

![0_image_0.png](0_image_0.png)

Ranking of the observation data can be calculated from the value of eq.(14). The i-th most suspicious data is given by dσ(i) in eq.(15). Suspiciousness s(dσ(i)) is larger than s(dσ(i
′)) for any **i < i**′.

$$\sigma(i)=\arg\max_{m\neq\sigma(n)\ \mbox{for}\ \forall n<i}s(d_{m})\ (1\leq i\leq D).\tag{15}$$
$$\mathbf{IV.\Tests\Database}$$

## A. Network Model

Two classes of network models are employed to generate communication test dataset. The first class is a real organization. The second class is a mathematical model having several adjustable parameters.

The network model (A) in Fig.1 represents a real organization. It is a global mujahedin (Jihad fighters) organization which was analyzed in [19]. The model consists of 107 persons and 4 regional sub-networks. The sub-networks represent Central Staffs (CS), Core Arabs (CA) from the Arabian Peninsula countries and Egypt, Maghreb Arabs (MA) from the North African countries, and Southeast Asians (SA).

The organization has a relatively large Gini coefficient of the nodal degree, 0.35, and a relatively large average clustering coefficient, 0.54, [24]. In economics, the Gini coefficient is a measure of inequality of income distribution or of wealth distribution. A larger Gini coefficient indicates lower equality.

The values mean that the organization possesses hubs and a group structure.

The node n**CS10** (indicated by a red circle in Fig.1) is a hub having relatively large nodal degree (K(nCS10**) = 8**). It is believed to be the founder of the organization, and said to be the covert leader who provides operational commanders in regional sub-networks with financial support in many terrorism attacks including 9/11 in 2001. His whereabouts are not known despite many efforts in investigation and capture.

![0_image_1.png](0_image_1.png)

The model (A) provides with the practical implication of solving the node discovery problem. But mathematical model is more suitable than the real organization to study the extensive quantitative characteristics of the method. Here, Barab´asi-Albert model [3] with a group structure is used as a generalization of hubs and group structure in the model (A). The Barab´asi-Albert model grows with preferential attachment.

The probability where a newly coming node nk connects a link to an existing node nj is proportional to the nodal degree of nj (p(k → j) ∝ K(nj)). The occurrence frequency of the nodal degree tends to be scale-free (f(K) ∝ Ka). In the Barab´asiAlbert model with a group structure, every node nj is assigned a pre-determined group attribute c(nj ) to which it belongs. The number of groups is G. The probability p(k → j) is modified to eq.(16). Group contrast parameter η is introduced. Links between the groups appear less frequently as η increases. The initial links between the groups are connected at random before growth by preferential attachment starts.

$$p(k\to j)\propto\left\{\begin{array}{ll}\eta(G-1)K(n_{j})&\mbox{if$c(n_{j})=c(n_{k})$}\\ K(n_{j})&\mbox{otherwise}\end{array}\right..\tag{16}$$

The network models (B), (C), and (D) are examples where the number of nodes is 201 and G = 1, 8, and 201. The model
(B) results in the conventional Barab´asi-Albert model. The model (C) is shown in Fig.2. The model (D) results in Erd¨osR´enyi model [6] which is configured by random connection between nodes.

## B. Communication Model

The dataset for performance tests is generated from the network models in IV-A in the 2 steps below.

In the first step, the communication patterns {δi} are generated D times according to the influence transmission under the true value of θ. A pattern includes both an initiator node nj and multiple responder nodes nk. An example is δ0 =