*2.1. Anomaly Detection*

Anomaly detection is to identify points which are significantly different from other data [3,15]. For example, in the field of social analysis [16–18], anomalies refer to users with anomalous behaviors compared to the general public. They may be robots or highly active anomalous users [19]. Its core is how to identify the real anomalous points and avoid the wrong partition. With the input of data, we can ge<sup>t</sup> the results, like scores or labels. It is a very important issue in various fields, and many methods and tools are proposed. One of them is supervised machine learning methods [2,20], using tag data training model to classify the data. Another one is unsupervised machine learning methods [1,21,22], with no training data and thus has been widely used. H. Shao et al. use multi-modal microblog content features with analysis of propagation patterns to determine veracity of microblog observations [22]. However, because of the lack of an objective evaluation system, both of them is hard to evaluate. Therefore, an increasing number of experts and scholars tend to apply visualization analysis to anomaly detection. Histogram visualization is the most mature and popular method [23] due to its easy and intuitive to use. Especially in fraud detection and denning, their behavior is easy to capture and model into

histogram [24,25]. Thom et al. design a visualization system for detecting anomalies based on label cloud [10]. N. Cao et al. propose a visualization system detecting anomalous users via Twitter [8]. Our system compares to them, based on ego central network to analyze the relationship between egos and alters, using a novelty design to explore users' behavior effectively. The LOF algorithm we use can quantify the user's anomalies into scores rather than just a single label, which is very helpful for the follow-up work. Besides, our system can be used in all social communication records.

### *2.2. Social Network Visualization and Analysis*

With the analysis of social network, we can know individuals, groups or the whole network in a more effective way [12,26]. There are many kinds of topics in social network research, such as character recognition [27], information diffusion research [22,28,29], group detection [30], etc. Z. Qin et al. use homophily to increase the diffusion accuracy in social network [22]. J. Gao et al. find that the volatility of weak ties is very important for a person to make decisions and information diffusion [29]. Visualization methods are used extensively in social networks to enable intuitive research on abstract networks [31]. Zbigniew Tarapata et al. consider applying multicriteria weighted graphs similarity (MWGSP) method to examine some properties of social networks [32]. Vincent D Blondel et al. survey the contributions made so far on the social networks and explore large-scale anonymized datasets [33]. Jian Zhao et al. incorporate machine learning algorithms to detect anomalies and present an interactive visual analysis system called FluxFlow, which also offers visualization designs for presenting the detected threads for deeper analysis [34]. Based on node link network, J.Heer et al. design a system to explore the large graph structures using visualization [35]. Nardi et al. utilize colors to distinguish the communities that exist in users' email contacts [36]. Mutton's PieSpy gives us the opportunity to research the real-time dynamic community visualization in Internet-based chat systems [37].

However, all of the above studies are focused on a specific social network, which causes to a result that one research can only be used for one purpose, and does not have good scalability and generality. As is stated above, with the development of the Internet, there have been various social communication platform, which also leads to the complexity and heterogeneity of social data. N. Cao et al. proposed an initiator-centric model and a responder-centric model to tackle this problem [38]. Based on their study, we design an ego centric based model to crush this challenge.

### *2.3. Ego Centric Network Visualization and Analysis*

Ego centric network analysis has been widely applied in anthropology and sociology. In the method, it assumes that one node called ego is in the center, and some nodes around it called alters. From the ego centric network, we can have a deeper understanding of interested nodes, obtaining the ego's behavior and the structure with alters [39,40]. Mesoscopic and microscopic perspectives are two common starting points in it [4]. On the one hand, many researchers study the network structure and attributes of one or part of egos from a mesoscopic perspective. It is found that network size has a large effect on ego's features and the composition of the network [41]. In Lubbers et al. research, they summarized that how long a relationship can be maintained depends mainly on the strength of the relationship, the density of the network [42]. On the other hand, the microscopic level focus on network properties, alters and their behaviors' effect to the ego. L. Backstrom et al. found that the intimacy between couples can be indirectly determined based on the relationship between their mutual friends [19].

Nowadays, more and more researchers use advanced visualization methods to reveal more patterns in ego central network [43]. Shi et al. show the time dimension and the ego network's structure by a 1.5D form [44]. Node-link model is the most commonly used visualization method in ego centered networks [4,45,46], where each vertex represents a person and each edge represents the strength of the relationship between two vertices. However, this method does not directly reflect the relationship between each alter and ego, and as the number of vertices increases, visual clutter will become serious. Different from the above studies, our system uses a novel glyph based on the

solar, and is more intuitive to study the topology of the network and the relationship between egos and alters.
