Spotting Suspicious Behaviors in Multimodal Data: A General Metric and Algorithms

• Published in: IEEE transactions on knowledge and data engineering Vol. 28; no. 8; pp. 2187 - 2200
• Main Authors: Meng Jiang, Beutel, Alex, Peng Cui, Hooi, Bryan, Shiqiang Yang, Faloutsos, Christos
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.08.2016; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Advertising; Algorithms; Axioms; Data mining; dense blocks; Deviation; Facebook; Fraud; fraud detection; Graphs; IP networks; Mathematical analysis; Measurement; multimodal data; Spots; Suspicious behavior; Tagging; Tensile stress; Twitter
• ISSN: 1041-4347; 1558-2191
• DOI: 10.1109/TKDE.2016.2555310

Many commercial products and academic research activities are embracing behavior analysis as a technique for improving detection of attacks of many sorts-from retweet boosting, hashtag hijacking to link advertising. Traditional approaches focus on detecting dense blocks in the adjacency matrix of graph data, and recently, the tensors of multimodal data. No method gives a principled way to score the suspiciousness of dense blocks with different numbers of modes and rank them to draw human attention accordingly. In this paper, we first give a list of axioms that any metric of suspiciousness should satisfy; we propose an intuitive, principled metric that satisfies the axioms, and is fast to compute; moreover, we propose CrossSpot, an algorithm to spot dense blocks that are worth inspecting, typically indicating fraud or some other noteworthy deviation from the usual, and sort them in the order of importance ("suspiciousness"). Finally, we apply CrossSpot to the real data, where it improves the F1 score over previous techniques by 68 percent and finds suspicious behavioral patterns in social datasets spanning 0.3 billion posts.