1 / 45

Inferring Strange Behavior from Connectivity Pattern in Social Networks

Inferring Strange Behavior from Connectivity Pattern in Social Networks. Meng Jiang, Peng Cui, Shiqiang Yang (Tsinghua, Beijing) Alex Beutel , Christos Faloutsos (CMU). What is Strange Behavior?. “Who-follows-whom” network with billions of edges: Twitter, Weibo , etc.

naiara
Download Presentation

Inferring Strange Behavior from Connectivity Pattern in Social Networks

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Inferring Strange BehaviorfromConnectivityPatterninSocialNetworks MengJiang, PengCui, ShiqiangYang (Tsinghua, Beijing) AlexBeutel,ChristosFaloutsos (CMU)

  2. What is Strange Behavior? • “Who-follows-whom” network with billions of edges: Twitter, Weibo, etc.

  3. What is Strange Behavior? • Sell followers: “Become a Twitter Rockstar” $ $ $ 0.9 TWD per edge

  4. What is Strange Behavior? customer botnet $ connect $  100  1,000 $

  5. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ #follower↑+1,000

  6. What is Strange Behavior? customer botnet $ connect $  100  1,000  $ Unsafe! More customers…  100

  7. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ More customers… connect  100  5,000

  8. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ I want more followers… connect  100  5,000

  9. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ connect connect  100  5,000

  10. What is Strange Behavior? customer botnet $ connect  1,000  100 $ $  100  5,000  ….  …. More groups of customers More groups of botnets More companies….

  11. What is Strange Behavior? customer botnet $ connect $ $ Detectdense biparitite cores! How can we evade detection? Some other activity!

  12. What is Strange Behavior? customer botnet $ connect $ $ “Camouflage”: may connect to popular idols to look normal

  13. What is Strange Behavior? customer botnet $ connect $ $ “Fame”: may have a few honest followers

  14. AdjacencyMatrixReminder followee   follower   Graph Structure Adjacency Matrix

  15. Strange Lockstep Behavior customer botnet • Groups • Acting together • Little other activity connect camouflage fame

  16. More Applications • eBay reviews

  17. More Applications • Facebook “Likes”

  18. Problem Definition • Givenadjacencymatrix • FindStrange=“Lockstep”Behavior reordering

  19. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  20. SVD Reminder followee 1   follower follow  2  Graph Structure Adjacency Matrix SVD:A=USVT Pairsofsingularvectors: followee U2 V2 U1U2 … V1V2 U1 V1 follower “SpectralSubspacePlot”

  21. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  22. Lockstep and SpectralSubspacePlot • Case#0:Nolockstepbehaviorinrandompowerlawgraphof1Mnodes,3Medges • Random“Scatter” Adjacency Matrix SpectralSubspacePlot

  23. Lockstep and SpectralSubspacePlot • Case#1:non-overlappinglockstep • “Blocks”“Rays” Adjacency Matrix SpectralSubspacePlot

  24. Lockstep and SpectralSubspacePlot • Case#2:non-overlappinglockstep • “Blocks;lowdensity”Elongation Adjacency Matrix SpectralSubspacePlot

  25. Lockstep and SpectralSubspacePlot • Case#3:non-overlappinglockstep • “Camouflage” (or “Fame”)Tilting“Rays” Adjacency Matrix SpectralSubspacePlot

  26. Lockstep and SpectralSubspacePlot • Case#3:non-overlappinglockstep • “Camouflage” (or “Fame”)Tilting“Rays” Adjacency Matrix SpectralSubspacePlot

  27. Lockstep and SpectralSubspacePlot • Case#4:?lockstep • “?”“Pearls” Adjacency Matrix SpectralSubspacePlot ?

  28. Lockstep and SpectralSubspacePlot • Case#4:overlappinglockstep • “Staircase”“Pearls” Adjacency Matrix SpectralSubspacePlot

  29. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  30. Algorithm • Step1:Seedselection • Spot“Rays”and“Pearls” • Catchseedfollowers • Step2:BeliefPropagation • Blamefolloweeswithstrangefollowers • Blamefollowerswithstrangefollowees

  31. AutomaticallySpot“Rays”and“Pearls” Spectral SubspacePlot PolarCoordinate Transform Histograms

  32. BP-basedAlgorithm • Blame followees with strange followers • Blame followers with strange followees

  33. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  34. Dataset • TencentWeibo • 117 million nodes(users) • 3.33billiondirectededges

  35. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  36. Real Data “Block” “Rays” “Pearls” “Staircase”

  37. Real Data “Rays” “Block”

  38. Real Data “Pearls” • 3,188 • in F1 • 7,210 • in F2 • 2,457 • in F3 “Staircase” • E1 E2E3E4

  39. Real Data “Pearls” “Staircase” “Staircase”

  40. RealData • Spikesontheout-degreedistribution  

  41. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  42. Synthetic Data • Injectlockstepbehaviorwith“camouflage” perfect

  43. Synthetic Data • Injectoverlapping lockstepbehavior perfect

  44. Contributions • Differenttypesoflockstepbehavior • Ahandbook(rules)toinferlockstepbehaviorwithconnectivitypatterns • Analgorithmtocatchthesuspiciousnodes • Removespikesonout-degreedistribution

  45. Thank you!

More Related