TR-13-6.pdf

"UNIK: unsupervised social network spam detection" 

Enhua Tan, Lei Guo, Songqing Chen, Xiaodong Zhang, and Yihong (Eric) Zhao 

Proceedings of 22nd ACM International Conference on Information and  
Knowledgement Management (CIKM 2013), San Francisco, October 27- November 1, 2013.

Abstract

Social network spam increases explosively with the rapid development
and wide usage of various social networks on the
Internet. To timely detect spam in large social network sites,
it is desirable to discover unsupervised schemes that can save
the training cost of supervised schemes. In this work, we first
show several limitations of existing unsupervised detection
schemes. The main reason behind the limitations is that existing
schemes heavily rely on spamming patterns that are
constantly changing to avoid detection. Motivated by our
observations, we first propose a sybil defense based spam
detection scheme SD2 that remarkably outperforms existing
schemes by taking the social network relationship into
consideration. In order to make it highly robust in facing
an increased level of spam attacks, we further design an unsupervised
spam detection scheme, called UNIK. Instead of
detecting spammers directly, UNIK works by deliberately
removing non-spammers from the network, leveraging both
the social graph and the user-link graph. The underpinning
of UNIK is that while spammers constantly change their
patterns to evade detection, non-spammers do not have to
do so and thus have a relatively non-volatile pattern. UNIK
has comparable performance to SD2 when it is applied to a
large social network site, and outperforms SD2 significantly
when the level of spam attacks increases. Based on detection
results of UNIK, we further analyze several identified spam
campaigns in this social network site. The result shows that
different spammer clusters demonstrate distinct characteristics,
implying the volatility of spamming patterns and the
ability of UNIK to automatically extract spam signatures.