Presentation on theme: "Social Bots and Malicious Behavior"— Presentation transcript:
1Social Bots and Malicious Behavior Kristina LermanUniversity of Southern CaliforniaAccess to data allows us to ask new questions, empirically measure effectsCS 599: Social Media AnalysisUniversity of Southern California
4Bot presence is growing online Faking influenceCompanies, celebrities, politicians buy followers, likes to appear more popularAstroturfingpractice of masking the sponsors of a message to give the appearance of grassroots participation.Hashtag overload – “denial of cognitive service” attack In 2012 presidential elections in Mexico, PRI, was accused of using tens of thousands of bots to drown out opposing parties’ messages on Twitter and FacebookPhantom jamIsraeli students created bots that caused a phony traffic jam on Waze
5Sai Kaushik Ponnekanti Detecting and Tracking the Spread of Astroturf Memes in Microblog StreamsJacob Ratkiewicz Michael Conover Mark Meiss Sneha P Bruno Gonçalves Alessandro F Filippo MenczerPresented bySai Kaushik Ponnekanti
6IntroductionMicroblogs have become a very valuable media to spread information, it is natural for people to find ways to abuse themThis paper focuses on tracking political memes on Twitter and help detect astroturfing, smear campaigns and misinformation about US politicsMeme ?an idea, belief or belief system, or pattern of behavior that spreads throughout a culture.
7Introduction Astroturf? Ex : The deceptive tactic of simulating grassroots support for a product, cause, etc., undertaken by people or organizations with an interest in shaping public opinionEx :A case of using 9 fake accounts to promote a url to prominence. 9 fake accounts created 930 tweets in 138 mins all having link to a url smearing a candidate for 2009 Massachusetts election. In a few hours, it got promoted to the top of google search for ‘martha coakley’ creating a so called ‘twitter bomb’This demonstrates how a focused effort can initiate viral spread of information on twitter and the serious consequences this can have.
8Difference between Spam and Truthy Truthy – a political astroturf.Truthy is a type of spam, butSpam – make you click url or somethingTruthy – establish a false group sensus about a particular ideaMany of the users involved in propagating the political astroturfs may be legitimate users who themselves have been deceived.So traditional spam detection mechanisms wont work.
9FeaturesTo study information diffusion in Twitter, we need to single out features to identify a specific topic which is propagating.To do so, authors have chosen the below set of features.Hashtags in the tweetMentions in the tweetURLS mentioned in the tweetsPhrases – text of the tweet after the metadata, punctuation and urls have been removed.
11Data CollectionTwitter garden hose has been used to collect data about the tweets. All the collected tweets are stored in a file with daily time resolution
12Meme DetectionGo through tweets collected in first step to see which are to be stored in database for further analysisThe goal is to collect tweetsWith content related to the political electionsOf sufficiently general interestFor (1) , a hand curated list of 2500 keywords relating to 2010 elections have been usedCalled the Tweet FilterWould result in many many tweets because any hash tag, url or mention is considered
13Meme Detection(2) – this stage is called meme filtering, goal is to pick out only those tweets which are of general interestIf any meme exceeds a rate threshold of five mentions in a given hour it is considered ‘activated’ – storedIf a tweet contains an ‘activated’ meme - immediately storedWhen the mention rate of the meme drops below the threshold – No longer consideredThis low threshold is chosen because the authors thought that if a meme appeared 5 times in the sample, it is likely mentioned many more times in twitter are large
14Network AnalysisKlatsch – A unified framework which makes it possible to analyze users and diffusion for broad variety of user feedsDue to the diversity among site designs and data models, any tools written for one site are not easily portable to anotherThe Klatsch framework is used for the network analysis and layout for visualization of diffusion patterns in the truthy architecture
16Network AnalysisTo characterize the diffusion network, we store statistics like number of nodes and edges in the graph, the mean degree and strength of nodes in the graph, mean edge weightAdditionally we also store, out degree of the most prolific broadcaster and also the in degree of the most focused upon user.
17Sentiment AnalysisIn addition to the graph based statistics, the authors also do the sentiment analysis using the GPOMS (Google-based Profile of Mood States)GPOMS assigns a six-dimensional vector with bases corresponding to different mood attributes, namely Calm, Alert, Sure, Vital, Kind, and HappyGPOMS relies for vocabulary on POMS.72 adjectives associated with corresponding mod dimensions
18Sentiment AnalysisUsing 5 grams like ‘ I feel X and Y’ where X is a POMS vocabulary, GPOMS increased its vocabulary to 964 tokens associated with the 6 dimensionsApply GPOMS to collection of tweets to get the mood vector
19Web InterfaceThe final component of the analytical framework includes a dynamic Web interface to allow users to inspect memes through various views, and annotate those they consider to be truthy
21Truthiness Classification A binary classifier trained to automatically label legitimate and truthy memesTraining Data :Hand labeled corpus of training examples in 3 classes(truthy, legitimate, remove) is usedPeople were asked to label the memes into the 3 specified categoriesTruthy – If it may be a political astroturfLegitimate – If it is a natural memeRemove – if it is in foreign language or didn’t belong to politics
22Results The initial results showed around 90% accuracy Examples of truthys uncovered by this model#ampat The #ampat hashtag is used by many conservative users on Twitter. What makes this meme suspicious is that the bursts of activity are driven by two which are controlled by the same user, in an apparent effort to give the impression that more people are tweeting about the same topics. This user posts the same tweets using the two accounts and has generated a total of over 41, 000 tweets in this fashion.
23ObservationsThe authors observed that the detection of truthys is possible in the initial stages of the meme injectionBecause once it gains attention of the community, it is very difficult to distinguish between a truthy and a legitimate meme.
25Limiting the Spread of Misinformation in Social Networks Ceren Budak, Divyakant Agrawal, Amr El AbbadiUniversity of California, Santa BarbaraPresented byGouthami Kondakindi
26Focus of the ResearchFinding a near-optimal way to spread good information in the network so as to minimize the effects of bad campaigns.How? Limiting Campaigns: Used to counteract the effect of misinformation.This optimization problem is NP-HardPaper finds greedy approach approximation for the problem; Also finds heuristics(degree centrality, early infectees, largest infectees) that are comparable in performance to Greedy approach.
27Related Study Influence maximization problem Selecting a subset of the network for initial activation so that the information spread is maximumPast studies ignore certain aspects of real social networks like existence of competing campaignsConclusions from studies similar to this study:Best strategy for first player is to choose high degree nodes(Study competing campaigns as a game problem)
28Need behind the StudyEarlier similar studies consider that the two campaigns(good and bad) propagate exactly the same wayEarlier studies study influence maximizationPresent study – Competing campaigns have different acceptance rates. Also, one campaign starts in response to the other. Hence, campaign of last player is started with a delayPresent study – Addresses influence limitation as opposed to maximization
29Methodology and Definitions Social network can be modeled as a directed graphpv,w = Used to model the direct influence v has on wL – Limiting Campaign; C – Bad CampaignIndependent Cascade Model:One of the most basic and well-studied diffusion modelsWhen a node v first becomes active in time step t, it has a single chance to activate each currently inactive neighbor w. If v is successful in activation, w becomes active at time step t+1. v cannot make further attempts after time tIf w has incoming edges from multiple newly activated nodes, their attempts are sequenced in an arbitrary order
30Methodology and Definitions Influence Diffusion Models used in the paper:Model diffusion of two cascades evolving simultaneously in a network. Let L and C be the two campaigns.Multi-Campaign Independent Cascade Model (MCICM)Similar to ICM. If two or more nodes try to activate node w at the same time, at most one of them succeeds with probability pL,v,w (or pC,v,w)Assumption: If good and bad campaigns both reach a node at same time, good is preferred over bad (High Effectiveness Property)Campaign-Oblivious Independent Cascade Model (COICM)Unlike MCICM, no matter what information reaches node v, it forwards it to it’s neighbor w with probability pv,w
31Problem Definition Eventual Influence Limitation problem: Minimizing the number of nodes that end up adopting campaign C when information cascades from both the campaigns are over.To solve this problem, authors assume MCICM as the model of communicationCampaign C starts spreading bad news starting at node n. This is detected with a delay r. Limiting Campaign L is hence initiated after r
32Eventual Influence Limitation (EIL) Suppose C starts spreading bad information which is detected after time r. Given a budget k, select AL seeds for initial activation of L such that expected number of nodes adopting C is limitedSimplification: Consider only a single source of bad information i.e., | AC |=1. Also, considering high- effectiveness property, pL,v,w = 1Despite the simplification, problem is still NP-Hard. Authors prove NP-Hardness of the problem by considering Set Cover as a special case of EIL
33General Influence Spread In order to save (3), do we need to save both (1) & (2)? NO. If L can reach (3) before C, (3) can never be infected. If L reaches node (1) by r = 1, it will be saved. In this case, L will reach (3) at r = 2 and even if (2) is not saved, that still guarantees that (3) will be saved. Conclusion: Saving nodes along shorter path to target is sufficient to save the target.
34Solutions for Eventual Influence Limitation EIL is NP-Hard. Hence, greedy approximation can give a polynomial time solution to EILBut, greedy approach is also too costly in real world networkSolution? Consider other alternatives to greedy:Degree CentralityEarly InfecteesRun a number of simulations of infection spread from S (start node for C) and select nodes infected at time step r in decreasing orderLargest InfecteesChoose seeds that are expected to infect highest number of nodes if they were infected. Run number of simulations from S and if node I is in path from S to nodes n[k], we increase value of I by k. Return in decreasing order the nodes having highest value.
35EvaluationPerformed experiments on 4 regional network graphs from FacebookSB08: 2008 snapshot of Santa Barbara regional network with nodes and edgesSB09: 2009 snapshot of same network with nodes and edges (bigger network)MB08: 2008 snapshot of Monterey Bay network with nodes and edgesMB09: 2009 snapshot of same network with nodes and edges (bigger network)
36Evaluation (with PC,v,w = 0.1) k = Number of initially activated nodes in campaign L Observation: When L has high effectiveness property, the biggest factor is determining how late the limiting campaign L is started
37Evaluation (with Pv,w = 0.1) COICM => No high effectiveness Observation: Compare 3(a) and 4(a). 3(a) has high effectiveness and hence could save 95% of population with 10 seeds. 4(a) could save only 72%. If 4(b), campaign C has start node with degree 40. None of the methods are able to save more nodes because by the time campaign L starts, C has already affected large no of nodes
38EvaluationBigger dataset and no high effectiveness. Observation: Compare 5(b) with 3(a). Even if L does not have high effectiveness, if it is dominant than C, it is still able to save a large population. Greedy approach was not considered because it is computationally very expensive for bigger dataset and without the high effectiveness optimization.
39Crucial ObservationsIn almost all cases, largest infectees performs comparable with greedy approach and is far less computationally expensive than greedyParameters such as delay of L, connectedness of adversary campaign C’s start node(i.e., it’s degree) are crucial to determining which method to use.Eg: Degree centrality is a good option when delay is small but a bad choice when delay is largeHaving sufficient information about such parameters can help identify the best method for EIL
40Further ExtensionsThe authors so far considered the scenario where number of nodes affected by bad campaign C, number of nodes still inactive(unaffected) are all known. But in real world networks, such information is difficult to obtainThey discuss a solution for Eventual Influence Limitation with incomplete data using their algorithm Predictive Hill Climbing Approach (PHCA)- Beyond the scope of this discussion. Involves high level mathematical concepts. Please refer to the paper for more information.
41Conclusion Investigated efficient solution to: Given a social network where a (bad) information campaign is spreading, who are the k “inﬂuential” people to start a counter- campaign if our goal is to minimize the effect of the bad campaign? – Eventual Influence Limitation problemProved that EIL is NP-Hard. Stated 3 heuristics comparable in performance to greedy approach and good approximation for EILExplored different aspects of the problem such as effect of starting the limiting campaign early/late, properties or adversary and how prone the population is to accepting either one of the campaignsAlso studied EIL in presence of missing information with PHCA (not discussed here)
42The rise of social bots (Ferrara et al.) Bots have been around for yearsNow, the boundary between human and bot is fuzzier. Bots haveReal sounding namesKeep human hours (stop at night)Engage in social behaviorShare photosUse emoticons, LOLConverse with each otherCreate realistic social networksCan we spot bots?
43Bot or not?Automatically classify Twitter accounts as human or bot based on ~1000 different features
48Open questions How many social bots are there? Who creates and controls them?For what purpose?What share of content can be attributed to bots?As we build better detection systems, we expect an arms race similar to that observed for spam in the past“The race will be over only when the increased cost of deception will no longer be justified due to the effectiveness of early detection.”