CopyCatch: Stopping Group Attacks by Spotting Lockstep Behavior in Social Networks (WWW2013) BEUTEL, ALEX, WANHONG XU, VENKATESAN GURUSWAMI, CHRISTOPHER PALOW, AND CHRISTOS FALOUTSOS. GROUP 20

Outline 1. Motivation 2. Problem Formulation 3. Solutions ◦3.1 Serial Algorithm ◦3.2 Mapreduce implementation 4. Experiments 5. Conclusion

1. Motivation 1. Misleading feedback 2. Boost Facebook Page Like count ill-gotten Like: a Like that doesn’t come from someone truly interested in connecting with a Page 3. Existing defense mechanisms in Facebook: anti-fishing, anti-malware, fake account detection

2. Problem Formulation 1. Detecting ill-gotten Page Like on Facebook (and other deceitful user feedback in many other online setting) 2. Lockstep behavior: groups of users acting together, generally Liking the same Pages at around the same time

3. Problem Formulation

2. Problem Formulation

Finding the bipartite core is NP-hard Suspicious

2. Problem Formulation Maximize the number of suspicious users and the number of Page Likes of suspicious users that are suspicious (fall within the designated time window)

3. Solutions Question: What do we have? User-page Like relationship→ bipartite graph Like time→ edge creation time 3.1 A Serial Algorithm iteratively update 3.2 MapReduce Implementation parallel running

3.1. Serial Algorithm keep P′ constant and update c. Keep c constant and update P′.

3.1 Serial Algorithm In the updateCenter() function: keep P’ constant and update c. Loosen the width to Δt where >1 In the update Subspace() function: keep c constant and update P’. Any user that were covered before will still be.

3.1 Serial Algorithm Converge ：

3.2 Mapreduce Implementation Brief Introduction to Mapreduce

3.2 Mapreduce Implementation Input: a set of clusters. Each cluster has a center c, and P’. Output: updated c and P’ for each cluster.

3.2 Mapreduce Implementation Algorithm: (1)Mapper: Take input as L and I. For each user i, check if it belongs to cluster k. If yes, output (k, (L i,*, I i,* )). (2)Reducer: Take input as (k, (L i,*, I i,* )). Then for each cluster k, update c and P’.

4. Experiments 4.1 Scalability 4.2 Convergence 4.3 Effectiveness Dataset: real Facebook like data &synthetic data

4.1 Scalability Good Scalability: Linear relationship between the data size and runtime

4.2 Convergence Although MapReduce Algorithm is not provably convergent, it is convergent in practice.

4.3 Effectiveness This Algorithm can find the most attacks in practice

Conclusion (1) Give a novel problem formulation, with a simple concrete definition of suspicious behavior in terms of graph structure and edge constraints. (2) Two algorithms to find such suspicious lockstep behavior: ◦one provably-convergent iterative algorithm ◦one approximate, scalable MapReduce implementation

Thanks