Actionable Objective Optimization for Suspicious Behavior Detection - PowerPoint PPT Presentation

Actionable Objective Optimization for Suspicious Behavior Detection on Large Bipartite Graphs Tong Zhao, Matthew Malir, Meng Jiang DM2 Laboratory Computer Science and Engineering University of Notre Dame

Suspicious Behavior on Bipartite Graph • Bot followers in social networks. • Bully buyers in e-commercial platforms. Notice: Recently, there are some customers making improper evaluations and comments like posting ads or asking for cashbacks. Taobao.com has banned them from posting any comments. Tong Zhao 2

Suspicious Behavior on Bipartite Graph • Bot followers in social networks. • Bully buyers in e-commercial platforms. • Behavior: source users target users. • Source users: followers, buyers. • Target users: followees, sellers. Tong Zhao 3

Key Observation/Assumption • Fraudsters’ avoiding effort forms dense blocks. Tong Zhao 4

Key Observation/Assumption • Fraudsters’ avoiding effort forms dense blocks. Follower seller Tong Zhao 5

Key Observation/Assumption • Fraudsters’ avoiding effort forms dense blocks. Follower seller Tong Zhao 6

Existing Methods • Find a dense subgraph. • Find the suspiciousness vector 𝒗 . (1) max 𝐾(𝑩 𝑡𝑣𝑐 (𝒗)) 𝑣 𝑓 (2) 𝐾 𝐵 𝑡𝑣𝑐 = 𝑜 𝑣 × 𝑜 𝑤 Tong Zhao 7

Does it work? • Yes but NOT Actionable ! Tong Zhao 8

Does it work? • Yes but NOT Actionable ! • Serious consequence of false positive. – An important email is thrown into spam. – A normal Twitter/Taobao account is banned. • Double check the reported suspicious users? Large size of data. • Heavy human labor. Tong Zhao 9

What is actionable? • Blocklist function Tong Zhao 10

What is actionable? • Blocklist function Blocking bullies – Settings • Blocking plug-ins. Allow buyers whose average rating (AR) ≥ 0.92 to purchase items; Tong Zhao 11

What is actionable? • Blocklist function • Blocking plug-ins. Seller Screenshot of the buyer ’ s profile: “… . AR given by the buyer: 85.19% …” “Y ou cannot purchase if your AR is lower than 95% .” “P lease use another account if you hav e.” Tong Zhao 12

Observation Decision Massive Behavior Data Tong Zhao 13

Observation Individual Experience Decision Massive Behavior Data Tong Zhao 14

The Gap Individual Experience Decision Action Gap: Actionable Objectives Massive Behavior Data Tong Zhao 15

Our Idea … Buyer’s … average … rating … Tong Zhao 16

Our Idea … Buyer’s … average … rating … Tong Zhao 17

Our Idea … Buyer’s … average … rating … Tong Zhao 18

Our Idea … Buyer’s … average … rating … Tong Zhao 19

Our Idea • Use platform’s big data . • Learn the best threshold for everyone . • Actionable Objective Optimization (AOO): find the threshold vector 𝒘 . Tong Zhao 20

AOO B ij = ቊ1, 𝑗𝑔 𝐽 𝑗𝑘 = 1 𝑏𝑜𝑒 𝑣 𝑗 < 𝑤 𝑘 ; (3) 0, 𝑝𝑢ℎ𝑓𝑠𝑥𝑗𝑡𝑓. Tong Zhao 21

AOO • Calculate the indicator vectors. 𝑑 (𝑣) = 𝐂 ∙ 𝟐 𝑛 (4) 𝑑 (𝑤) = 𝐂 ∙ 𝟐 𝑜 (5) (𝑣) ≥ 𝛾 (𝑣) ; (𝑣) = ൝1, 𝑗𝑔 𝑑 𝑗 (6) 𝑡 𝑗 0, 𝑝𝑢ℎ𝑓𝑠𝑥𝑗𝑡𝑓. (𝑤) ≥ 𝛾 (𝑤) ; (𝑤) = ൝1, 𝑗𝑔 𝑑 (7) 𝑘 𝑡 𝑘 0, 𝑝𝑢ℎ𝑓𝑠𝑥𝑗𝑡𝑓. Tong Zhao 22

AOO • Find the size and sum of the block. 𝑈 ∙ 𝑡 (𝑣) (8) 𝑜 𝑣 = 𝟐 𝑜 𝑈 ∙ 𝑡 (𝑤) (9) 𝑜 𝑤 = 𝟐 𝑛 𝑓 = 𝑡 (𝑣)𝑈 ∙ 𝐂 ∙ 𝑡 (𝑤) (10) Tong Zhao 23

AOO • Objective function that we want to maximize. 𝑓 (11) 𝐾 𝑒 𝒘 = 𝑜 𝑣 × 𝑜 𝑤 𝑡 (𝑣)𝑈 ∙ 𝐂 ∙ 𝑡 (𝑤) (12) = 𝑈 ∙ 𝑡 (𝑣) )(𝟐 𝑛 𝑈 ∙ 𝑡 (𝑤) ) (𝟐 𝑜 Tong Zhao 24

AOO • Find the partial derivatives with respect to 𝒘 . 𝜖𝐾 𝑒 1 𝜖𝑓 𝑓 𝜖𝑜 𝑣 𝑓 𝜖𝑜 𝑤 (13) = − − 2 𝑜 𝑤 2 𝜖𝑤 𝑙 𝑜 𝑣 𝑜 𝑤 𝜖𝑤 𝑙 𝜖𝑤 𝑙 𝜖𝑤 𝑙 𝑜 𝑣 𝑜 𝑣 𝑜 𝑤 𝑛 𝜖𝑜 𝑣 𝑜 𝜖𝑜 𝑣 𝜖𝐶 𝑗𝑘 (14) = ෍ ෍ 𝜖𝑤 𝑙 𝜖𝐶 𝑗𝑘 𝜖𝑤 𝑙 𝑗=1 𝑘=1 𝑜 (𝑣) 1 − 𝑡 𝑗 (15) = α 2 ෍ (𝑣) 𝑡 𝑗 𝐶 𝑗𝑙 (1 − 𝑕(𝑤 𝑙 − 𝑣 𝑗 )) 𝑗=1 Tong Zhao 25

AOO 𝑛 𝜖𝑜 𝑤 𝑜 𝜖𝑜 𝑤 𝜖𝐶 𝑗𝑘 (16) = ෍ ෍ 𝜖𝑤 𝑙 𝜖𝐶 𝑗𝑘 𝜖𝑤 𝑙 𝑗=1 𝑘=1 𝑜 (17) (𝑤) (1 − 𝑡 𝑙 (𝑤) ) ෍ = α 2 𝑡 𝑙 𝐶 𝑗𝑙 (1 − 𝑕(𝑤 𝑙 − 𝑣 𝑗 )) 𝑗=1 𝑜 𝑛 𝜖𝑓 𝜖𝑓 𝜖𝐶 𝑗𝑘 (18) = ෍ ෍ 𝜖𝑤 𝑙 𝜖𝐶 𝑗𝑘 𝜖𝑤 𝑙 𝑗=1 𝑘=1 𝑜 𝑛 𝑜 𝑜 (𝑣) 1 − 𝑡 𝑗 (𝑤) + 𝑜𝛽𝑡 𝑙 (𝑤) 1 − 𝑡 𝑙 (𝑤) ෍ (𝑣) + 𝑡 𝑙 (𝑤) ෍ (19) = α 2 ෍ (𝑣) (𝑣) 𝑡 𝑗 ෍ 𝐶 𝑗𝑟 𝑡 𝑟 𝐶 𝑞𝑙 𝑡 𝑞 𝑡 𝑗 𝑗=1 𝑟=1 𝑞=1 𝑗=1 Tong Zhao 26

AOO 𝐾 𝑒 𝒘 and 𝜖𝐾 𝑒 𝜖𝒘 Each seller Tong Zhao 27

Experiments • On both synthetic datasets and real-world datasets. • Baselines: – SpokEn (Prakash, et al., 2010) – CatchSync (Jiang, et al., 2014) – Fraudar (Hooi, et al., 2016) – Actionable version of each of them. Tong Zhao 28

Actionable Version Baselines Tong Zhao 29

Actionable Version Baselines Tong Zhao 30

Actionable Version Baselines Tong Zhao 31

Synthetic Data Tong Zhao 32

Experiment Results Sparse blocks Dense blocks Tong Zhao 33

Experiment Results • Changing the attack density. • Number of blocks = 3. Tong Zhao 34

Real-word Dataset • Amazon reviews in 2015. • 4,552 users (buyers). • 6,347 products (sellers). • 231,600 ratings with reviews. Tong Zhao 35

Observations on Real-word Dataset Buyers’ average rating distribution Word cloud of all reviews Tong Zhao 36

Observation on the Results Word cloud of all bad reviews not blocked by AOO Word cloud of all reviews blocked by AOO Tong Zhao 37

Conclusions • Revisited the problem of suspicious behavior detection from the perspective of individuals. • Proposed a novel Actionable Objective Optimization (AOO) method that finds actionable solution of preventing fraud behaviors to happen. • Experimental results showed that AOO is effective and efficient. Tong Zhao 38

Thank you! • Any questions? Tong Zhao 39

Synthetic Experiment Results • Quadratic time complexity. • 𝑃(𝑛𝑜 𝑠 𝑢) . – 𝑛 : number of users. – 𝑜 𝑠 : number of ratings. – 𝑢 : number of iterations. Tong Zhao 40