Collusion-Resistance Misbehaving User Detection Schemes Speaker: Jing-Kai Lou 2015/10/131

Outline Introduction – What’s the problem – Does it matter Previous work: What have I done … – Community-based scheme Current Analysis: What am I doing … – HITS – Random walk scheme 2015/10/132

The Rise of User Generated Content Most of the fastest-growing sites on the internet now are based on user-generated content (UGC). Customer Reviews Increase Web Sales --- eMarketer 2015/10/133

Inappropriate UGC The misbehaving users – post the inappropriate UGC Hiring lots of official moderators – is the typical solution But, such high labor cost is a great burden to the service provider There is another choice … 2015/10/134

Social Moderation System A user-assist Moderation Every user is a reviewer Blogger Album Video ?? ? ? !? O O X X X X Official moderator inspects what you see You report what you see while viewing X X 2015/10/135

Social Moderation Effect Advantages of social moderation system: 1.Fewer official moderators 2.Detecting inappropriate content quickly The number of the reports is still large. 1% uploading photos in Flickr are problematic, there are still about 43,200 reports each day An automation scheme to filter the reports 2015/10/136

Automated Filter for Reports Sorting the reports by their number of accusations These photos are reported no more than ( N =20) times These photos are reported more than ( N =20) times 2015/10/137

However, the collusion exists… 2015/10/138

Not All Users Are Trustable While most users report responsibly, colluders report fake results to gain some benefits While most users report responsibly, colluders report fake results to gain some benefits 2015/10/139

The Objective To develop a collusion-resistant scheme CAN automatically infers whether the accusations are fair or malicious. The scheme, therefore, distinguish misbehaving users from victims. 2015/10/1310

Our Work: Graph Theory Approach Using the report (accusation) relation only Previous work: Community-based Scheme – Submitted to 3 rd ACM workshop on Scalable Trust Computing (STC 2008) Extended work: – Propose new schemes – Analyzing new schemes… 2015/10/1311

COMMUNITY-BASED SCHEME 2015/10/1312

Community-based Scheme Achieving accuracy rate higher than 90% Preventing at least 90% victims from collusion attack 2015/10/1313

Idea of Community-based Scheme Accusation Relation: Accusing Graph: /10/1314

Ideal Patterns 2015/10/1315 Colluder Victim Normal user Misbehaving user

Accusing Community Users with similar accusing tend to be in the same community 2015/10/1316 Inter-community edge

Designing Features for Each User To find accusations NOT from colluders Base on the communities, we design features – Incoming Accusation, IA(k) = 2, – Outgoing Accusation, OA(k) = 5 k 2015/10/1317

Community-based Algorithm 1.Partitioning accusing graph into communities. 2.Computing the feature pair ( IA, OA ) of each user 3.Clustering based on their ( IA, OA ) pairs, and label users in the cluster with large ( IA, OA ) as misbehaving users. 2015/10/1318

Evaluation Metric What we care is, False Negative – Misidentifying victims as misbehaving users Collusion Resistance 2015/10/1319

Effect of #(Misbehaving users) Our Method Count-based Method 2015/10/1320

Effect of #(Colluders) Our Method Count-based Method 2015/10/1321

Effect of Accusation Density Our Method Count-based Method 2015/10/1322

Weakness of Community-based scheme In our simulation, the colluders only accuse the victims. Realistically, the colluders sometimes may also vote some misbehaving users. We shall consider smart colluder 2015/10/1323

Smart Colluder Behavior Behavior := probability for colluder to vote misbehaving users, ranges from 0 to 100. Behavior 0100 Naïve Colluder Smart Colluder Normal user 2015/10/1324

HITS, HYPERLINK-INDUCED TOPIC SEARCH 2015/10/1325

Inspiration A link analysis algorithm that rates Web pages, developed by Jon Kleinberg.link analysisalgorithmJon Kleinberg It determines two values for a page: – its authority, which estimates the value of the content of the page, – and its hub value, which estimates the value of its links to other pages. 2015/10/1326

Ideal Authority  Victim Hub value  Colluder For example, – Number of User = 150 – Misbehaving User Ratio = 10%, i.e., 15 – Colluder Ratio = 20%, i.e., 30 – Behavior = 20% 2015/10/1327

2015/10/1328

When Behavior is increasing Parameter: – Number of User = 150 – Misbehaving User Ratio = 10%, i.e., 15 – Colluder Ratio = 20%, i.e., 30 – Behavior = 50% 2015/10/1329

2015/10/1330

RANDOM WALK SCHEME 2015/10/1331

Main Idea 1.Focusing on content accused by many reviewers 2.Creating undirected graph C to describe them and their relation 3.Shaping C, (named it as D) to satisfy the Goal 4.Goal: Putting many people walking several steps on D, then most of people would stay on “victims” finally 2015/10/1332

Co-Voter Graph, C Define a co-voter graph C(V, E) to describe the relation between all accused V(G): accused E(G): – if the intersection of accusers against accused i and j (vertex i and j), then (i, j) in E(G) – weight, w(i. j) = #(intersection of accusers) 2015/10/1333

A snap shot of co-voter graph B C A E F D 1, 2, 3, 4, 5, 6, 7, 81, 12, 13, 145,6,7,8 5, 7,81, 2, 4, 8, 9, 105, 6, /10/1334

Making Ideal Tendency (Be Directed) M M’ V V’ FORCE Strong Weak GOAL: 1.For M, 2 > 1 2.For V, 3 > /10/1335 Key Node

Goal 1: Intersection Ratio M M’ V 2015/10/1336 Prob. to V Prob. to M

GOAL 2: Alpha of Target Alpha(M) < Alpha(V), hopefully Mb V 2015/10/1337 Prob. to M = Alpha(M) Prob. to V = Alpha(V)

What should be Alpha? [Version N(eighborhood)]: Alpha(T) := the number of co-voters between b and all its neighbors Colluder tend to share more co-voters with his collusion group … [Version H(ub)]: Alpha(T) := Sum(hub score of T’s voter) 2015/10/1338

Weight Formula Options Directed weight formula: w(a, b) = Alpha(b) * |a intersect b| / |a union b| Then, we set the node leaving prob. by normalizing outgoing weight 2015/10/1339 X A B C Pr(X  A) =.4 Pr(X  B) =.2 Pr(X  C) =.4

Evaluation Parameter: – Number of User = 250 – Misbehaving User Ratio = 10%, i.e., 25 – Colluder Ratio = 20%, i.e., 50 – Behavior = 50% 2015/10/1340

Evaluation 2015/10/1341

Conclusion Any new factor we shall consider? Any idea to improve the random walk scheme, or HITS Scheme? Any NEW idea? 2015/10/1342

THANKS FOR YOUR LISTENING! 2015/10/1343