A GENERAL SUSPICIOUSNESS METRIC FOR DENSE BLOCKS IN MULTIMODAL DATA - - PowerPoint PPT Presentation

▶
a general suspiciousness metric for dense blocks in
SMART_READER_LITE
LIVE PREVIEW

A GENERAL SUSPICIOUSNESS METRIC FOR DENSE BLOCKS IN MULTIMODAL DATA - - PowerPoint PPT Presentation

Apr 12, 2023 288 likes •632 views

A GENERAL SUSPICIOUSNESS METRIC FOR DENSE BLOCKS IN MULTIMODAL DATA Meng Jiang, University of Illinois at Urbana-Champaign, USA Joint work with Alex Beutel (CMU), Peng Cui (Tsinghua), Bryan Hooi (CMU), Shiqiang Yang (Tsinghua), Christos

slide-1
SLIDE 1

A GENERALSUSPICIOUSNESS METRIC FOR DENSE BLOCKS IN MULTIMODAL DATA

Meng Jiang, University of Illinois at Urbana-Champaign, USA Joint work with Alex Beutel (CMU), Peng Cui (Tsinghua), Bryan Hooi (CMU), Shiqiang Yang (Tsinghua), Christos Faloutsos (CMU)

slide-2
SLIDE 2
  • 1. Motivation & Problem

ROADMAP

  • 2. Proposed Method
  • 3. Experiments

2

slide-3
SLIDE 3

Suppose You Work in Twitter

3

My boss wants me to catch fraud in such a big table – billions of records, tens of columns!!! How?!

fraud

slide-4
SLIDE 4

Massive Multi-Modal Data: Lines (Mass) & Columns (Mode)

4

Dataset Mode Mass

Retweeting

User Root ID IP Time (min) #retweet 29.5M 19.8M 27.8M 56.9K 211.7M

Trending (Hashtag)

User Hashtag IP Time (min) #tweet 81.2M 1.6M 47.7M 56.9K 276.9M

Network attacks (LBNL)

Src-IP Dest-IP Port Time (sec) #packet 2,345 2,355 6,055 3,610 230,836

slide-5
SLIDE 5

SuspiciousBehaviors in Multi-ModalData

5

slide-6
SLIDE 6

Dense Blocks Indicates Suspiciousness

6

user time 225 200 minutes 27,313

slide-7
SLIDE 7

Dense Blocks Indicates Suspiciousness

7

user time 120 minutes 40 12,375

slide-8
SLIDE 8

Dense Blocks Indicates Suspiciousness

8

user time 120 minutes 40 12,375 +Hashtag +URL +Product +Location +…

slide-9
SLIDE 9

Dense Blocks Indicates Suspiciousness

9

user time user time 225 200 minutes 27,313 120 minutes 40 12,375

Question: Which is more suspicious? We need a metric to evaluate the suspiciousness.

slide-10
SLIDE 10
  • 2. Proposed Method

ROADMAP

  • 3. Experiments

10

  • 1. Motivation & Problem
slide-11
SLIDE 11

Metric Criteria

11

What properties are required of a good metric?

n1 ⨉ n2 ⨉ n3 mass c density ρ

N1 ⨉ N2 ⨉ N3 Count data with total “mass” C

n’1 ⨉ n’2 ⨉ n’3 mass c’ density ρ’

f( f( ) )

vs

slide-12
SLIDE 12

Axioms 1-4

12

c1 > c2 ⇐ ⇒ f(n, c1, N, C) > f(n, c2, N, C)

p1 < p2 ⇐ ⇒ ˆ f(n, ρ, N, p1) > ˆ f(n, ρ, N, p2)

slide-13
SLIDE 13

Axiom 5: Multimodal

fK1

  • [nk]K

1 k=1, c, [Nk]K 1 k=1, C

  • = fK
  • ([nk]K

1 k=1, NK), c, [Nk]K k=1, C

  • Lemma 1 Cross-mode comparisons

Not including a mode is the same as including all values for that mode.

=

▶ New information (more modes) can only make our blocks more suspicious

slide-14
SLIDE 14

Our Principled Idea: Scoring Suspiciousness

14

user time user time 225 200 minutes 27,313 120 minutes 40 12,375

slide-15
SLIDE 15

Our Principled Idea: Scoring Suspiciousness

15

user time user time 225 200 minutes 27,313 120 minutes 40 12,375

Probability

0.9% 0.05%

slide-16
SLIDE 16

nNegative log likelihood of block’s probability

A General Suspiciousness Metric

16

slide-17
SLIDE 17

CrossSpot: Local Search with the Metric

nSeed block, adjust modes, select a mode, adjust values in

mode, until convergence.

nSeed selection: HOSVD, or with LockInfer [PAKDD’14] nFast convergence nParallelize to multiple machines: Scalable! 17

slide-18
SLIDE 18

Advantage: “Suspiciousness”+CrossSpot

18

nScore dense blocks nTarget multi-modal data nSatisfy all the axioms

slide-19
SLIDE 19
  • 3. Experiments

ROADMAP

  • 2. Proposed Method

19

  • 1. Motivation & Problem
slide-20
SLIDE 20

Performance: Synthetic Data

nExperiments: Synthetic data

n1,000×1,000×1,000 of 10,000 random data nBlock#1: 30×30×30 of 512

3 modes

nBlock#2: 30×30×1,000 of 512

2 modes

nBlock#3: 30×1,000×30 of 512

2 modes

nBlock#4: 1,000×30×30 of 512

2 modes

20

slide-21
SLIDE 21

Performance: Manipulating Trends

21

slide-22
SLIDE 22

Performance: Network Blocks

# Src-IP×dst-IP×port×second Mass c Suspiciousness CROSSSPOT 1 411×9×6×3,610 47,449 552,465 2 533×6×1×3,610 30,476 400,391 3 5×5×2×3,610 18,881 317,529 4 11×7×7×3,610 20,382 295,869 HOSVD 1 15×1×1×1,336 4,579 80,585 2 1×2×2×1,035 1,035 18,308 3 1×1×1×1,825 1,825 34,812 4 1×13×6×181 1,722 29,224

slide-23
SLIDE 23

Conclusion

nProposed a general “suspiciousness” metric

based on probability for multi-modal behaviors

nCrossSpot: Proposed a local search algorithm for

catching suspicious behaviors

23

Thank you!

  • Meng Jiang, UIUC
  • mjiang89@gmail.com
  • www.meng-jiang.com
slide-24
SLIDE 24

24

slide-25
SLIDE 25

(Erdös-Rényi-)Poisson Model

𝑌𝒋~Poisson(𝑞)

Suspiciousness metric is the negative log-likelihood of the sub-block’s mass

𝑔 𝑍 = −log 3Poisson 𝑍

4|𝑞 4∈7

slide-26
SLIDE 26

Suspiciousness Metric

Suspiciousness metric is the negative log-likelihood of the sub-block’s mass

· · · ⇥ f(n, c, N, C)=c(log c C 1)+C

K

Y

i=1

ni Ni c

K

X

i=1

log ni Ni (1)

ˆ f(n, ρ, N, p) = K Y

i=1

ni ! DKL(ρ||p)

slide-27
SLIDE 27

Suspiciousness Metric

Satisfies all axioms!

· · · ⇥ f(n, c, N, C)=c(log c C 1)+C

K

Y

i=1

ni Ni c

K

X

i=1

log ni Ni (1)

ˆ f(n, ρ, N, p) = K Y

i=1

ni ! DKL(ρ||p)

slide-28
SLIDE 28

Search Algorithm

Algorithm 1 Local Search Require: Data X, seed region Y with ˜ P = { ˜ Pj}K

j=1

1: while not converged do 2:

for j = 1 . . . K do

3:

˜ Pj ADJUSTMODE(j)

4:

end for

5: end while 6: return

˜ P Find optimal* subset of indices in mode j in O(Nj log Nj) time.

*Optimal given other modes are held constant.

Can use previous methods to seed algorithm

slide-29
SLIDE 29

Synthetic Tests (Matrix)

Recall

0.5 1

Precision

0.2 0.4 0.6 0.8 1

CrossSpot SVD (r = 20) SVD (r = 10) SVD (r = 5) MAF AvgDeg

CrossSpot

slide-30
SLIDE 30

Synthetic Tests (3-mode Tensor)

Recall

0.5 1

Precision

0.2 0.4 0.6 0.8 1

CrossSpot HOSVD (r = 20) HOSVD (r = 10) HOSVD (r = 5) MAF

CrossSpot

slide-31
SLIDE 31

Synthetic Tests (3-mode Tensor)

Mass of injected 30*30*30 blocks

512 256 128 64 32 16

Recall

0.2 0.4 0.6 0.8 1

HOSVD CrossSpot (HOSVD seed)

CrossSpot HOSVD

slide-32
SLIDE 32

Suspicious Retweet Blocks

# User⇥tweet⇥IP⇥minute Mass c Suspiciousness CROSSSPOT 1 14⇥1⇥2⇥1,114 41,396 1,239,865 2 225⇥1⇥2⇥200 27,313 777,781 3 8⇥2⇥4⇥1,872 17,701 491,323 HOSVD 1 24⇥6⇥11⇥439 3,582 131,113 2 18⇥4⇥5⇥223 1,942 74,087 3 14⇥2⇥1⇥265 9,061 381,211

slide-33
SLIDE 33

TABLE VII. RETWEETING BOOSTING: WE SPOT A GROUP OF USERS RETWEET “GALAXY NOTE DREAM PROJECT: HAPPY HAPPY LIFE TRAVELLING THE

WORLD” IN LOCKSTEP (EVERY 5 MINUTES) ON THE SAME GROUP OF IP ADDRESSES. (RETWEETING LOG IN BLOCK 225×1×2×200 IN TABLE VI)

User ID Time IP address (city, province) Retweet comment (Google translator: from Simplified Chinese to English) USER-A 11-26 10:08:54 IP-1 (Liaocheng Shandong) Qi Xiao Qi: ”unspoken rules count ass ah, the day listening... USER-B 11-26 10:08:54 IP-1 (Liaocheng Shandong) You gave me a promise, I will give you a result... USER-C 11-26 10:09:07 IP-2 (Liaocheng Shandong) Clouds have dispersed, the horse is already back to God... USER-A 11-26 10:13:55 IP-1 (Liaocheng Shandong) People always disgust smelly socks, it remains to his bed... USER-B 11-26 10:13:57 IP-2 (Liaocheng Shandong) Next life do koalas sleep 20 hours a day, eat two hours... USER-C 11-26 10:14:03 IP-1 (Liaocheng Shandong) all we really need to survive is one person who truly... USER-A 11-26 10:18:57 IP-1 (Liaocheng Shandong) Coins and flowers after the same amount of time... USER-C 11-26 10:19:18 IP-2 (Liaocheng Shandong) My computer is blue screen USER-B 11-26 10:19:31 IP-1 (Liaocheng Shandong) Finally believe that in real life there is no so-called... USER-A 11-26 10:23:50 IP-1 (Liaocheng Shandong) Do not be obsessed brother, only a prop. USER-B 11-26 10:24:04 IP-2 (Liaocheng Shandong) Life is like stationery, every day we loaded pen USER-C 11-26 10:24:19 IP-1 (Liaocheng Shandong) ”The sentence: the annual party 1.25 Hidetoshi premature...