1. 1 Link Privacy in Social Networks Aleksandra Korolova, Rajeev Motwani, Shubha U. Nabar CIKM’08 Advisor: Dr. Koh, JiaLing Speaker: Li, HueiJyun Date: 2009/3/30

2. 2 Outline Introduction The Model Goal of the Attack The Network through a User’s Lens Possible Attack Strategies Experimental Results Results on Synthetic Data Results on Real Data Conclusions

3. 3 Introduction In online communities whose primary goal is social networking, each user’s set of trusted users is of paramount importance to their activity on the site Such as: MySpace 、 Facebook 、 LinkedIn A major part of the value of participating in an online social network or in a web-service with an online community for a user lies in the ability to leverage the structure of the social network graph

4. 4 Introduction The motivation for this paper is networks where Relationships between users may be sensitive to privacy concerns The link information is a valuable asset to the user and to the network owner In such networks, a user is typically permitted only limited access to the link structure

5. 5 Introduction In this paper, we analysis The methods one could employ to obtain information about the link structure of a social network The difficulty of doing that depending on the interface of neighborhood access permitted by the social network We focus on the case in which an attacker, whose goal is to Ascertain a significant fraction of the links in a network Obtains access to parts of the network by gaining access to the accounts of some select users

6. 6 The Model *Goal of the Attack View a social network as an undirected graph G = (V, E) V: users E: connections or interactions between users The primary goal of the privacy attack is to discover the link structure of the network

7. 7 The Model *Goal of the Attack Measure an attack’s effectiveness using the notion of node coverage, or simply coverage Measures the amount of network graph structure exposed to the attacker Definition 1 (Node coverage) The fraction of nodes whose entire immediate neighborhood is known A node is covered, if and only if the attacker knows precisely which nodes it is connected to and which nodes it is not connected to

8. 8 The Model *The Network through a User’s Lens An online social network could choose the extent to which links are made visible to its users depending on how sensitive the links are quantify such choices using lookahead Lookahead l : a user can see all of the edges incident to the nodes within distance l from him 0: a user can see exactly who he links to 1: a user can see exactly the friends that he links to as well as the friends that his friends link to

9. 9 The Model *The Network through a User’s Lens A typical online social network provides a search interface People can search for users by username, name or other identifying information such as email or school affiliation Returns usernames who satisfy the query, often with the numbers of friends of those users Interface: neighbors( username, password, l ) exists( username ) degree( username ) userlist()

10. 10 The Model *Possible Attack Strategies Bribed users: the users to whose accounts the attacker obtains An attack’s success or attained node coverage vary depending on the strategy followed for picking the users to bribe Benchmark-Greedy: the one whose perspective on the network will give the largest possible amount of new information (optimal 、 NP-hard)

11. 11 The Model *Possible Attack Strategies Heuristically Greedy: according to some heuristic measure Degree greedy: the one with the maximum “unseen ” degree (degree(username) - #(edges) ) Highest-Degree: bribe users in the descending order of their degrees Random Uniform-Random Crawler: similar to the Heuristically Greedy, but only seen Degree-Greedy-Crawler

12. 12 Experimental Results At a high level, our experiments explore the fraction, f, of nodes that need to be bribed by an attacker Using the different bribing strategies in order to achieve 1-ε node coverage of a social network with lookahead l Results on Synthetic data Generating Synthetic Graphs satisfies a given degree distribution picking uniformly at random from all such graphs

13. 13 Experimental Results *Results on Synthetic data **Generating Synthetic Graphs Generates a graph 1. Generate the degrees of all the nodes d(vi) i = 1, …, n independently according to the distribution  C: the normalizing constant  α: the power law parameter 2. Consider minivertices which correspond to the original vertices in a natural way and generate a random matching over D 3. For each edge in the matching, construct an edge between corresponding vertices in the original graph  obtain a random graph with a given power-law degree distribution

14. Experimental Results *Results on Synthetic data **Comparison of Strategies 14 100,000 nodes α = 0.3 d max = 5 Random Crawler 、 Greedy Highest Benchmark

15. Experimental Results *Results on Synthetic data **Dependence on the Number of Users 15 0.99 0.9 0.8

16. Experimental Results *Results on Synthetic data **Dependence on the Lookahead 16

17. Experimental Results *Results on Synthetic data **Dependence on the Lookahead 17 Lookahead = 1 Lookahead = 2 Lookahead = 3

18. Experimental Results *Results on Real data ** Comparison of Strategies 18 LiveJournal 572,949 users α = 2.6 d min = 1 d max = 1974 Random Highest Crawler 、 Greedy Random Crawler 、 Greedy Highest

19. Experimental Results *Results on Real data **Dependence on the Lookahead 19 Lookahead = 1 Lookahead = 2 Lookahead = 3

20. 20 Conclusions Provided a experimental analysis of the vulnerability of a social network to the link privacy attack Proposed several strategies for carrying out such attacks, and analyzed their potential for success as a function of the lookahead permitted by the social network’s interface

21. 21 Conclusions The number of user accounts that an attacker needs to subvert in order to obtain a fixed portion of the link structure of the network decreases exponentially with increases in lookahead provided by the network owner Social networks may want to decrease their vulnerability by not displaying the exact number of connections that each users has, or varying the lookahead available to users depending on their trustworthiness