Towards Detecting Anomalous User Behavior in Online Social Networks

Users increasingly rely on crowdsourced information, such as reviews on Yelp and Amazon, and liked posts and ads on Facebook. This has led to a market for black-hat promotion techniques via fake (e.g., Sybil) and com-promised accounts, and collusion networks. Existing ap-proaches to detect such behavior relies mostly on super-vised (or semi-supervised) learning over known (or hy-pothesized) attacks. They are unable to detect attacks missed by the operator while labeling, or when the at-tacker changes strategy. We propose using unsupervised anomaly detection techniques over user behavior to distinguish potentially bad behavior from normal behavior. We present a tech-nique based on Principal Component Analysis (PCA) that models the behavior of normal users accurately and identifies significant deviations from it as anomalous. We experimentally validate that normal user behavior (e.g., categories of Facebook pages liked by a user, rate of like activity, etc.) is contained within a low-dimensional sub-space amenable to the PCA technique. We demonstrate the practicality and effectiveness of our approach using extensive ground-truth data from Facebook: we success-fully detect diverse attacker strategies—fake, compro-mised, and colluding Facebook identities—with no a pri-ori labeling while maintaining low false-positive rates. Finally, we apply our approach to detect click-spam in Facebook ads and find that a surprisingly large fraction of clicks are from anomalous users.