**1. Introduction**

Social communication is a necessary part of people's daily life. However, it seems that we suffer from all kinds of harassment every day, like sales phone calls, robots, harassment on social platform and so on. These seriously affect our daily life. Therefore, this has led to the development of anomaly detection. To best of our knowledge, the majority of the anomaly detection methods can be divided into two categories: unsupervised [1] and supervised [2] methods. However, there are still many challenges in anomaly detection. Firstly, the valid and objective tag data is hard to gain [3]. If we collect them all manually, it will take a long time and make the data more subjective and likely to lose their meaning. The number of anomalies is usually small and anomalies come in a variety of forms [3]. Besides, in practical use, we can only infer from the behavior or some characteristics of a user in the network without knowing exactly whether he or she is an abnormal user or not, which poses a greater challenge to the accuracy of anomaly detection.

Social network is a durable research topic, and theories for analyzing social networks are also emerging, such as the structural hole theory [4], egocentric network and Dunbar's number [5]. Dunbar and Zhou discovered through research that an ordinary person's social network is hierarchical [6,7], which means that if a person lacks this hierarchical structure, it is very likely that he or she is an anomalous user. In addition, the egocentric network allows experts to start by the topology and have an intuitive understanding of the user's network, which is very helpful in identifying anomalies in social networks [8].

Visualization has a huge impact on evaluating data analysis results and mining data, and can help provide additional evidence to support ideas and conclusions. It also allows users to access the information and discover hidden connections in the data quickly by mapping the data into recognizable graphics. Therefore, it has been widely used in various fields, such as anomaly detection [9–11], social analysis [12–14] and so on. However, to design a general and effective visualization is a difficult problem, especially for anomaly detection in social networks. As the types of social network data are diverse, containing text, audio files, and video files, etc, it is hard to design a suitable model to cover all of them.

Combining the above questions and thoughts, we design a novel visualization system, egoDetect, which can explore anomalies from both global and local perspectives, and then, combine the time series to analyze users' anomalies from multiple perspectives. It can detect anomalies in the data of social networks without tags. egoDetect based on ego central network provides three views for exploring and analyzing suspicious users. (1) A macroscopic view using the features of egos, analyzes all the egos' degree of anomaly and displays from a group level. (2) Inspired by the solar, we propose a mesoscopic view to explore the nodes we are interested in. We can learn the topology of egos with alters and the characteristics of them from an ego central network perspective. (3) We also provide a microscopic view to reveal the behavior patterns and hobbies of the ego and the detail of the ego with a specific alter. In summary, our system can analyze users from three levels from multi-perspective. We also add friendly and intuitive interactions to help experts quickly ge<sup>t</sup> the information they want.

Our contributions in this paper as follows:

