DMCA
CopyCatch: Stopping Group Attacks by Spotting Lockstep Behavior in Social Networks
| Citations: | 19 - 7 self |
BibTeX
@MISC{Guruswami_copycatch:stopping,
author = {Venkatesan Guruswami and Alex Beutel and Christopher Palow and Wanhong Xu and Christos Faloutsos},
title = {CopyCatch: Stopping Group Attacks by Spotting Lockstep Behavior in Social Networks},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
How can web services that depend on user generated content discern fraudulent input by spammers from legitimate input? In this paper we focus on the social network Facebook and the problem of discerning ill-gotten Page Likes, made by spammers hoping to turn a profit, from legitimate Page Likes. Our method, which we refer to as CopyCatch, detects lockstep Page Like patterns on Facebook by analyzing only the social graph between users and Pages and the times at which the edges in the graph (the Likes) were created. We offer the following contributions: (1) We give a novel problem formulation, with a simple concrete definition of suspicious behavior in terms of graph structure and edge constraints. (2) We offer two algorithms to find such suspicious lockstep behavior- one provably-convergent iterative algorithm and one approximate, scalable MapReduce implementation. (3) We show that our method severely limits “greedy attacks ” and analyze the bounds from the application of the Zarankiewicz problem to our setting. Finally, we demonstrate and discuss the effectiveness of CopyCatch at Facebook and on synthetic data, as well as potential extensions to anomaly detection problems in other domains. CopyCatch is actively in use at Facebook, searching for attacks on Facebook’s social graph of over a billion users, many millions of Pages, and billions of Page Likes.
Keyphrases
social network group attack lockstep behavior social graph greedy attack detection problem social network facebook page like edge constraint legitimate input novel problem formulation suspicious behavior simple concrete definition content discern fraudulent input provably-convergent iterative algorithm many million suspicious lockstep ill-gotten page like following contribution scalable mapreduce implementation zarankiewicz problem potential extension lockstep page graph structure synthetic data legitimate page like
