  Suppose that a rumor originating from a single source among a set of suspects
spreads in a network, how to root out this rumor source? With the a priori
knowledge of suspect nodes and an observation of infected nodes, we construct a
maximum a posteriori (MAP) estimator to identify the rumor source using the
susceptible-infected (SI) model. The a priori suspect set and its associated
connectivity bring about new ingredients to the problem, and thus we propose to
use local rumor center, a generalized concept based on rumor centrality, to
identify the source from suspects. For regular tree-type networks of node
degree {\delta}, we characterize Pc(n), the correct detection probability of
the estimator upon observing n infected nodes, in both the finite and
asymptotic regimes. First, when every infected node is a suspect, Pc(n)
asymptotically grows from 0.25 to 0.307 with {\delta} from 3 to infinity, a
result first established in Shah and Zaman (2011, 2012) via a different
approach; and it monotonically decreases with n and increases with {\delta}.
Second, when the suspects form a connected subgraph of the network, Pc(n)
asymptotically significantly exceeds the a priori probability if {\delta}>2,
and reliable detection is achieved as {\delta} becomes large; furthermore, it
monotonically decreases with n and increases with {\delta}. Third, when there
are only two suspects, Pc(n) is asymptotically at least 0.75 if {\delta}>2; and
it increases with the distance between the two suspects. Fourth, when there are
multiple suspects, among all possible connection patterns, that they form a
connected subgraph of the network achieves the smallest detection probability.
Our analysis leverages ideas from the Polya's urn model in probability theory
and sheds insight into the behavior of the rumor spreading process not only in
the asymptotic regime but also for the general finite-n regime.
