Mining the best observational window to model social phenomena

The structure and behavior of organizations can be learned by mining the event logs of the information systems they manage. This supports numerous applications, such as inferring the structure of social relations, uncovering implicit workflows, and detecting illicit behavior. However, to date, no clear guidelines regarding how to select an appropriate time period to perform organizational modeling have been articulated. This is a significant concern because an inaccurately defined period can lead to incorrect models and poor performance in data-driven applications. In this paper, we introduce a data-driven approach to infer the optimal time period for organizational modeling. Our approach 1) represents the system as a social network, 2) decomposes it into its respective principal components, and 3) optimizes the signal-to-noise ratio over varying temporal observation windows. In doing so, we minimize the variance in the organizational structure while maximizing its patterns. We assess the capability of this approach using an anomaly detection scenario, which is based on the patterns learned from the interactions documented in audit logs. The classification performance of two known algorithms is investigated over a range of time periods in two representative datasets. First, we use the electronic health record access logs from Northwestern Memorial Hospital to demonstrate that our framework detects a period that coincides with the optimal performance of the anomaly detection algorithms. Second, we assess the generalizability of the framework through an analysis with a less clearly defined organization, in the form of the social network inferred from the DBLP co-authorship dataset. The results with this data further illustrate that our framework can discover the optimal time period in the context of a more loosely organized group.