inferring strange behavior from connectivity pattern in social networks n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Inferring Strange Behavior from Connectivity Pattern in Social Networks PowerPoint Presentation
Download Presentation
Inferring Strange Behavior from Connectivity Pattern in Social Networks

Loading in 2 Seconds...

  share
play fullscreen
1 / 45
naiara

Inferring Strange Behavior from Connectivity Pattern in Social Networks - PowerPoint PPT Presentation

145 Views
Download Presentation
Inferring Strange Behavior from Connectivity Pattern in Social Networks
An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. Inferring Strange BehaviorfromConnectivityPatterninSocialNetworks MengJiang, PengCui, ShiqiangYang (Tsinghua, Beijing) AlexBeutel,ChristosFaloutsos (CMU)

  2. What is Strange Behavior? • “Who-follows-whom” network with billions of edges: Twitter, Weibo, etc.

  3. What is Strange Behavior? • Sell followers: “Become a Twitter Rockstar” $ $ $ 0.9 TWD per edge

  4. What is Strange Behavior? customer botnet $ connect $  100  1,000 $

  5. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ #follower↑+1,000

  6. What is Strange Behavior? customer botnet $ connect $  100  1,000  $ Unsafe! More customers…  100

  7. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ More customers… connect  100  5,000

  8. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ I want more followers… connect  100  5,000

  9. What is Strange Behavior? customer botnet $ connect $  100  1,000 $ connect connect  100  5,000

  10. What is Strange Behavior? customer botnet $ connect  1,000  100 $ $  100  5,000  ….  …. More groups of customers More groups of botnets More companies….

  11. What is Strange Behavior? customer botnet $ connect $ $ Detectdense biparitite cores! How can we evade detection? Some other activity!

  12. What is Strange Behavior? customer botnet $ connect $ $ “Camouflage”: may connect to popular idols to look normal

  13. What is Strange Behavior? customer botnet $ connect $ $ “Fame”: may have a few honest followers

  14. AdjacencyMatrixReminder followee   follower   Graph Structure Adjacency Matrix

  15. Strange Lockstep Behavior customer botnet • Groups • Acting together • Little other activity connect camouflage fame

  16. More Applications • eBay reviews

  17. More Applications • Facebook “Likes”

  18. Problem Definition • Givenadjacencymatrix • FindStrange=“Lockstep”Behavior reordering

  19. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  20. SVD Reminder followee 1   follower follow  2  Graph Structure Adjacency Matrix SVD:A=USVT Pairsofsingularvectors: followee U2 V2 U1U2 … V1V2 U1 V1 follower “SpectralSubspacePlot”

  21. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  22. Lockstep and SpectralSubspacePlot • Case#0:Nolockstepbehaviorinrandompowerlawgraphof1Mnodes,3Medges • Random“Scatter” Adjacency Matrix SpectralSubspacePlot

  23. Lockstep and SpectralSubspacePlot • Case#1:non-overlappinglockstep • “Blocks”“Rays” Adjacency Matrix SpectralSubspacePlot

  24. Lockstep and SpectralSubspacePlot • Case#2:non-overlappinglockstep • “Blocks;lowdensity”Elongation Adjacency Matrix SpectralSubspacePlot

  25. Lockstep and SpectralSubspacePlot • Case#3:non-overlappinglockstep • “Camouflage” (or “Fame”)Tilting“Rays” Adjacency Matrix SpectralSubspacePlot

  26. Lockstep and SpectralSubspacePlot • Case#3:non-overlappinglockstep • “Camouflage” (or “Fame”)Tilting“Rays” Adjacency Matrix SpectralSubspacePlot

  27. Lockstep and SpectralSubspacePlot • Case#4:?lockstep • “?”“Pearls” Adjacency Matrix SpectralSubspacePlot ?

  28. Lockstep and SpectralSubspacePlot • Case#4:overlappinglockstep • “Staircase”“Pearls” Adjacency Matrix SpectralSubspacePlot

  29. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  30. Algorithm • Step1:Seedselection • Spot“Rays”and“Pearls” • Catchseedfollowers • Step2:BeliefPropagation • Blamefolloweeswithstrangefollowers • Blamefollowerswithstrangefollowees

  31. AutomaticallySpot“Rays”and“Pearls” Spectral SubspacePlot PolarCoordinate Transform Histograms

  32. BP-basedAlgorithm • Blame followees with strange followers • Blame followers with strange followees

  33. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  34. Dataset • TencentWeibo • 117 million nodes(users) • 3.33billiondirectededges

  35. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  36. Real Data “Block” “Rays” “Pearls” “Staircase”

  37. Real Data “Rays” “Block”

  38. Real Data “Pearls” • 3,188 • in F1 • 7,210 • in F2 • 2,457 • in F3 “Staircase” • E1 E2E3E4

  39. Real Data “Pearls” “Staircase” “Staircase”

  40. RealData • Spikesontheout-degreedistribution  

  41. Outline • Method • SVDReminder • “SpectralSubspacePlot” • BP-basedAlgorithm • Experiments • Dataset • RealData • SyntheticData

  42. Synthetic Data • Injectlockstepbehaviorwith“camouflage” perfect

  43. Synthetic Data • Injectoverlapping lockstepbehavior perfect

  44. Contributions • Differenttypesoflockstepbehavior • Ahandbook(rules)toinferlockstepbehaviorwithconnectivitypatterns • Analgorithmtocatchthesuspiciousnodes • Removespikesonout-degreedistribution

  45. Thank you!