Therefore, given any X[0, t + ], T vr, we can always find a corresponding sample path X[0, t], T vr, which occrs with a higher probability Step 2c Now we consider the sample path X [0, t + ] and denote by t R v r the recovery time of node v r in X [0, t + ] We now constrct a sample path X[0, t] as follows: Note that we cannot apply the same argment to t I > becase ti = t I may not be feasible in a valid X[0, t]

6 If t R v r > t +, ie, v r is an infected node, then t R v r > t, where t R v r is the recovery time of v r in X[0, t] If t R v r t, we choose t R v r = t R v r If t R v r = t +, we choose t R v r = t We frther complete X[0, t] by having optimal ones on T h and constrcting the ones in T i following step 2b According to steps 2a and 2b, it is easy to verify that X[0, t] occrs with a higher probability than X [0, t + ] Therefore, we conclde that ineqality 2 holds for k = n +, hence for any k according to the principle of indction Step 3 Repeatedly applying ineqality 2, we obtain that t v r is the minimm amont of time reqired to prodce the observed infection topology The minimm time reqired is eqal to the maximm distance from v r to an infected node Therefore, the lemma holds B The Sample Path Based Estimator After deriving t v, we have a niqe t v for each v V The next lemma states that the optimal sample path starting from a node with a smaller infection eccentricity is more likely to occr Lemma 2 Consider a tree network with infinitely many levels Assme the information sorce is the root, and the observed infection topology is Y which contains at least one infected node For, v V sch that, v E, if t > t v, then PrX [0, t ] < PrX v[0, t v], where X [0, t ] is the optimal sample path starting from node Proof: Recall that T v denotes the tree rooted at v and T v denotes the tree rooted at bt withot the branch from v Frthermore, Cv is the set of children of v, and X[0, t], T v is the sample path X[0, t] restricted to T v Step : The first step is to show t = t v + First we claim Tv I Otherwise, all infected node are on T v Since on a tree, v can only reach nodes in T v throgh edge, v, t v = t +, which contradicts t > t v If T v I, a T v I, we have and b T v I, Hence, which implies that d, a = dv, a t v, d, b = dv, b + t v + t t v +, t v < t t v +, ie, t = t v + If T v I =, all infected nodes are in Tv, so it is obvios t = t v + Step 2: In this step, we will prove that t I v = on the sample path X [0, t ] If t I v > on X [0, t ], then t t I v = t v + t I v < t v Note that according to the definition of t and t I v, within t t I v time slots, node v can infect all infected nodes on Tv Since t = t v +, the infected node farthest from node mst be on Tv, which implies that there exists a node a Tv sch that d, a = t = t v + and dv, a = t v So node v cannot reach a within t t I v time slots, which contradicts the fact that the infection can spread from node v to a within t t I v time slots along the sample path X[0, t ] Therefore, t I v = Step 3: Now given sample path X [0, t ], we constrct X v [0, t v] which occrs with a higher probability We divide the sample path X [0, t ] into two parts along sbtrees T v and Tv Since t I v =, we have PrX [0, t ] = q Pr X [0, t ], T v t I v = Pr X [0, t ], T v, where q is the probability that v is infected at the first time slot Sppose in X v [0, t v], node was infected at the first time slot, then PrX v [0, t v] = q Pr X v [0, t v ], T v Pr X v [0, t v ], T v t I = For the sbtree Tv, in which t I v =, we constrct the partial sample path X v [0, t v], T to be identical to X [0, t ], Tv one time slot earlier, ie, X v [0, t v ], T v, given X [0, t ], T v v except that all events occr = X [, t ], Tv This is feasible becase t v = t Then Pr X [0, t ], Tv t I v = = Pr X v [0, t v ], Tv that For the sbtree T v X v [0, t v], T v arg max X[0,t v ],T v X t v Based on Lemma, we have X[0,t v ],T v max X t v max Pr v,t X[0,t v ],T X t v,t > max X[0,t v ],T X t v,t, we constrct X v [0, t v], T v sch v,t Pr X [0, t v ], T v t I = X [0, t v ], T v Pr t I = = X [0, t ], T v t I = Pr X [0, t ], T v Therefore, given the optimal sample path rooted at, we have constrcted a sample path rooted at v which occrs with a higher probability The lemma holds Next, we give a sefl property of the Jordan infection centers in the following lemma Lemma 3 On a tree network with at least one infected node, there exist at most two Jordan infection centers When the network has two Jordan infection centers, the two mst be neighbors

7 Proof: First, we claim if there are more than one Jordan infection centers, they mst be adjacent Sppose v, V are two Jordan infection centers and ẽv = ẽ = λ Sppose v and are not adjacent, ie, dv, > Then, there exists w V sch that dw, =, and dw, v = dv,, ie, w is a neighbor of and is on the shortest path between and v Note in a tree strctre w is niqe If I T w =, then a I, dw, a = d, a < d, a, which contradicts the fact that is a Jordan infection center If I T w Since b I T w, ie, dv, b = dv, w + dw, b, dw, b = dv, b dv, w λ On the other hand, since ẽ = λ, h T w I, In a smmary, h I, dw, h = d, h λ dw, h λ, which contradicts the fact that the minimm infection eccentricity is λ Therefore all Jordan infection centers mst be adjacent to each other However, sppose there exist n infection eccentricity centers where n > 2, they wold form a cliqe with n nodes which contradicts the fact that the graph is a tree Therefore, there exist at most two adjacent Jordan infection centers Based on Lemma 2 and Lemma 3, we finish this section with the following theorem Theorem 4 Consider a tree network with infinitely many levels Assme that the observed infection topology Y contains at least one infected node Then the sorce node associated with X [0, t ] the soltion to the optimization problem is a Jordan infection center, ie, v = arg min v V ẽv Proof: We assme the network has two Jordan infection centers: w and, and assme ẽw = ẽ = λ The same argment works for the case where the network has only one Jordan infection center Based on Lemma 3, w and mst be adjacent We will show for any a V\{w, }, there exists a path from a to or w along which the infection eccentricity strictly decreases Step : First, it is easy to see from Figre 4 that dγ, w λ γ Tw I We next show that there exists a node ξ sch that the eqality holds Figre 4 A Pictorial Description of the Positions of Nodes a,, w and ξ Sppose that dγ, w λ 2 for any γ Tw I, which implies dγ, λ γ T w I Since w and are both Jordan infection centers, we have γ T w I, In a smmary, γ I, dγ, w λ dγ, λ dγ, λ This contradicts the fact that ẽw = ẽ = λ Therefore, there exists ξ Tw I sch that dξ, w = λ Step 2: Similarly, γ T w I, dγ, λ, and there exists a node sch that the eqality holds Step 3: Next we consider a V\{w, }, and assme a T w and da, = β Then for any γ Tw I, we have da, γ = da, + d, w + dw, γ β + + λ = λ + β, and there exists ξ Tw I sch that the eqality holds On the other hand, γ T w I Therefore, we conclde that da, γ da, + d, γ β + λ ẽa = λ + β, so the infection eccentricity decreases along the path from a to Step 4: Repeatedly applying Lemma 2 along the path from node a to, we can conclde that the optimal sample path rooted at node is more likely to occr than the optimal sample path rooted at node a Therefore, the root node associated with the optimal sample path X [0, t ] mst be a Jordan infection center, and the theorem holds

8 IV REVERSE INFECTION ALGORITHM Since in tree networks with infinitely many levels, the estimator based on the sample path approach is a Jordan infection center, we view the Jordan infection centers as possible candidates of the information sorce We next present a simple algorithm to find the information sorce in general networks The algorithm is to first identify the Jordan infection centers, and then break ties based on the sm of distances to infected nodes The key idea of the algorithm is to let every infected node broadcast a message containing its identity ID to its neighbors Each node, after receiving messages from its neighbors, checks whether the ID in the message has been received If not, the node records the ID say v, the time at which the message is received say t v, and then broadcasts the ID to its neighbors When a node receives the IDs of all infected nodes, it claims itself as the information sorce and the algorithm terminates If there are mltiple nodes receiving all IDs at the same time, the tie is broken by selecting the node with the smallest t v The tie-breaking rle we proposed is to choose the node with the maximm infection closeness [7] The closeness measres the efficiency of a node to spread information to all other nodes The closeness of a node is the inverse of the sm of distances from the node to any other nodes In or model, we define the infection closeness as the inverse of the sm of distances from a node to all infected nodes, which reflects the efficiency to spread information to infected nodes We select a Jordan infection center with the largest infection closeness, breaking ties at random Algorithm Reverse Infection Algorithm for i I do i sends its ID ω i to its neighbors end for while t and STOP== 0 do for V do if receives ω i for the first time then Set t i = t and then broadcast the message ω i to its neighbors If there exists a node who received I distinct messages, then set ST OP == end if end for end while retrn = arg min S i I t i, where S is the set of nodes who receive I distinct messages when the algorithm terminates Ties are broken at random It is easy to verify that the set S is the set of the Jordan infection centers The rnning time of the algorithm is eqal to the minimm infection eccentricity and the nmber of messages each node receives/sends dring each time slot is bonded by its degree V PERFORMANCE ANALYSIS The reverse infection algorithm is based on the strctre properties of the optimal sample paths on trees While the MLE is the node that maximizes the likelihood of the snapshot among all possible nodes, the sample path based estimator does not have sch a garantee To demonstrate the effectiveness of the sample path based approach, we next show that on g + -reglar trees where each node has g + neighbors, the information sorce generated by the reverse infection algorithm is within a constant distance from the actal sorce with a high probability, independent of the nmber of infected nodes and the time at which the snapshot Y was taken Theorem 5 Consider a g + -reglar tree with infinitely many levels where g > 2 and gq > Assme that the observed infection topology Y contains at least one infected node Given ɛ > 0, there exists d ɛ sch that the distance between the optimal sample path estimator and the actal sorce is d ɛ with probability ɛ, where d ɛ is independent of the nmber of infected nodes and the time the snapshot Y was taken Proof: Consider the tree rooted at the information sorce v We say v is at level 0 We denote by Z l the set of infected and recovered nodes at level l Frthermore, we define Zl τ to be the set of infected and recovered nodes at level l whose parents are in set Zl τ and who were infected within τ time slots after their parents were infected We assme Z0 τ = {v } In addition, let Z l = Z l and Zl τ = Zl τ Note lim τ Zτ l = Z l, and given v and Z τ l, t I v t I lτ, ie, the infection times of nodes in Zl τ differ by at most lτ note that the difference is not τ since the parents of and v may be infected at different times Or proof is based on the Galton Watson GW branching process [8] A GW branching process is a stochastic process Bl which evolves according to the recrrence formla B0 = and Bl = Bl where {ζ i } is a set of random variables, taking vales from nonnegative integers The distribtion of ζ i is called the offspring distribtion of the branching process In a g + - reglar tree, the evoltion of Zl τ is a branching process, where the offspring distribtion is a fnction of τ We se B τ to denote the corresponding branching process, and B τ l to denote the nmber of offsprings at level l, ie, B τ l = Zl τ we se these two notations interchangeably Given a node is in the infected state for t time slots, the nmber of infected offsprings follows a binomial distribtion Note the following two facts: i= ζ i,

9 Figre 5 A pictorial description of the positions of v, ṽ,, and w The nmber of time slots at which a node is in the infected state follows a geometric distribtion with parameter p A child remains to be ssceptible with probability q τ when the parent has been in the infected state for τ time slot Therefore, the offspring distribtion of the branching process B τ at level 2 is Prγ = i τ g = p t p q t i q tg i i t= τ g + p t p q τ i q τg i, i t= where γ is the nmber of offsprings of a node The offspring distribtion of branching process B is Prγ = i g = p t p q t i q tg i i t= Each infected node can be viewed the sorce of branching processes on the sbtree rooted at the node We define K l to be the nmber of srvived B branching processes whose roots are in set Zl τ, where a branching process srvives if it never dies ot Now given L 2, we consider the following events: Event : Z L = 0 Event 2: K l 2 for some l L In other words, at least two B branching processes starting from Zl τ srvive for some l L We note that these two are disjoint events When Z l = 0, no node at level L is infected and the infection process terminates at level L When there is at least one infected node in Y, since ẽv L, the minimm infection eccentricity is at most L Therefore, the distance between v and v is no more than 2L 2 The sorce node has g + children while other nodes have g children Given K l 2 for some l L, we will arge that the distance between the sample path based estimator and the actal one is pper bonded by τ + L Consider Figre 5, where the shaded nodes are infected and recovered nodes We will show that if two B branching processes starting from l L srvive, a node at level τ+l cannot be a Jordan infection center Recall that at time t, the distance between any infected node and the actal sorce is no more than t, which implies the eccentricity of a Jordan infection center is t Now consider a node ṽ at level τ + l Recall that at least two B branching processes starting from level l srvive Let Zl τ be the root of a srvived B branching process, and assme node ṽ is not on the sbtree rooted at Frther, assme v is an infected node at the lowest level on sb-tree T w Since the branching process B srvives, the infection process propagates one level lower at each time slot and node v is at level l + t t I From Figre 5, it is easy to see that the distance between v and ṽ is at least t t I τ + l l = t t I + τl +, which occrs when the first common predecessor of nodes v and ṽ is at l level Note that the common predecessor cannot appear at level l since ṽ is not on T w Since Zl τ, the infection time of node is no later than τl, ie, t I τl Therefore, the distance between v and ṽ is at least t +, which is larger than t Hence, v cannot be a Jordan infection center Since l L, any node at or below level τ + L cannot be a Jordan infection center In a smmary, if event 2 occrs, then we have dv, v τ + L We next show that given any ɛ, we can find sfficiently large τ and L, independent of t and the nmber of infected nodes, sch that the probability that either event or event 2 occrs is at least ɛ Given n 0 > 0 and τ > 0, we define l = min {l : Z τ l > n 0 }, ie, l is the first level at which B τ has more than n 0 nodes We first have PrZ L = 0 + Pr K l 2 for some l L PrZ L = 0 + Pr K l 2 and l L = PrZ L = 0 + Pr l L Pr K l 2 l L L = PrZ L = 0 + Pr {Zi τ > n 0 } Pr K l 2 l L i= L L Pr {0 < Zi τ n 0 } Pr {Zi τ = 0} i= Pr K l 2 l L + PrZ L = 0 i=

10 Note that we have PrK l 2 l L L = PrK l 2 l = l Prl = l l L 3 l= According to Lemma 6, given any ɛ > 0, we can find a sfficiently large n 0 sch that PrK l 2 l = l ɛ, which implies that for sfficiently large n 0, We can then conclde PrK l 2 l L ɛ PrZ L = 0 + Pr K l 2 for some l L L Pr {0 < Zi τ n 0 } ɛ i= L Pr {Zi τ = 0} + PrZ L = 0 i= L = Pr {0 < Zi τ n 0 } ɛ i= + PrZ L = 0 PrZ τ L = 0, where Pr L i= {Zτ i = 0} = PrZL τ = 0 becase Zτ l = 0 implies that ZL τ = 0 for l L According to Lemma 7 and Lemma 8, given any ɛ 2 > 0 and ɛ 3 > 0, there exist sfficiently large τ and L sch that L Pr {0 < Zi τ n 0 } > ɛ 2, and Hence, we have i= PrZ L = 0 PrZ τ L = 0 ɛ 3 PrZ L = 0 + Pr K l 2 for some l L ɛ ɛ 2 ɛ 3 Now choosing ɛ = ɛ 2 = ɛ 3 = ɛ 4 /3 for some ɛ 4 > 0, we have PrZ L = 0 + Pr K l 2 for some l L ɛ 4 Since E 2 implies that Y =, we have PrE Y = + Pr E 2 Y = = Pr Y = PrE { Y = } + Pr E 2 = Pr Y = PrE PrE { Y = 0} + Pr E 2 Pr Y = PrE Pr{ Y = 0} + Pr E 2 Pr Y = Pr{ Y = } ɛ 4 ɛ 4 = Pr Y = Note that Pr Y = is a positive constant since the B branching process starting from the information sorce srvives with non-zero probability The theorem holds by choosing ɛ 4 = ɛ Pr Y = Lemma 6 Consider n 0 iid GW branching processes with a binomial offspring distribtion with parameters g and q sch that gq > Denote by K the nmber of branching processes that srvive Given any ɛ > 0, if then n 0 8 log ɛ ρ, PrK 2 ɛ, where ρ is the extinction probability of the GW branching process In the binomial case, ρ is the smallest non-negative root of eqation ρ = q + qρ g Proof: The extinction probability of a GW branching process is denoted by ρ, which is the smallest none negative root of eqation ρ = Gρ according to [8], where Gρ is the moment generating fnction of offspring distribtion In the binomial case we have Gρ = q + qρ g ρ < when gq > We define a Bernolli random variable H i, for the i th branching process sch that {, if the ith branching process srvives; H i = 0, otherwise So K = n 0 i= H i, and E[K] = n 0 ρ According to the Chernoff bond [9], we have PrK δ ρn 0 < e ρn 0 δ2 2 Now let Y denote the nmber of infected nodes in the Choose δ = 05 The Lemma holds if observation Y Define events E = {Z L = 0} and E 2 = ρn 0 /2 2, {K l 2 for some l L} We have and PrE Y = + Pr E 2 Y = ρn 0 /8 log /ɛ = Pr Y = PrE { Y = } + Pr E 2 { Y = }

11 Lemma 7 Given any ɛ > 0, there exists a constant L sch that for any L L, L Pr {0 < Zi τ n 0 } ɛ i= Proof: Define p τ to be the probability that a node infects at least one of its children if it is in the infection state for τ time slots We have and τ p τ = p t p q gt t= + p τ q gτ, Pr0 < Z τ l n 0 0 < Z τ l n 0 PrZ τ l > 0 0 < Z τ l n 0 p τ n0, which implies that L Pr 0 < Zi τ n 0 i= = Pr0 < Z τ L n 0 0 < Z τ L n 0 Pr0 < Z τ L n 0 0 < Z τ L 2 n 0 Pr0 < Z τ 2 n 0 0 < Z τ n 0 Pr0 < Z τ n 0 p τ n0 L The lemma holds by choosing L = log ɛ log p τ n0 Lemma 8 Given any ɛ, there exist τ and L sch that for any τ > τ and L > L PrZ L = 0 PrZ τ L = 0 ɛ Proof: Note the difference can be re-written as PrZ L = 0 PrZ τ L = 0 = PrZ L =0 PrZ =0+PrZ τ =0 PrZ τ L =0 + PrZ = 0 PrZ τ = 0 Step Since {Z τ L = 0} {Zτ = 0}, Step 2 We know PrZ τ = 0 PrZ τ L = 0 0 lim PrZ L = 0 = PrZ = 0 L Then for ɛ/2 > 0, there exists L sch that for any L L, PrZ L = 0 PrZ = 0 ɛ/2, which implies that PrZ L = 0 PrZ = 0 ɛ/2 Step 3 In this step, we will show lim τ PrZτ = 0 = PrZ = 0 Define the generating fnctions of the offspring distribtions of B τ and B to be G τ s and Gs, respectively We know that G τ s s and Gs s are convex fnctions when s [0, ] Let ρ = PrZ = 0, ie, the extinction probability, we know that ρ is the smallest nonnegative root of Gρ = ρ and ρ < Similarly, define ρ τ = PrZ τ = 0, and ρ = lim τ ρ τ Taking limit on both sides of G τ ρ τ = ρ τ, we have Note that for any τ, so Gρ = ρ ρ ρ τ ρ < ρ ρ ρ < Since Gs s = 0 has at most two soltions in [0, ] and s = is one of them, we conclde ρ = ρ Therefore, for given ɛ/2 > 0, there exists τ τ sch that PrZ = 0 PrZ τ = 0 ɛ/2 Hence, the lemma holds VI SIMULATIONS In this section, we evalate the performance of the reverse infection algorithm on different networks, inclding different tree networks and some real world networks A Tree Networks In this section, we evalate the performance of the reverse infection algorithm on tree networks We compare the reverse infection algorithm with the closeness centrality heristic, which selects the node with the maximm infection closeness as the information sorce Note that the node with the maximm closeness is the maximm likelihood estimator of the information sorce on reglar trees nder the SI model [3] [5] Small-size tree networks: We first stdied the performance on small-size trees The infection probability q was chosen niformly from 0, and the recovery probability p was chosen niformly from 0, q The infection process propagates t time slots where t was niformly chosen from [3, 5] To keep the size of infection topology small, we restricted the total nmber of infected and recovered nodes to be no more than 00 For small-size trees, we first calclated the MLE sing dynamic programming for fixed t and then searching over t [0, t max ] for a large vale of t max to find the optimal estimator The detection rate is defined to be the fraction of experiments in which the estimator coincides with the actal sorce We varied g from 2 to 0 and the reslts are shown in Figre

12 Detection Rate % MLE Degree RI CC Detection Rate % RI CC Figre 6 The Detection Rates of the Maximm Likelihood Estimator MLE, Reverse Infection RI and Closeness Centrality CC on Reglar Trees 6 We can see that the detection rate of the reverse infection algorithm is almost the same as that of the MLE, and is higher than that of the closeness centrality heristic by approximately 20% when the degree is small and by 0% when the degree is large Detection Rate % RI CC Degree Figre 7 The Detection Rates of the Reverse Infection RI and Closeness Centrality CC Algorithms on Reglar Trees 2 General g-reglar tree networks: We frther condcted or simlations on large-size g-reglar trees The infection probability q was chosen niformly from 0, and the recovery probability p was chosen niformly from 0, q The infection process propagates t time slots where t was niformly chosen from [3, 20] We selected the networks in which the total nmber of infected and recovered nodes is no more than 500 We varied g from 2 to 0 Figre 7 shows the detection rate as a fnction of g We can see the detection rates of both the reverse infection and closeness centrality algorithms increase as the degree increases and is higher than 60% when g > 6 However, he detection rate of the reverse infection algorithm is higher than that of the closeness centrality algorithm, and the average difference is 886% 3 Binomial random trees: In addition, we evalated the performance on binomial random trees where the nmber of children of each node follows a binomial distribtion with Figre 8 The Detection Rates of the Reverse Infection RI and Closeness Centrality CC Algorithms on Binomial Random Trees Percentage% Distance RI Random Figre 9 The Performance of the Reverse Infection RI on the Internet Atonomos Systems Network nmber of trials g and sccess probability β We fixed g = 0 and varied β from 0 to 09 The drations of the infection process and the observed infected networks were selected according to the same rles for the g-reglar tree case The reslts are shown in Figre 8 Similar to the reglar tree case, as β increases, the tree is more denser which increases the nmber of srvived branching processes and the detection rate The reverse infection algorithm otperforms the closeness centrality algorithm by 06% on average B Real World Networks We next condcted experiments on three real world networks the Internet Atonomos Systems network IAS 3, the Wikipedia who-votes-on-whom network Wikipeida 4, and the power grid network PG 4 We compare the reverse infection algorithm with random gessing, which randomly selects a node and declares it as the information sorce In these networks, the infection probability q was chosen niformly from 0, 005 and the recovery probability p was chosen niformly from 0, q Here we chose small infection probabilities since the network was of finite size so the infection process shold be controlled to make sre that not all nodes were infected when the network was observed The dration t was an integer niformly chosen from [3, 200] We selected the networks in 3 Available at 4 Available at mejn/netdata/

13 Percentage% Distance RI Random Figre 0 The Performance of the Reverse Infection RI on the Wikipedia Who-Votes-on-Whom Network Percentage% RI Random Distance Figre The Performance of the Reverse Infection RI on the Power Grid Network which the total nmber of infected and recovered nodes was in the range of [50, 500] The Internet atonomos systems network: Figre 9 shows the reslts on the the Internet atonomos systems network An Internet atonomos system is a collection of connected roters who se a common roting policy The Internet atonomos system network is obtained based on the recorded commnication between the Internet atonomos systems inferred from Oregon rote-views on March, 3st, 200 The network consists of 0,670 nodes and 22,002 edges According to Figre 9, more than 80% of the estimators identified by the reverse infection algorithm are no more than two hops away from the actal sorces, comparing to 0% nder the random gessing 2 The Wikipedia who-votes-on-whom network: Figre 0 shows reslts on the Wikipedia who-votes-on-whom network, in which two nodes are connected if one ser voted on the other in the administrator promotion elections The network has 00,736 links and 7,066 nodes We have similar observations as for the Internet atonomos systems network: the majority of the estimators prodced by the reverse infection algorithm are no more than two hops away from the actal sorces; and only less than 20% of the estimators of random gessing are within two hops from the actal sorces 3 The power grid network: Figre shows the reslts on the power grid, which has 4,94 nodes and 6,594 edges As we can see, the reverse infection algorithm performs better than the random gessing The peak of the reverse infection algorithm appears at the third hop verss the seventeenth hop nder random gessing VII CONCLUSION In this paper, we developed a sample path based approach to find the information sorce nder the SIR model We proved that the sample path based estimator is a node with the minimm infection eccentricity Based on that, a reverse infection algorithm has been proposed We analyzed the performance of the reverse infection algorithm on reglar trees, and showed that with a high probability the distance between the estimator and actal sorce is a constant, independent of the nmber of infected nodes and the time the network was observed We evalated the performance of the proposed reverse infection algorithm on several different network topologies q p v v dv, Cv ẽv t v t I v t R v Y T v APPENDIX A NOTATION TABLE the probability an infected node infects its neighbors the probability an infected node recovers the actal information sorce the estimator of the information sorce the length of shortest path between node v and node the set of children of node v the infection eccentricity of node v the time dration associated of the optimal sample path in which node v is the information sorce the infection time of node v the recovery time of node v the snapshot of all nodes the tree rooted at node bt withot the branch from v the state of node v at time t the states of all nodes at time t X v t Xt X[0, t] the sample path from 0 to t X[0, t], T v the sample path from time slot 0 to t X t restricted to T v the set of all valid sample path from time slot 0 to t X t, T v the set of all valid sample path from time I slot 0 to t restricted to T v the set of the infected nodes REFERENCES [] C Moore and M E J Newman, Epidemics and percolation in smallworld networks, Phys Rev E, vol 6, no 5, pp , 2000 [2] A Ganesh, L Massolie, and D Towsley, The effect of network topology on the spread of epidemics, in Proc IEEE Int Conf Compter Commnications INFOCOM, Miami, FL, Mar 2005, pp [3] D Shah and T Zaman, Detecting sorces of compter virses in networks: Theory and experiment, in Proc Ann ACM SIGMETRICS Conf, New York, NY, 200, pp [4], Rmors in a network: Who s the clprit? IEEE Trans Inf Theory, vol 57, pp , Ag 20 [5], Rmor centrality: a niversal sorce detector, in Proc Ann ACM SIGMETRICS Conf, London, England, UK, 202, pp [6] N T J Bailey, The mathematical theory of infectios diseases and its applications Hafner Press, 975