+ Collective Spammer Detection in Evolving Multi-Relational Social Networks Shobeir Fakhraei (University of Maryland) James Foulds (University of California, Santa Cruz) Madhusudana Shashanka (if(we) Inc., Currently Niara Inc.) Lise Getoor (University of California, Santa Cruz)

Spam in Social Networks Recent study by Nexgate in 2013: Spam grew by more than 300% in half a year 2

Spam in Social Networks Recent study by Nexgate in 2013: Spam grew by more than 300% in half a year 1 in 200 social messages are spam 3

Spam in Social Networks Recent study by Nexgate in 2013: Spam grew by more than 300% in half a year 1 in 200 social messages are spam 5% of all social apps are spammy 4

Spam in Social Networks What’s different about social networks? Spammers have more ways to interact with users 5

Spam in Social Networks What’s different about social networks? Spammers have more ways to interact with users Messages, comments on photos, winks,… 6

Spam in Social Networks What’s different about social networks? Spammers have more ways to interact with users Messages, comments on photos, winks,… They can split spam across multiple messages 7

Spam in Social Networks What’s different about social networks? Spammers have more ways to interact with users Messages, comments on photos, winks,… They can split spam across multiple messages More available info about users on their profiles! 8

Spammers are getting smarter! 9 Want some replica luxury watches? Click here: Traditional Spam: GeorgeShobeir

Spammers are getting smarter! 10 Want some replica luxury watches? Click here: Traditional Spam:   [Report Spam] GeorgeShobeir

Spammers are getting smarter! 11 Want some replica luxury watches? Click here: Traditional Spam:(Intelligent) Social Spam: Hey Shobeir! Nice profile photo. I live in Bay Area too. Wanna chat? Hey Shobeir! Nice profile photo. I live in Bay Area too. Wanna chat?   [Report Spam] GeorgeShobeir Mary

Spammers are getting smarter! 12 Want some replica luxury watches? Click here: Traditional Spam:(Intelligent) Social Spam: Hey Shobeir! Nice profile photo. I live in Bay Area too. Wanna chat? Hey Shobeir! Nice profile photo. I live in Bay Area too. Wanna chat? Sure! :)   [Report Spam] GeorgeShobeir Mary

Spammers are getting smarter! 13 Want some replica luxury watches? Click here: Traditional Spam:(Intelligent) Social Spam: Hey Shobeir! Nice profile photo. I live in Bay Area too. Wanna chat? Hey Shobeir! Nice profile photo. I live in Bay Area too. Wanna chat? Sure! :)   [Report Spam] GeorgeShobeir Mary … I’m logging off here., too many people pinging me! I really like you, let’s chat more here: I’m logging off here., too many people pinging me! I really like you, let’s chat more here: Mary Realistic Looking Conversation

Tagged.com Founded in 2004, is a social networking site which connects people through social interactions and games Over 300 million registered members Data sample for experiments (on a laptop): 5.6 Million users (3.9% Labeled Spammers) 912 Million Links 14

Social Networks: Multi-relational and Time-Evolving 15

Social Networks: Multi-relational and Time-Evolving 16 Legitimate users

Social Networks: Multi-relational and Time-Evolving 17 Legitimate users Spammers

Social Networks: Multi-relational and Time-Evolving Link = Action at time t Actions = Profile view, message, poke, report abuse, etc 18 Legitimate users Spammers

Social Networks: Multi-relational and Time-Evolving Link = Action at time t Actions = Profile view, message, poke, report abuse, etc 19

Social Networks: Multi-relational and Time-Evolving Link = Action at time t Actions = Profile view, message, poke, report abuse, etc 20 Profile view

Social Networks: Multi-relational and Time-Evolving Link = Action at time t Actions = Profile view, message, poke, report abuse, etc 21 Profile view Message

Social Networks: Multi-relational and Time-Evolving Link = Action at time t Actions = Profile view, message, poke, report abuse, etc 22 Profile view Message Poke

Social Networks: Multi-relational and Time-Evolving Link = Action at time t Actions = Profile view, message, poke, report abuse, etc 23 Profile view Message Poke Report spammer

Our Approach 24 Predict spammers based on: Graph structure Action sequences Reporting behavior

Our Approach 25 Predict spammers based on: Graph structure Action sequences Reporting behavior

Graph Structure Feature Extraction 26 Graphs for each relation

Graph Structure Feature Extraction 27 Graphs for each relation Features

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 28 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 29 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 30 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 31 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 32 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 33 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 34 (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 35 X (8 features for each of 10 relations)

Graph Structure Features Extract features for each relation graph es for each of 10 rel PageRank Degree statistics Total degree In degree Out degree k-Core Graph coloring Connected components Triangle count 36 Viewing profile Friend requests Message Luv Wink Pets game Buying Wishing MeetMe game Yes No Reporting abuse X (8 features for each of 10 relations)

Graph Structure Features 37 Graph Structure … PageRankTriangle CountIn-DegreeOut-Degreek-CoreGraph Coloring … PageRankTriangle CountIn-DegreeOut-Degreek-CoreGraph Coloring t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3) Classification method: Gradient Boosted Trees Viewing profileReporting abuse…

Graph Structure Features 38 ExperimentsAU-PRAU-ROC 1 Relation, 8 Feature types ± ± Relations, 1 Feature type ± ± Relations, 8 Feature types ± ± Multiple relations/features better performance!

Graph Structure Features 39 ExperimentsAU-PRAU-ROC 1 Relation, 8 Feature types ± ± Relations, 1 Feature type ± ± Relations, 8 Feature types ± ± Multiple relations/features better performance!

Graph Structure Features 40 ExperimentsAU-PRAU-ROC 1 Relation, 8 Feature types ± ± Relations, 1 Feature type ± ± Relations, 8 Feature types ± ± Multiple relations/features better performance!

Graph Structure Features 41 ExperimentsAU-PRAU-ROC 1 Relation, 8 Feature types ± ± Relations, 1 Feature type ± ± Relations, 8 Feature types ± ± Multiple relations/features better performance!

Our Approach 42 Predict spammers based on: Graph structure Action sequences Reporting behavior

Sequence of Actions Sequential Bigram Features: Short sequence segment of 2 consecutive actions, to capture sequential information 43 User1 Actions: Message, Profile_view, Message, Friend_Request, ….

Sequence of Actions Mixture of Markov Models (MMM): A.k.a. chain-augmented, tree-augmented naive Bayes 44

Sequence of Actions 45 Action Sequence … Bigram Features + Chain Augmented NB t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3)

Sequence of Actions ExperimentsAU-PRAU-ROC Bigram Features0.471 ± ± MMM0.246 ± ± Bigram + MMM ± ± Little benefit from MMM (although little overhead)

Results 47 Precision-Recall ROC We can classify 70% of the spammers that need manual labeling with about 90% accuracy

Deployment and Example Runtimes We can: Run the model on short intervals, with new snapshots of the network Update the features as events occur Example runtimes with Graphlab Create TM on a Macbook Pro: 5.6 million vertices and 350 million edges: PageRank: 6.25 minutes Triangle counting: minutes k-core: 14.3 minutes 48

Our Approach 49 Predict spammers based on: Graph structure Action sequences Reporting behavior

Refining the abuse reporting systems Abuse report systems are very noisy People have different standards Spammers report random people to increase noise Personal gain in social games Goal is to clean up the system using: Reporters’ previous history Collective reasoning over reports 50

Collective Classification with Reports 51 Report Subgraph Probabilistic Soft Logic t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3)

HL-MRFs & Probabilistic Soft Logic (PSL) 52 Probabilistic Soft Logic (PSL), a declarative modeling language based on first-order logic Weighted logical rules define a probabilistic graphical model: Instantiated rules reduce the probability of any state that does not satisfy the rule, as measured by its distance to satisfaction 52

Collective Classification with Reports Model using only reports: 53

Collective Classification with Reports Model using reports and credibility of the reporter: 54

Collective Classification with Reports Model using reports, credibility of the reporter, and collective reasoning: 55

Results of Classification Using Reports ExperimentsAU-PRAU-ROC Reports Only0.674 ± ± Reports & Credibility0.869 ± ± Reports & Credibility & Collective Reasoning ± ±

Results of Classification Using Reports ExperimentsAU-PRAU-ROC Reports Only0.674 ± ± Reports & Credibility0.869 ± ± Reports & Credibility & Collective Reasoning ± ±

Results of Classification Using Reports ExperimentsAU-PRAU-ROC Reports Only0.674 ± ± Reports & Credibility0.869 ± ± Reports & Credibility & Collective Reasoning ± ±

Results of Classification Using Reports ExperimentsAU-PRAU-ROC Reports Only0.674 ± ± Reports & Credibility0.869 ± ± Reports & Credibility & Collective Reasoning ± ±

Conclusion 60 t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3) Graph Structure … PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring … Multiple relations are more predictive than multiple features AUPR: → Code and part of the data will be released soon:

Conclusion 61 t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3) Graph Structure … PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring … Action Sequence … Bigram Features + Chain Augmented NB Multiple relations are more predictive than multiple features Even simple bigrams are highly predictive AUPR: → AUPR: Code and part of the data will be released soon:

Conclusion 62 t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3) Graph Structure … PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring … Action Sequence … Bigram Features + Chain Augmented NB Multiple relations are more predictive than multiple features Even simple bigrams are highly predictive AUPR: → AUPR: Can classify 70% of the spammers that needed manual labeling with 90% accuracy AUPR: Code and part of the data will be released soon:

Conclusion 63 t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3) Graph Structure … PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring … Action Sequence … Bigram Features + Chain Augmented NB Report Subgraph Probabilistic Soft Logic Multiple relations are more predictive than multiple features Even simple bigrams are highly predictive Jointly refining the credibility of the source is highly effective! AUPR: → AUPR: AUPR: → Can classify 70% of the spammers that needed manual labeling with 90% accuracy AUPR: Code and part of the data will be released soon:

Acknowledgements Collaborators: If(we) Inc. (Formerly Tagged Inc.): Johann Schleier-Smith, Karl Dawson, Dai Li, Stuart Robinson, Vinit Garg, and Simon Hill Dato (Formerly Graphlab): Danny Bickson, Brian Kent, Srikrishna Sridhar, Rajat Arya, Shawn Scully, and Alice Zheng 64 Shobeir Fakhraei Univ. of Maryland Lise Getoor Univ. California, Santa Cruz Madhusudana Shashanka if(we) Inc., currently Niara Inc.

Conclusion 65 t(1) t(3) t(2) t(4) t(5) t(6) t(7) t(8) t(9) t(10) t(8) t(3) Graph Structure … PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring PageRankTriangle Count In-Degree Out-Degreek-Core Graph Coloring … Action Sequence … Bigram Features + Chain Augmented NB Report Subgraph Probabilistic Soft Logic Multiple relations are more predictive than multiple features Even simple bigrams are highly predictive Jointly refining the credibility of the source is highly effective! AUPR: → AUPR: AUPR: → Can classify 70% of the spammers that needed manual labeling with 90% accuracy AUPR: Code and part of the data will be released soon: Thank you!