1. Collusion-Resistance Misbehaving User Detection Schemes Speaker: Jing-Kai Lou 2015/10/131

2. Outline Introduction – What’s the problem – Does it matter Previous work: What have I done … – Community-based scheme Current Analysis: What am I doing … – HITS – Random walk scheme 2015/10/132

3. The Rise of User Generated Content Most of the fastest-growing sites on the internet now are based on user-generated content (UGC). Customer Reviews Increase Web Sales --- eMarketer 2015/10/133

4. Inappropriate UGC The misbehaving users – post the inappropriate UGC Hiring lots of official moderators – is the typical solution But, such high labor cost is a great burden to the service provider There is another choice … 2015/10/134

5. Social Moderation System A user-assist Moderation Every user is a reviewer Blogger Album Video ?? ? ? !? O O X X X X Official moderator inspects what you see You report what you see while viewing X X 2015/10/135

6. Social Moderation Effect Advantages of social moderation system: 1.Fewer official moderators 2.Detecting inappropriate content quickly The number of the reports is still large. 1% uploading photos in Flickr are problematic, there are still about 43,200 reports each day An automation scheme to filter the reports 2015/10/136

7. Automated Filter for Reports Sorting the reports by their number of accusations 37 47 3 These photos are reported no more than ( N =20) times These photos are reported more than ( N =20) times 2015/10/137

8. However, the collusion exists… 2015/10/138

9. Not All Users Are Trustable While most users report responsibly, colluders report fake results to gain some benefits While most users report responsibly, colluders report fake results to gain some benefits 2015/10/139

10. The Objective To develop a collusion-resistant scheme CAN automatically infers whether the accusations are fair or malicious. The scheme, therefore, distinguish misbehaving users from victims. 2015/10/1310

11. Our Work: Graph Theory Approach Using the report (accusation) relation only Previous work: Community-based Scheme – Submitted to 3 rd ACM workshop on Scalable Trust Computing (STC 2008) Extended work: – Propose new schemes – Analyzing new schemes… 2015/10/1311

12. COMMUNITY-BASED SCHEME 2015/10/1312

13. Community-based Scheme Achieving accuracy rate higher than 90% Preventing at least 90% victims from collusion attack 2015/10/1313

14. Idea of Community-based Scheme Accusation Relation: Accusing Graph: 12345 1 01000 2 00010 3 01001 4 00000 5 01000 2015/10/1314

15. Ideal Patterns 2015/10/1315 Colluder Victim Normal user Misbehaving user

16. Accusing Community Users with similar accusing tend to be in the same community 2015/10/1316 Inter-community edge

17. Designing Features for Each User To find accusations NOT from colluders Base on the communities, we design features – Incoming Accusation, IA(k) = 2, – Outgoing Accusation, OA(k) = 5 k 2015/10/1317

18. Community-based Algorithm 1.Partitioning accusing graph into communities. 2.Computing the feature pair ( IA, OA ) of each user 3.Clustering based on their ( IA, OA ) pairs, and label users in the cluster with large ( IA, OA ) as misbehaving users. 2015/10/1318

19. Evaluation Metric What we care is, False Negative – Misidentifying victims as misbehaving users Collusion Resistance 2015/10/1319

20. Effect of #(Misbehaving users) Our Method Count-based Method 2015/10/1320

21. Effect of #(Colluders) Our Method Count-based Method 2015/10/1321

22. Effect of Accusation Density Our Method Count-based Method 2015/10/1322

23. Weakness of Community-based scheme In our simulation, the colluders only accuse the victims. Realistically, the colluders sometimes may also vote some misbehaving users. We shall consider smart colluder 2015/10/1323

24. Smart Colluder Behavior Behavior := probability for colluder to vote misbehaving users, ranges from 0 to 100. Behavior 0100 Naïve Colluder Smart Colluder Normal user 2015/10/1324

25. HITS, HYPERLINK-INDUCED TOPIC SEARCH 2015/10/1325

26. Inspiration A link analysis algorithm that rates Web pages, developed by Jon Kleinberg.link analysisalgorithmJon Kleinberg It determines two values for a page: – its authority, which estimates the value of the content of the page, – and its hub value, which estimates the value of its links to other pages. 2015/10/1326

27. Ideal Authority  Victim Hub value  Colluder For example, – Number of User = 150 – Misbehaving User Ratio = 10%, i.e., 15 – Colluder Ratio = 20%, i.e., 30 – Behavior = 20% 2015/10/1327

28. 2015/10/1328

29. When Behavior is increasing Parameter: – Number of User = 150 – Misbehaving User Ratio = 10%, i.e., 15 – Colluder Ratio = 20%, i.e., 30 – Behavior = 50% 2015/10/1329

30. 2015/10/1330

31. RANDOM WALK SCHEME 2015/10/1331

32. Main Idea 1.Focusing on content accused by many reviewers 2.Creating undirected graph C to describe them and their relation 3.Shaping C, (named it as D) to satisfy the Goal 4.Goal: Putting many people walking several steps on D, then most of people would stay on “victims” finally 2015/10/1332

33. Co-Voter Graph, C Define a co-voter graph C(V, E) to describe the relation between all accused V(G): accused E(G): – if the intersection of accusers against accused i and j (vertex i and j), then (i, j) in E(G) – weight, w(i. j) = #(intersection of accusers) 2015/10/1333

34. A snap shot of co-voter graph B C A E F D 1, 2, 3, 4, 5, 6, 7, 81, 12, 13, 145,6,7,8 5, 7,81, 2, 4, 8, 9, 105, 6, 7 2015/10/1334

35. Making Ideal Tendency (Be Directed) M M’ V V’ FORCE 3 2 1 Strong Weak GOAL: 1.For M, 2 > 1 2.For V, 3 > 2 2015/10/1335 Key Node

36. Goal 1: Intersection Ratio M M’ V 2015/10/1336 Prob. to V Prob. to M

37. GOAL 2: Alpha of Target Alpha(M) < Alpha(V), hopefully Mb V 2015/10/1337 Prob. to M = Alpha(M) Prob. to V = Alpha(V)

38. What should be Alpha? [Version N(eighborhood)]: Alpha(T) := the number of co-voters between b and all its neighbors Colluder tend to share more co-voters with his collusion group … [Version H(ub)]: Alpha(T) := Sum(hub score of T’s voter) 2015/10/1338

39. Weight Formula Options Directed weight formula: w(a, b) = Alpha(b) * |a intersect b| / |a union b| Then, we set the node leaving prob. by normalizing outgoing weight 2015/10/1339 X 0.4 0.8 A B C Pr(X  A) =.4 Pr(X  B) =.2 Pr(X  C) =.4

40. Evaluation Parameter: – Number of User = 250 – Misbehaving User Ratio = 10%, i.e., 25 – Colluder Ratio = 20%, i.e., 50 – Behavior = 50% 2015/10/1340

41. Evaluation 2015/10/1341

42. Conclusion Any new factor we shall consider? Any idea to improve the random walk scheme, or HITS Scheme? Any NEW idea? 2015/10/1342

43. THANKS FOR YOUR LISTENING! 2015/10/1343