Inferring Strange Behavior from Connectivity Pattern in Social Networks

Abstract. Given a multimillion-node social network, how can we sum-marize connectivity pattern from the data, and how can we find unex-pected user behavior? In this paper we study a complete graph from a large who-follows-whom network and spot lockstep behavior that large groups of followers connect to the same groups of followees. Our first contribution is that we study strange patterns on the adjacency matrix and in the spectral subspaces with respect to several flavors of lockstep. We discover that (a) the lockstep behavior on the graph shapes dense “block ” in its adjacency matrix and creates “ray ” in spectral subspaces, and (b) partially overlapping of the behavior shapes “staircase ” in the matrix and creates “pearl ” in the subspaces. The second contribution is that we provide a fast algorithm, using the discovery as a guide for practi-tioners, to detect users who offer the lockstep behavior. We demonstrate that our approach is effective on both synthetic and real data.

지리적 거리 정보를 활용한 가짜 팔로워 구매자 식별 방법

학위논문 (박사)-- 서울대학교 대학원 : 공과대학 컴퓨터공학부, 2019. 2. 김종권.The reputation of social media such as Twitter, Facebook, and Instagram now regard as one persons power in real-world. The person who has more friends or followers can influence more individuals. So the influence of users is associated with the number of friends or followers. On the demand of increasing social power, an underground market has emerged where a customer can buy fake followers. The one who purchase fake followers acts vigorously in online social network. Thus, it is hard to distinguish customer from celebrity or cyberstar. Nevertheless, there are unique characteristics of legitimate users that customers or fake followers cannot manipulate such as a small-world property. The small-world property is mainly qualified by the shortest-path and clustering coefficient. In the small-world network, most people are linked by short chains. Existing work has largely focused on extracting relationship features such as indegree, outdegree, status, hub, or authority. Even though these research explored the relationship features to classify abnormal users of fake follower markets, research that utilize the small-world property to detect abnormal users is not studied. In this work, we propose a model that adapt the small-world property. Specifically, we study the geographical distance for 1hop-directional links using nodes geographical location to verify whether a social graph has the small-world property or not. Motivated by the difference of distance ratio for 1hop directional links, we propose a method which is designed to generate 1hop link distance ratio and classify a node as a customer or not. Experimental results on real-world Twitter dataset demonstrates that the proposed method achieves higher performance than existing models.Chapter 1 Introduction 1 1.1 Motivations 1 1.2 Fake Follower Markets 3 1.3 Research Objectives 5 1.4 Contributions 6 1.5 Thesis Organization 8 Chapter 2 Related Work 10 2.1 Small World Phenomenon 10 2.2 Online Social Abusing Attack Detection 11 2.2.1 Contents-based Detection 12 2.2.2 Social Network-based Detection 13 2.2.3 Behavior-based Detection 5 Chapter 3 Characteristic of Customers and Fake Followers 16 3.1 Data Preparation 16 3.2 Fake Follower Properties 21 3.3 Customer Properties 26 Chapter 4 Social Relationship and Geographical Distance 29 4.1 Geographical Distance in OSNs 29 4.2 Follower Ratio 34 Chapter 5 Detecting Customers 38 5.1 Key Features for Customer Detection 38 5.2 Performance matrices 40 5.3 Experiments 41 5.4 Comparison with Baseline Method 44 5.5 Comparison with Feature-based Method 47 5.6 Impact of Balanced Dataset 49 5.7 Fake Follower Detection 50 Chapter 6 Future Work 52 6.1 The Absence of Location Information 52 6.2 Hybrid Detection Method with Link Ratio and Profile Information 54 Chapter 7 Conclusion 56 Bibliography 58 국문초록 69Docto

Social Fingerprinting: detection of spambot groups through DNA-inspired behavioral modeling

Spambot detection in online social networks is a long-lasting challenge involving the study and design of detection techniques capable of efficiently identifying ever-evolving spammers. Recently, a new wave of social spambots has emerged, with advanced human-like characteristics that allow them to go undetected even by current state-of-the-art algorithms. In this paper, we show that efficient spambots detection can be achieved via an in-depth analysis of their collective behaviors exploiting the digital DNA technique for modeling the behaviors of social network users. Inspired by its biological counterpart, in the digital DNA representation the behavioral lifetime of a digital account is encoded in a sequence of characters. Then, we define a similarity measure for such digital DNA sequences. We build upon digital DNA and the similarity between groups of users to characterize both genuine accounts and spambots. Leveraging such characterization, we design the Social Fingerprinting technique, which is able to discriminate among spambots and genuine accounts in both a supervised and an unsupervised fashion. We finally evaluate the effectiveness of Social Fingerprinting and we compare it with three state-of-the-art detection algorithms. Among the peculiarities of our approach is the possibility to apply off-the-shelf DNA analysis techniques to study online users behaviors and to efficiently rely on a limited number of lightweight account characteristics

The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race

Recent studies in social media spam and automation provide anecdotal argumentation of the rise of a new generation of spambots, so-called social spambots. Here, for the first time, we extensively study this novel phenomenon on Twitter and we provide quantitative evidence that a paradigm-shift exists in spambot design. First, we measure current Twitter's capabilities of detecting the new social spambots. Later, we assess the human performance in discriminating between genuine accounts, social spambots, and traditional spambots. Then, we benchmark several state-of-the-art techniques proposed by the academic literature. Results show that neither Twitter, nor humans, nor cutting-edge applications are currently capable of accurately detecting the new social spambots. Our results call for new approaches capable of turning the tide in the fight against this raising phenomenon. We conclude by reviewing the latest literature on spambots detection and we highlight an emerging common research trend based on the analysis of collective behaviors. Insights derived from both our extensive experimental campaign and survey shed light on the most promising directions of research and lay the foundations for the arms race against the novel social spambots. Finally, to foster research on this novel phenomenon, we make publicly available to the scientific community all the datasets used in this study.Comment: To appear in Proc. 26th WWW, 2017, Companion Volume (Web Science Track, Perth, Australia, 3-7 April, 2017