*6.3. Ego View*

Through the analysis of the group view, experts can pick out the points they want to continue analyze. In this view, we need to display the relationship between the ego and all his/her alters, so that experts can explore through a sociological perspective. Figure 4d is the ego view of our system. It consists of two parts: An ego network glyph based on solar system and an ego's portrait.

**Figure 4.** The overview of egoDetect based on the call record data. The user interface consists of six parts: (**a**) The distribution of users with their features, (**b**) a list sorted by users' anomaly scores, (**c**) statistical information for each segment, (**d**) the ego network glyph inspired from solar system, (**e**) the statistical view of ego's active time and behavior, (**f**) the detail view about the contact between the ego with each alter.

Ego Network Glyph. As mentioned above, we design a novel glyph to reveal the patterns between egos and alters. Figure 4d is our solar network glyph. Each alter is a node surrounding by the ego. The distance between the ego and an alter and the radius of the node represents the relationship between them. The grey transparent ring in each track tells us the proportion of local alters' number to the total number in this track, and the nodes in it mean they are the local alters, while the nodes not in it mean the alien alters. Above all, it can give us an intuitive and detailed understanding of the

internal structure and circumstances of an ego network (T3). It is worth noting that how to code alters, as an important part of the network, is a very important issue. We consider three alternatives to visual encodings of each alter, showing in Figure 5. In the first design, the inner ring shows the count of contact-in and the contact-out, like the count of contacts in Twitter, while the outer ring is the value of the inner ring, such as time spending on calls. We also use the line color to show the anomaly score of the alter. However, when the circle is too small to see, it is hard to ge<sup>t</sup> the color of the line. The second design uses the inner and outer circle radii to encode the information of alters, and the center circle represents the anomaly score of them. When the alters become large, we find it is sometimes confused about the color coding. The third design is based on the bar chart, where each column represents one information of the alter. It is limited by shape. When the amount of data is large, the data clutter is serious. While all three designs have some drawbacks, we finally used the first design after careful consideration. Because there are egos contact with many alters in social networks, we need to make sure that they are still as clear as possible when they are presented (T3).

Portrait Glyph. Through the contact data of ego, we can conclude the various characteristics of the ego and they can help us judge whether the ego is abnormal. In addition to some common indicators, like total count of contact-in and contact-out, we introduce average relationship strength with alters, average anomaly score of alters ,local alters and alien alters, unidirectional and bidirectional alters features into the system. The average relationship strength with alters helps us analyze ego's behavior patterns. Many anomalous egos are machine users generated by software, so there will be many similar behavior patterns and like to contact with each other. Besides, for advertisers, they tend to contact-out more than contact-in and have little bidirectional alters, leading to a low level of average relationship strength with alters, which can respond from these attributes. The local alters , alien alters and unidirectional and bidirectional alters properties help us to understand the egos' alters' structure. Normal egos are more likely to contact people who have similar interests and hobbies with them and the proportion of unidirectional and bidirectional alters should be balanced. The average anomaly score of alters can tell us how the average anomaly of alters is. As mentioned above, machine users will contact other machine users. If an ego's alters' anomaly is high, the ego can also be considered an anomalous user. In the solar network layout, the ego's information is located in the middle of the whole network (T4). In order to better display ego's data from multiple dimensions, we choose the radar map as the center of the whole layout. All features of the user are mapped to each direction of the radar map, and the center of each direction means the minimum while the outside means the maximum. The color of the area represents the anomaly score of the ego. As shown in Figure 6, radar maps can simply and directly highlight important information.
