Shulou(Shulou.com)06/01 Report--

Wang Hao

Haow85@outlook.com

All kinds of frauds are rampant on the Internet. Especially since the birth of social networks, many professions and black industry chains have made a living through fraud. A common fraud is a large number of simultaneous false likes, that is, a large number of users Synchronized Attack the same page in a short period of time. For this specific fraud, academic researchers and industrial engineers have specifically studied an algorithm called SynchroTrap. The algorithm was deployed in Facebook and Instagram systems and detected 2 million fraudulent accounts and 1156 large-scale networks in a month.

SynchroTrap's algorithm is very simple, the most basic principle is to use Jaccard similarity to select those users who are particularly similar in a certain time window.

Let's take a look at the difference between Synchronized Attack and normal user behavior:

The figure (a) above shows Synchronized Attack, which shows that a large number of users produce some kind of behavior almost at the same time in a very short period of time, while the user behavior in (b) is more of a random distribution.

To better understand Synchronized Attack fraud, let's take a look at the economic constraints of fraud:

1. It is usually due to computational resources and operating costs. Fraudulent users usually control a large number of users in a limited time.

two。 Because of the black economy, fraud is usually task-oriented, that is, there is a task time limit.

In order to better solve the Synchronized Attack problem, we first define the concept of "matching". The so-called matching means:

Where U is the user id, C is the user's behavior set, and T is the time when the behavior set is generated.

Define the Jaccard similarity between users as follows:

Where:

After calculating the similarity between users and users, we get a graph with users as nodes. Then we use the method of single-link agglomeration hierarchical clustering to cluster users:

The time complexity of SynchroTrap is O (rn ^ 2).

The principle of SynchroTrap algorithm is very simple. It detects Synchronized Attack problems.

It is transformed into a clustering problem. The clustering problem inevitably involves the calculation of the distance between points. The authors of SynchroTrap use the commonly used similarity distance calculation measure Jaccard Distance to represent the distance between points. Then clustering is carried out by using the method of agglomeration and hierarchical clustering. The whole process of the algorithm is very simple and smooth.

The figure above shows the number of users detected per week over an 11-week period.

Original: Uncovering Large Groups of Active Malicious Accounts in Online Social Networks

Original author: Qiang Cao, Xiaowei Yang, Jieqi Yu, Christopher Palow

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.