Inferring Strange Behavior from Connectivity Pattern in Social - - PowerPoint PPT Presentation

▶
inferring strange behavior from connectivity pattern in
SMART_READER_LITE
LIVE PREVIEW

Inferring Strange Behavior from Connectivity Pattern in Social - - PowerPoint PPT Presentation

Mar 03, 2023 692 likes •1.16k views

Inferring Strange Behavior from Connectivity Pattern in Social Networks Meng Jiang, Peng Cui, Shiqiang Yang (Tsinghua, Beijing) Alex Beutel, Christos Faloutsos (CMU) What is Strange Behavior? Who -follows- whom network with billions

slide-1
SLIDE 1

Inferring Strange Behavior from Connectivity Pattern in Social Networks

Meng Jiang, Peng Cui, Shiqiang Yang (Tsinghua, Beijing) Alex Beutel, Christos Faloutsos (CMU)

slide-2
SLIDE 2

What is Strange Behavior?

  • “Who-follows-whom” network with billions of

edges: Twitter, Weibo, etc.

slide-3
SLIDE 3

What is Strange Behavior?

  • Sell followers: “Become a Twitter Rockstar”

$ $ $

0.9 TWD per edge

slide-4
SLIDE 4

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet connect

slide-5
SLIDE 5

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet #follower↑+1,000 connect

slide-6
SLIDE 6

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet More customers…  100

Unsafe!

connect

slide-7
SLIDE 7

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet  100  5,000 connect connect More customers…

slide-8
SLIDE 8

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet  100  5,000 I want more followers… connect connect

slide-9
SLIDE 9

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet  100  5,000 connect connect connect

slide-10
SLIDE 10

What is Strange Behavior?

$ $ $

 100 customer  1,000 botnet connect  100  5,000  ….  …. More groups of customers More groups of botnets More companies….

slide-11
SLIDE 11

What is Strange Behavior?

$ $ $

customer botnet connect Detect dense biparitite cores! How can we evade detection? Some other activity!

slide-12
SLIDE 12

What is Strange Behavior?

$ $ $

customer botnet “Camouflage”: may connect to popular idols to look normal connect

slide-13
SLIDE 13

What is Strange Behavior?

$ $ $

customer botnet “Fame”: may have a few honest followers connect

slide-14
SLIDE 14

Adjacency Matrix Reminder

Graph Structure Adjacency Matrix followee follower    

slide-15
SLIDE 15

Strange Lockstep Behavior

  • Groups
  • Acting together
  • Little other activity

customer botnet connect

camouflage

fame

slide-16
SLIDE 16

More Applications

  • eBay reviews
slide-17
SLIDE 17

More Applications

  • Facebook “Likes”
slide-18
SLIDE 18

Problem Definition

  • Given adjacency matrix
  • Find Strange = “Lockstep” Behavior

reordering

slide-19
SLIDE 19

Outline

  • Method

– SVD Reminder – “Spectral Subspace Plot” – BP-based Algorithm

  • Experiments

– Dataset – Real Data – Synthetic Data

slide-20
SLIDE 20

SVD Reminder

follow

Graph Structure Adjacency Matrix

followee follower

   

followee follower

U1U2 V1V2

U1 U2 V1 V2

“Spectral Subspace Plot” Pairs of singular vectors: SVD: A=USVT

1 2

slide-21
SLIDE 21

Outline

  • Method

– SVD Reminder – “Spectral Subspace Plot” – BP-based Algorithm

  • Experiments

– Dataset – Real Data – Synthetic Data

slide-22
SLIDE 22

Lockstep and Spectral Subspace Plot

  • Case #0: No lockstep behavior in random

power law graph of 1M nodes, 3M edges

  • Random “Scatter”

Adjacency Matrix Spectral Subspace Plot

slide-23
SLIDE 23

Lockstep and Spectral Subspace Plot

  • Case #1: non-overlapping lockstep
  • “Blocks” “Rays”

Adjacency Matrix Spectral Subspace Plot

slide-24
SLIDE 24

Lockstep and Spectral Subspace Plot

  • Case #2: non-overlapping lockstep
  • “Blocks; low density” Elongation

Adjacency Matrix Spectral Subspace Plot

slide-25
SLIDE 25

Lockstep and Spectral Subspace Plot

  • Case #3: non-overlapping lockstep
  • “Camouflage” (or “Fame”) Tilting “Rays”

Adjacency Matrix Spectral Subspace Plot

slide-26
SLIDE 26

Lockstep and Spectral Subspace Plot

  • Case #3: non-overlapping lockstep
  • “Camouflage” (or “Fame”) Tilting “Rays”

Adjacency Matrix Spectral Subspace Plot

slide-27
SLIDE 27

Lockstep and Spectral Subspace Plot

  • Case #4: ? lockstep
  • “?” “Pearls”

Adjacency Matrix Spectral Subspace Plot

?

slide-28
SLIDE 28

Lockstep and Spectral Subspace Plot

  • Case #4: overlapping lockstep
  • “Staircase” “Pearls”

Adjacency Matrix Spectral Subspace Plot

slide-29
SLIDE 29

Outline

  • Method

– SVD Reminder – “Spectral Subspace Plot” – BP-based Algorithm

  • Experiments

– Dataset – Real Data – Synthetic Data

slide-30
SLIDE 30

Algorithm

  • Step 1: Seed selection

– Spot “Rays” and “Pearls” – Catch seed followers

  • Step 2: Belief Propagation

– Blame followees with strange followers – Blame followers with strange followees

slide-31
SLIDE 31

Automatically Spot “Rays” and “Pearls”

Spectral Subspace Plot Polar Coordinate Transform Histograms

slide-32
SLIDE 32

BP-based Algorithm

  • Blame followees with strange followers
  • Blame followers with strange followees
slide-33
SLIDE 33

Outline

  • Method

– SVD Reminder – “Spectral Subspace Plot” – BP-based Algorithm

  • Experiments

– Dataset – Real Data – Synthetic Data

slide-34
SLIDE 34

Dataset

  • Tencent Weibo
  • 117 million nodes (users)
  • 3.33 billion directed edges
slide-35
SLIDE 35

Outline

  • Method

– SVD Reminder – “Spectral Subspace Plot” – BP-based Algorithm

  • Experiments

– Dataset – Real Data – Synthetic Data

slide-36
SLIDE 36

Real Data

“Pearls” “Staircase” “Rays” “Block”

slide-37
SLIDE 37

Real Data

“Rays” “Block”

slide-38
SLIDE 38

Real Data

“Pearls” “Staircase” 3,188 in F1 E1 E2 E3 E4 7,210 in F2 2,457 in F3

“F-E”

F1-… F2-… F3-…

Density 91.3% 92.6% 89.1%

slide-39
SLIDE 39

Real Data

“Staircase”

“Staircase” “Pearls”

slide-40
SLIDE 40

Real Data

  • Spikes on the out-degree distribution

 

slide-41
SLIDE 41

Outline

  • Method

– SVD Reminder – “Spectral Subspace Plot” – BP-based Algorithm

  • Experiments

– Dataset – Real Data – Synthetic Data

slide-42
SLIDE 42

Synthetic Data

  • Inject lockstep behavior with “camouflage”

perfect

slide-43
SLIDE 43

Synthetic Data

  • Inject overlapping lockstep behavior

perfect

slide-44
SLIDE 44

Contributions

  • Different types of lockstep behavior
  • A handbook (rules) to infer lockstep behavior

with connectivity patterns

  • An algorithm to catch the suspicious nodes
  • Remove spikes on out-degree distribution
slide-45
SLIDE 45

Thank you!