Group anomaly detection in mobile app usages: A spatiotemporal convex hull methodology

Analysing mobile apps communications can unleash significant information on both the communication infrastructure state and the operations of mobile computing services. A wide variety of events can engender unusual mobile communication patterns possibly interesting for pervasive computing applications, e.g., in smart cities. For instance, local events, national events, and network outages can produce spatiotemporal load anomalies that could be taken into consideration by both mobile applications and infrastructure providers, especially with the emergence of edge computing frameworks where the two environments merge. Being able to detect and timely treat these anomalies is therefore a desirable feature for next-generation cellular and edge computing networks, with regards to security, network and application performance, and public safety. We focus on the detection of mobile access spatiotemporal anomalies by decomposing, aggregating and grouping cellular data usage features time series. We propose a methodology to detect first raw anomalies, and group them in a spatiotemporal convex hull, further refining the anomaly detection logic, with a novel algorithmic framework. We show how with the proposed framework we can unveil details about broad-category mobile events timeline, their spatiotemporal spreading, and their impacted apps. We apply our technique to extensive real-world data and open source our code. By linkage with ground-truth special events that happened in the observed period, we show how our methodology is able to detect them. We also evidence the existence of five main categories of anomalies, finely characterising them. Finally, we identify global patterns in the anomalies and assess their level of unpredictability, based on the nature of the impacted mobile applications.