Spotting Fake Reviewer Groups in Consumer Reviews

Transcription

1 Spon Fae Revewer roups n Consumer Revews Arun Muheree Deparmen of Compuer Scence Unversy of Illnos a Chcao 85 S. Moran Chcao IL 667 arun4787@mal.com Bn Lu Deparmen of Compuer Scence Unversy of Illnos a Chcao 85 S. Moran Chcao IL 667 lub@cs.uc.edu Naale lance oole Inc. 472 Forbes Ave Lower Level Psburh PA 523 nlance@oole.com ABSTRACT Opnonaed socal meda such as produc revews are now wdely used by ndvduals and oranzaons for her decson man. However due o he reason of prof or fame people ry o ame he sysem by opnon spammn (e.. wrn fae revews) o promoe or demoe some are producs. For revews o reflec enune user experences and opnons such spam revews should be deeced. Pror wors on opnon spam focused on deecn fae revews and ndvdual fae revewers. However a fae revewer roup (a roup of revewers who wor collaboravely o wre fae revews) s even more daman as hey can ae oal conrol of he senmen on he are produc due o s sze. Ths paper sudes spam deecon n he collaborave sen.e. o dscover fae revewer roups. The proposed mehod frs uses a frequen emse mnn mehod o fnd a se of canddae roups. I hen uses several behavoral models derved from he colluson phenomenon amon fae revewers and relaon models based on he relaonshps amon roups ndvdual revewers and producs hey revewed o deec fae revewer roups. Addonally we also bul a labeled daase of fae revewer roups. Alhouh labeln ndvdual fae revews and revewers s very hard o our surprse labeln fae revewer roups s much easer. We also noe ha he proposed echnque depars from he radonal supervsed learnn approach for spam deecon because of he nheren naure of our problem whch maes he classc supervsed learnn approach less effecve. Expermenal resuls show ha he proposed mehod ouperforms mulple sron baselnes ncludn he sae-of-he-ar supervsed classfcaon reresson and learnn o ran alorhms. Caeores and Subec Descrpors H..2 [Informaon Sysems]: Human Facors; J.4 [Compuer Applcaons]: Socal and Behavoral Scences Keywords Opnon Spa roup Opnon Spa Fae Revew Deecon. INTRODUCTION Nowadays f one wans o buy a produc mos probably one wll frs read revews of he produc. If he/she fnds ha mos revews are posve he/she s very lely o buy. However f mos revews are neave he/she wll almos ceranly choose anoher produc. Posve opnons can resul n snfcan fnancal ans and fames for oranzaons and ndvduals. Ths unforunaely ves sron ncenves for opnon spammn whch refers o human acves (e.. wrn fae revews) ha ry o delberaely mslead readers by vn unfar revews o some enes (e.. producs) n order o promoe hem or o damae her repuaons. As more and more ndvduals and oranzaons are usn revews for her decson man deecn such fae revews becomes a pressn ssue. The problem has been wdely repored n he news. There are pror wors [ ] on deecn fae revews and ndvdual fae revewers or spammers. However lmed research has been done o deec fae revewer (or spammer) roups whch we also call spammer roups. roup spammn refers o a roup of revewers wrn fae revews oeher o promoe or o demoe some are producs. A spammer roup can be hhly daman as can ae oal conrol of he senmen on a produc because a roup has many people o wre fae revews. Our expermens show ha s hard o deec spammer roups usn revew conen feaures [3] or even ndcaors for deecn abnormal behavors of ndvdual spammers [24] because a roup has more manpower o pos revews and hus each member may no loner appear o behave abnormally. Noe ha by a roup of revewers we mean a se of revewer-ds. The acual revewers behnd he ds could be a snle person wh mulple ds (socpuppe) mulple persons or a combnaon of boh. We do no dsnush hem n hs wor. Before proceedn furher le us see a spammer roup found by our alorhm. Fures 2 and 3 show he revews of a roup of hree revewers 2. The follown suspcous paerns can be noed abou hs roup: () he roup members all revewed he same hree producs vn all 5 sar rans; () hey posed revews whn a small me wndow of 4 days (wo of hem posed n he same day); () each of hem only revewed he hree producs (when our Amazon revew daa [4] was crawled); (v) hey were amon he early revewers for he producs (o mae a b mpac). All hese paerns occurrn oeher sronly sues suspcous acves. Noce also none of he revews hemselves are smlar o each oher (.e. no duplcaes) or appear decepve. If we only loo a he hree revewers ndvdually hey all appear enune. In fac 5 ou of 9 revews receved % helpfulness voes by Amazon users ndcan ha he revews are useful. Clearly hese hree revewers have aen oal conrol of he senmen on he se of revewed producs. In fac here s a fourh revewer n he roup. Due o space lmaons we om here. If a roup of revewers wor oeher only once o promoe or o demoe a produc s hard o deec hem based on her collecve behavor. They may be deeced usn he conen of her revews e.. copyn each oher. Then he mehods n [ ] are applcable. However over he years opnon spammn has become a busness. People e pad o wre fae revews. Such people canno us wre a snle revew Copyrh s held by he Inernaonal World Wde Web Conference Commee (IW3C2). Dsrbuon of hese papers s lmed o classroom use and personal use by ohers. WWW 22 Aprl Lyon France. ACM /2/4. 2 hp:// hp:// hp:// hp:// hp://

2 of people found he follown revew helpful: Praccally FREE musc December 4 24 Ths revew s from: Audo Xrac (CD-ROM) 2 of 2 people found he follown revew helpful: Le a ape recorder December 8 24 Ths revew s from: Audo Xrac (CD-ROM) Wow nerne musc! December 4 24 Ths revew s from: Audo Xrac (CD-ROM) I looed forever for a way o record nerne musc. My way I can' beleve for $ (afer rebae) I o a proram ha es Ths sofware really rocs. I can se he proram o record oo a lon me and many seps (frusran). Then I found me free unlmed musc. I was hopn dd half wha was. musc all day lon and us le o. I come home and my. Audo Xrac. Wh more han 3 sons downloaded n 3 of 8 people found he follown revew helpful: Yes really wors December 4 24 Ths revew s from: Audo Xrac Pro (CD-ROM) 3 of people found he follown revew helpful: Ths s even beer han December 8 24 Ths revew s from: Audo Xrac Pro (CD-ROM) 2 of 9 people found he follown revew helpful: Bes musc us o December 4 24 Ths revew s from: Audo Xrac Pro (CD-ROM) See my revew for Audo Xrac - hs PRO s even beer. Ths Le me ell you hs has o be one of he cooles producs ever The oher day I upraded o hs TOP NOTCH produc. s he soluon I've been loon for. Afer buyn Tunes. on he mare. Record 8 nerne rado saons a once. Everyone who loves musc needs o e from Inerne. 5 of 5 people found he follown revew helpful: My ds love December 4 24 Ths revew s from: Pond Aquarum 3D Deluxe Edon Ths was a baran a $2 - beer han he oher ones ha have no above waer scenes. My ds e a c ou of he. as hey would no mae enouh money ha way. Insead hey wre many revews abou many producs. Such collecve behavors of a roup worn oeher on a number of producs can ve hem away. Ths paper focuses on deecn such roups. Snce revewers n he roup wre revews on mulple producs he daa mnn echnque frequen emse mnn (FIM) [] can be used o fnd hem. However so dscovered roups are only roup spam canddaes because many roups may be concdenal as some revewers happen o revew he same se of producs due o smlar ases and populary of he producs (e.. many people revew all 3 Apple producs Pod Phone and Pad). Thus our focus s o denfy rue spammer roups from he canddae se. One ey dffculy for opnon spam deecon s ha s very hard o manually label fae revews or revewers for model buldn because s almos mpossble o reconze spam by us readn each ndvdual revew [4]. In hs wor mulple expers were employed o creae a labeled roup opnon spammer daase. Ths research maes he follown man conrbuons:. I produces a labeled roup spam daase. To he bes of our nowlede hs s he frs such daase. Wha was surprsn and also encouran o us was ha unle udn ndvdual fae revews or revewers udn fae revewer roups were consderably easer due o he roup conex and her collecve behavors. We wll dscuss hs n Sec I proposes a novel relaon-based approach o deecn spammer roups. Wh he labeled daase he radonal approach of supervsed learnn can be appled [4 23 3]. However we show ha hs approach can be nferor due o he nheren naure of our parcular problem: () Tradonal learnn assumes ha ndvdual nsances are ndependen of one anoher. However n our case roups are clearly no ndependen of one anoher as dfferen roups may share members. One consequence of hs s ha f a roup s found o be a spammer roup hen he oher roups ha share members wh roup are lely o be spammer roups oo. The reverse may also hold. () I s hard for feaures used o represen each roup n learnn o consder each ndvdual member s behavor on each ndvdual produc.e. a roup can conceal a lo of nernal deals. Ths resuls n severe nformaon loss and consequenly low accuracy. We dscuss hese and oher ssues n reaer deal n Sec. 7. To explo he relaonshps of roups ndvdual members and producs hey revewed a novel relaon-based approach s proposed whch we call SRan (roup Spam Ran) o ran canddae roups based on her lelhoods for ben spam. 3. A comprehensve evaluaon has been conduced o evaluae SRan. Expermenal resuls show ha ouperforms many sron baselnes ncludn he sae-of-he-ar learnn o ran supervsed classfcaon and reresson alorhms. 5 of 5 people found he follown revew helpful: 3 of 3 people found he follown revew helpful: For he prce you December 8 24 Cool loos rea December 4 24 Ths revew s from: Pond Aquarum 3D Deluxe Edon Ths revew s from: Pond Aquarum 3D Deluxe Edon Ths s one of he cooles screensavers I have ever seen he fsh We have hs se up on he PC a home and loos REAT. move realscally he envronmens loo real and he. The fsh and he scenes are really nea. Frends and famly. Fure : B John s Profle Fure 2: Cleus Profle Fure 3: Jae s Profle 2. RELATED WORK The problem of deecn revew or opnon spam was nroduced n [4] whch used supervsed learnn o deec ndvdual fae revews. Duplcae and near duplcae revews whch are almos ceranly fae revews were used as posve rann daa. Whle [24] found dfferen ypes of behavor abnormales of revewers [5] proposed a mehod based on unexpeced class assocaon rules and [3] employed sandard word and par-of-speech (POS) n-ram feaures for supervsed learnn. [23] also used supervsed learnn wh addonal feaures. [32] used a raph-based mehod o fnd fae sore revewers. A dsoron based mehod was proposed n [34]. None of hem deal wh roup spam. In [29] we proposed an nal roup spam deecon mehod bu s much less effecve han he proposed mehod n hs paper. In a wde feld he mos nvesaed spam acves have been n he domans of Web [ ] and Emal [6]. Web spam has wo man ypes: conen spam and ln spam. Ln spam s spam on hyperlns whch does no exs n revews as here s usually no ln n hem. Conen spam adds rrelevan words n paes o fool search ennes. Revewers do no add rrelevan words n her revews. Emal spam usually refers o unsolced commercal ads. Alhouh exss ads n revews are rare. Recen sudes on spam also exended o blos [2] onlne an [2] and socal newors [2]. However her dynamcs are dfferen from hose of produc revews. They also do no sudy roup spam. Oher leraure relaed o roup acves nclude mnn roups n WLAN [3]; moble users [8] usn newor los and communy dscovery based on neress [36]. Sybl Aacs [7] n secury creae pseudo denes o subver a repuaon sysem. In he onlne conex pseudo denes n Sybl aacs are nown as socpuppes. Indeed socpuppes are possble n revews and our mehod can deal wh hem. Lasly [ ] suded he usefulness or qualy of revews. However opnon spam s a dfferen concep as a low qualy revew may no be a spam or fae revew. 3. BUILDIN A REFERENCE DATASET As menoned earler here was no labeled daase for roup opnon spam before hs proec. To evaluae our mehod we bul a labeled daase usn exper human udes. Opnon spam and labeln vably: [5] arues ha classfyn he concep spam s dffcul. Research on Web [35] emal [6] blos [2] and even socal spam [27] all rely on manually labeled daa for deecon. Due o hs nheren naure of he problems he closes ha one can e o old sandards s by crean a manually labeled daase usn human expers [ ]. We oo bul a roup opnon spam daase usn human expers. Amazon daase: In hs research we used produc revews from Amazon [4] whch have also been used n [5 24]. The ornal

3 crawl was done n 26. Updaes were made n early 2. For our sudy we only used revews of manufacured producs whch are comprsed of revewers 958 revews and producs. Each revew conssed of a le conen sar ran posn dae and number of helpful feedbacs. Mnn canddae spammer roups: We use frequen emse mnn (FIM) here. In our conex a se of ems I s he se of all revewer ds n our daabase. Each ransacon ( I) s he se of revewer ds who have revewed a parcular produc. Thus each produc eneraes a ransacon of revewer ds. By mnn frequen emses we fnd roups of revewers who have revewed mulple producs oeher. We found 752 canddae roups wh mnsup_c (mnmum suppor coun) = 3 and a leas 2 ems (revewer ds) per emse (rou.e. each roup mus have wored oeher on a leas 3 producs. Iemses (roups) wh suppor lower han hs (mnsup_c = 2) are very lely o be due o random chance raher han rue correlaon and very low suppor also causes combnaoral exploson because he number of frequen emses rows exponenally for FIM []. FIM worn on revewer ds can also fnd socpuppeed ds formn roups whenever he ds are used mnsup_c mes o pos revews. Opnon spam snals: We revewed pror research on opnon spam and udelnes on consumer ses such as consumers.co lfehacer.com and consumersearch.com 3 and colleced from hese sources a ls of spammn ndcaors or snals e.. () havn zero caveas () full of empy adecves () purely lown prases wh no downsdes (v) ben lef whn a shor perod of me of each oher ec. These snals were ven o our udes. We beleve ha hese snals (and he addonal nformaon descrbed below) enhance her udn raher han bas hem because udn spam revews and revewers s very challenn. I s hard for anyone o now a lare number of possble snals whou subsanal pror experences. These snals on he Web and research papers have been compled by expers wh exensve experences and doman nowlede. We also remnded our udes ha hese snals should be used a her dscreon and encouraed hem o use her own snals. To reduce he udes worload furher for each roup we also provded 4 addonal peces of nformaon as hey are requred by some of he above snals: revews wh posn daes of each ndvdual roup member ls of producs revewed by each member revews of producs ven by non-roup members and wheher roup revews were aed wh AVP (Amazon Verfed Purchase). Amazon as each revew wh AVP f he revewer acually bouh he produc. Judes were also ven access o our daabase for queryn based on her needs. Labeln: We employed 8 exper udes: employees of Redff Shoppn (4) and ebay.n (4) for labeln our canddae roups. The udes had doman experse n feedbacs and revews of producs due o her naure of wor n onlne shoppn. Snce here were oo many paerns (or canddae roups) our udes could only manae o label 243 of hem as ben spam nonspam or borderlne. The udes were made o wor n solaon o preven any bas. The labeln oo around 8 wees. We dd no use Amazon Mechancal Tur (MTur) for hs labeln as because MTur s normally used o perform smple ass whch requre human udmens. However our as s hhly challenn me consumn and also requred he access o our daabase. Also we needed udes wh ood nowlede of he revew doman. Thus we beleve ha MTur was no suable. 4. LABELIN RESULTS We now repor he labeln resuls and analyze he areemens amon he udes. Spamcy: We calculaed he spamcy (deree of spam) of each roup by assnn pon for each spam udmen.5 pon for each borderlne udmen and pon for each non-spam udmen a roup receved and oo he averae of all 8 labelers. We call hs averae he spamcy score of he roup. Based on he spamces he roups can be raned. In our evaluaon we wll evaluae he proposed mehod o see wheher can ran smlarly. In pracce one can also use a spamcy hreshold o dvde he canddae roup se no wo classes: spam and nonspam roups. Then supervsed classfcaon s applcable. We wll dscuss hese n deal n he expermen secon. Areemen sudy: Prevous sudes have showed ha labeln ndvdual fae revews and revewers s hard [4]. To sudy he feasbly of labeln roups and also he udn qualy we used Fless mul-raer appa [] o measure he udes areemens. We obaned κ =.79 whch ndcaes close o perfec areemen based on he scale 4 n [22]. Ths was very encouran and also surprsn consdern ha udn opnon spam n eneral s hard [4]. I ells us ha labeln roups seems o be much easer han labeln ndvdual fae revews or revewers. We beleve he reason s ha unle a snle revewer or revew a roup ves a ood conex for udn and comparson and smlar behavors amon members ofen reveal sron snals. Ths was confrmed by our udes who had doman experse n revews. 5. SPAMMIN BEHAVIOR INDICATORS For modeln or learnn a se of effecve spam ndcaors or feaures s needed. Ths secon proposes wo ses of such ndcaors or behavors whch may ndcae spammn acves. 5. roup Spam Behavor Indcaors Here we dscuss roup behavors ha may ndcae spam.. roup Tme Wndow (TW): Members n a spam roup are lely o have wored oeher n posn revews for he are producs durn a shor me nerval. We model he deree of acve nvolvemen of a roup as s roup me wndow (TW): TW( ) max( TW ( ) pp P f L( F( TW P ( L( F( oherwse where L( and F( are he laes and earles daes of revews posed for produc p P by revewers of roup respecvely. P s he se of all producs revewed by roup. Thus TW P ( ves he me wndow nformaon of roup on a snle produc p. Ths defnon says ha a roup of revewers posn revews on a produc p whn a shor burs of me s more prone o be spammn (aann a value close o ). roups worn over a loner me nerval han e a value of as hey are unlely o have wored oeher. s a parameer whch we wll esmae laer. The roup me wndow TW() consders all producs revewed by he roup an max over p ( P ) so as o capure he wors behavor of he roup. For subsequen behavors max s aen for he same reason. 2. roup Devaon (D): A hhly daman roup spam occurs when he rans of he roup members devae a rea deal from () 3 hp://consumers.com/2/4/how-you-spo-fae-onlne-revews.hml hp://lfehacer.com/55726/hone-your-eye-for-fae-onlne-revews hp:// 4 No areemen (κ<) slh areemen ( < κ.2) far areemen (.2 < κ ) moderae areemen ( < κ ) subsanal areemen ( < κ ) and almos perfec areemen for < κ..

4 hose of oher (enune) revewers so as o chane he senmen on a produc. The larer he devaon he worse he roup s. Ths behavor s modeled by roup devaon (D) on a 5-sar ran scale (wh 4 ben he maxmum possble devaon): D ( ) max( D( ) pp (2) r p rp D( 4 where r p and r p are he averae rans for produc p ven by members of roup and by oher revewers no n respecvely. D( s he devaon of he roup on a snle produc p. If here are no oher revewers who have revewed he produc p r p =. 3. roup Conen Smlary (CS): roup connvance s also exhbed by conen smlary (duplcae or near duplcae revews) when spammers copy revews amon hemselves. So he vcmzed producs have many revews wh smlar conen. roup conen smlary (CS) models hs behavor: CS( ) max( CS ( ) pp CS ( av m m cosne( c( m c( m ) where c(m s he conen of he revew wren by roup member m for produc p. CS ( capures he averae parwse smlary of revew conens amon roup members for a produc p by compun he cosne smlary. 4. roup Member Conen Smlary (MCS): Anoher flavor of conen smlary s exhbed when he members of a roup do no now one anoher (and are conaced by a conracn aency). Snce wrn a new revew every me s axn a roup member may copy or modfy hs/her own prevous revews for smlar producs. If mulple members of he roup do hs he roup s more lely o be spammn. Ths behavor can be expressed by roup member conen smlary (MCS) as follows: CSM ( m) m MCS( ) (4) CS ( m) av cosne( c( p ) c( p )) M p p P The roup aans a value (ndcan spam) on MCS when all s members enrely coped her own revews across dfferen producs n P. CS M ( m) models he averae parwse conen smlary of member m over all producs n P. 5. roup Early Tme Frame (ETF): [24] repors spammers usually revew early o mae he bes mpac. Smlarly when roup members are amon he very frs people o revew a produc hey can oally hac he senmens on he producs. The roup early me frame (ETF) models hs behavor: (3) ETF ( ) max( TF ( ) (5) pp f L( A( TF( L( A( oherwse where TF( capures he me frame as how early a roup revews a produc p. L( and A( are he laes dae of revew posed for produc p P by roup and he dae when p was made avalable for revewn respecvely. s a hreshold (say 6 monhs laer esmaed) whch means ha afer monhs TF aans a value of as revews posed hen are no consdered o be early any more. Snce our expermenal daase [4] does no have he exac dae when each produc was launched we use he dae of he frs revew of he produc as he value for A(. 6. roup Sze Rao (SR): The rao of roup sze o he oal number of revewers for a produc can also ndcae spammn. A one exreme (wors case) he roup members are he only revewers of he produc compleely conrolln he senmen on he produc. On he oher hand f he oal number of revewers of he produc s very lare hen he mpac of he roup s small. SR( ) av( SRP ( ) pp (6) SRP ( M p where SR P ( s he rao of roup sze o M p (he se of all revewers of produc for produc p. 7. roup Sze (S): roup colluson s also exhbed by s sze. For lare roups he probably of members happenn o be oeher by chance s small. Furhermore he larer he roup he more daman s. S s easy o model. We normalze o [ ]. max( ) s he lares roup sze of all dscovered roups. S( ) (7) max( ) 8. roup Suppor Coun (SUP): Suppor coun of a roup s he oal number of producs owards whch he roup has wored oeher. roups wh hh suppor couns are more lely o be spam roups as he probably of a roup of random people happen o have revewed many producs oeher s small. SUP s modeled as follows. We normalze o [ ] wh max( P ) ben he lares suppor coun of all dscovered roups: P SUP( ) (8) max( P ) These eh roup behavors can be seen as roup spammn feaures for learnn. From here on we refer he 8 roup behavors as f f 8 when used n he conex of feaures. I s mporan o noe ha by no means do we say ha whenever a roup aans a feaure f > or a hreshold value s a spam roup. I s possble ha a roup of revewers due o smlar ases concdenly revew some smlar producs (and form a concdenal rou n some shor me frame or may enerae some devaon of rans from he res or may even have modfed some of he conens of her prevous revews o updae her revews producn smlar revews. The feaures us ndcae he exen hose roup behavors were exhbed. The fnal predcon of roups s done based on he learned models. As we wll see n Sec. 6.2 all feaures f f 8 are sronly correlaed wh spam roups and feaure values aaned by spam roups exceed hose aaned by oher non-spam roups by a lare marn. 5.2 Indvdual Spam Behavor Indcaors Alhouh roup behavors are mporan hey hde a lo of deals abou s members. Clearly ndvdual members behavors also ve snals for roup spammn. We now presen he behavors for ndvdual members used n hs wor.. Indvdual Ran Devaon (IRD): Le roup devaon we can model IRD as r p m rp m (9) IRD( 4 where r p m and r p m are he ran for produc p ven by revewer m and he averae ran for p ven by oher revewers respecvely. 2. Indvdual Conen Smlary (ICS): Indvdual spammers may revew a produc mulple mes posn duplcae or near duplcae revews o ncrease he produc populary [24]. Smlar o MCS we model ICS of a revewer m across all s revews owards a produc p as follows: ICS ( av ( cosne ( c( ) () The averae s aen over all revews on p posed by m.

5 .2 TW CS MCS D SR SUP ETF.5.2 Fure 4: Behavoral Dsrbuon. Cumulave % of spam (sold) and non-spam (dashed) roups vs. feaure value 3. Indvdual Early Tme Frame (IETF): Le ETF we defne IETF of a roup member m as: f L( A( IETF( L( A( oherwse () where L( denoes he laes dae of revew posed for a produc p by member m. 4. Indvdual Member Coupln n a roup (IMC): Ths behavor measures how closely a member wors wh he oher members of he roup. If a member m almos poss a he same dae as oher roup members hen m s sad o be hly coupled wh he roup. However f m poss a a dae ha s far away from he posn daes of he oher members hen m s no hly coupled wh he roup. We fnd he dfference beween he posn dae of member m for produc p and he averae posn dae of oher members of he roup for p. To compue me we use he me when he frs revew was posed by he roup for produc p as he baselne. Indvdual member coupln (IMC) s hus modeled as: ( T( F( ) av( m) IMC( m) av (2) pp L( F(.2 m { m}.5.2 ( T( m F( ) av( m) where L( and F( are he laes and earles daes of revews posed for produc p P by roup respecvely and T( s he acual posn dae of revewer m on produc p. Noe ha IP addresses of revewers may also be of use for roup spam deecon. However IP nformaon s prvaely held by propreary frms and no publcly avalable. We beleve f IP addresses are also avalable addonal feaures may be added whch wll mae our proposed approach even more accurae. 6. EMPIRICAL ANALYSIS To ensure ha he proposed behavoral feaures are ood ndcaors of roup spammn hs secon analyzes hem by S sascally valdan her correlaon wh roup spam. For hs sudy we used he classfcaon sen for spam deecon. A spamcy hreshold of.5 was employed o dvde all canddae roups no wo caeores.e. hose wh spamcy reaer han.5 as spam roups and ohers as non-spam roups. Usn hs scheme we e 62% non-spam roups and 38% spam roups. In Sec. 9 we wll see ha hese feaures wor well n eneral (raher han us for hs parcular hreshold). Noe ha he ndvdual spam ndcaors n Sec. 5.2 are no analyzed as here s no suable labeled daa for ha. However hese ndcaors are smlar o her roup counerpars and are hus ndrecly valdaed hrouh he roup ndcaors. They also helped SRan well (Sec. 9). 6. Sascal Valdaon For a ven feaure f s effecveness (Eff( )) s defned wh: Eff ( f ) P( f Spam ) P( f Non spam ) (3) where f > s he even ha he correspondn behavor s exhbed o some exen. Le he null hypohess be: boh spam and normal roups are equally lely o exhb f and he alernae hypohess: spam roups are more lely o exhb f han nonspam roups and are correlaed wh f. Thus demonsran ha f s observed amon spam roups and s correlaed s reduced o show ha Eff(f) >. We esmae he probables as follows: { f ( ) Spam} P( f Spam) { Spam} (4) { f ( ) Non spam} P( f Non spam) { Non spam} (5) We use Fsher s exac es o es he hypohess. The es reecs he null hypohess wh p<. for each of he modeled behavors. Ths shows ha spam roups are ndeed characerzed by he modeled behavors. Furhermore snce he modeled behavors are all anomalous and Fsher s exac es verfes sron correlaon of hose behavors wh roups labeled as spam also ndrecly ves us a sron confdence ha he maory of he class labels n he reference daase are rusworhy. 6.2 Behavoral Dsrbuon We now analyze he underlyn dsrbuon of spam and nonspam roups across each behavoral feaure dmenson. Fure 4 shows he cumulave behavoral dsrbuon (CBD). Aans each value x aaned by a feaure f ( x as f [ ] f) we plo he cumulave percenae of spam/non-spam roups havn values of f x. We noe he follown nshs from he plos: Poson: CBD curves of non-spam roups lean more owards he lef boundary of he raph han hose for spam roups across all feaures. Ths mples ha for a ven cumulave percenae cp he correspondn feaure value x n for non-spam roups s less han x s for spam roups. For example n CBD of he S feaure f cp =.75 hen 75% of he non-spam roups are bounded by x n = (.e. 2 members) 5 whle 75% of he spam roups are bounded by x s = 6 (.e. 6 5 members). As anoher example we ae CBD of SUP wh cp =. We see ha 8% of he non-spam roups are bounded by x n =.5 (.e producs) 6 whle 8% of spam roups are bounded by x s =.76 (.e producs). Ths shows ha spammn roups usually wor wh more members and revew more producs. As non-spam roups are mosly concdenal we fnd ha her feaure values reman low for mos roups ndcan benn behavors. Also we emphasze he erm bounded by n he above descrpon. By no means do we clam ha every spam 5 Daase n Sec. 3 of all canddae roups wh mnsup_c =3 yelded max{ } = and max suppor = 3. We mulply feaure values of S and SUP by hese numbers o e he acual couns. See equaons (7) and (8) for deals.

6 roup n our daabase revewed a leas producs and s comprsed of a leas 5 members. Lasly snce x n < x s cp (due o he lefward posonn of he CBD curve for non-spam roups) spam roups oban hher feaure values han non-spam roups for each modeled behavor f. Seep nal umps: These ndcae ha very few roups oban snfcan feaure values before ump abscssa. For example we fnd ha here are very few spam roups wh SUP <.25 and for CS we fnd a maory ( 9%) of non-spam roups n our daabase have mnuscule conen smlary 6 amon her revews. aps: CBD curves of non-spam roups are hher han hose of spam roups and he ap (separaon marn) refers o he relave dscrmnave poency. CS has he maxmum ap and nex n order are SUP and ETF. Ths resul s no surprsn as a roup of people havn a lo of conen smlary n her revews s hhly suspcous of ben spammn and hence CS has ood dscrmnave srenh. Lasly we noe aan ha he above sascs are nferred from he 243 labeled roups by doman expers based on he daa of [4] crawled n 26. By no means do we clam ha he resuls can be eneralzed across any roup of random people who happen o revew smlar producs oeher own o smlar neress. 7. MODELIN RELATIONS Wh he 8 roup behavoral feaures separan spam and nonspam roups by a lare marn and he labeled daa from Sec. 4 he classc approach o deec spammer roups s o employ a supervsed classfcaon reresson or learnn o ran alorhm o classfy or ran canddae roups. All hese exsn mehods are based on a se of feaures o represen each nsance (roup n our case). However as we ndcaed n he nroducon secon hs feaure-based approach has some shorcomns for our as: They assume ha rann and esn nsances are drawn ndependenly and dencally (d) from some dsrbuon. However n our case dfferen roups (nsances) can share members and may revew some common producs. Thus our daa does no follow he d assumpon because many nsances are relaed.e. apar from roup feaures he spamcy of a roup s also affeced by he oher roups sharn s members he spamcy of he shared members he exen o whch he revewed producs are spammed ec. roup feaures (f f 8 ) only summarze (e.. by max/av) roup behavors. Ths clearly leads o loss of nformaon because spamcy conrbuons from members are no consdered a each ndvdual member level bu are summarzed (max/av) o represen he whole roup behavor. Due o dfferen roup szes and complex relaonshps s no easy o desn and nclude each ndvdual member relaed feaures explcly whou some nd of summary. I s also dffcul o desn feaures whch can consder he exen o whch each produc s spammed by roups. Alhouh our focus s on deecn spammer roups he underlyn producs ben revewed are clearly relaed. Below we propose a more effecve model whch can consder he ner-relaonshp amon producs roups and roup members n compun roup spamcy. Specfcally we model hree bnary relaons: roup Spam Producs Member Spam Producs and roup Spam Member Spam. The overall dea s as follows: We frs model he hree bnary relaons o accoun for how each eny affecs he oher. We hen draw nference of one eny from he oher eny based on he correspondn bnary relaon. For 6 Compued usn LnPpe Java API avalable a hp://alas-.com/lnppe example usn he roup Spam Member Spam relaon we nfer he spamcy of a roup based on he spamcy of s ndvdual members and vce-versa. Our rann mehod called SRan (roup Spam Ran) s hen presened o e all hese nferences whch solves an eenvalue problem by alnn he roup vecor o he domnan eenvecor. Before on o he deals we frs defne some noaons used n he follown sub-secons. Le P = {p } = { } and M = {m } be he se of all producs roups and members. Le s( ) and s(m ) be he spamcy of and m raded over [ ] respecvely and le s(p ) be he exen o whch p s spammed also raded over [ ]. Values close o snfy hh spamcy for roups and members and reaer exen o whch producs are spammed. Addonally le V P = [s(p )] P V = [s( )] and V M = [s(m )] M be he correspondn produc roup and member score vecors. 7. roup Spam Producs Model Ths model capures he relaon amon roups and producs hey are. The exen a produc p s spammed by varous roups s relaed o: () spam conrbuon o p by each roup revewn p and () spamcy of each such roup. Also spam conrbuon by a roup wh hh spamcy couns more. Smlarly he spamcy of a roup s assocaed wh () s own spam conrbuon o varous producs and () he exen hose producs were spammed. To express hs relaon we frs compue he spam conrbuon o a produc p by a roup. From Sec. 5 we have TW P (me wndow of roup s acvy over a produc D ( s devaon of rans for TF (early me frame of s spam nflcon owards CS ( s conen smlary of revews on and SR P (rao of roup s sze for. We noe ha hese behavors are symmerc n he sense ha hher values ndcae ha s behavor on p s suspcous and also ndcae ha spam conrbuon o p by s hh. Thus he spam conrbuon by o p can be expressed by he follown funcon: w ( p ) [ TWP ( p ) D( p ) TF( p ) CS( p ) SRP ( p )] 5 W P = [w (p )] P x (6) w (p ) = when dd no revew p. The sum capures he spam nflced across varous spammn dmensons and s normalzed by 5 so ha w [ ]. For subsequen conrbuon funcons oo summaon and normalzaon are used for he same reason. W P denoes he correspondn conrbuon marx. Usn (6) (7) compues he exen p s spammed by varous roups. I sums he spam conrbuon by each roup w (p ) and wehs by he spamcy of ha roup s( ). Smlarly (8) updaes he roup s spamcy by summn s spam conrbuon on all producs wehed by he exen hose producs were spammed. The relaons can also be expressed as marx equaons. s ( p ) w ( p ) s( ); V W V (7) P P T s ( ) w ( p ) s( p ); V W V (8) Snce s( ) spamcy of s(p ) exen o whch p was spammed and w deree of spam nflced by owards p (7) and (8) employ a summaon o compue s( ) and s(p ). Furher as spam conrbuon by a roup wh hher spamcy s more daman he deree of spam conrbuon by a roup s wehed by s spamcy n (7). Smlarly for (8) spam conrbuon w s wehed by s(p ) o accoun for he effecve spamcy of he roup. For subsequen models oo wehed summaon s used for smlar reasons. The marx equaon (7) also shows how he produc vecor can be nferred from he roup vecor usn marx W P and vce-versa usn (8). P P P

7 7.2 Member Spam Produc Model Spam by a roup on a produc s bascally spam by ndvduals n he roup. A roup feaure can only summarze spam of members n he roup over he se of producs hey revewed. Here we consder spam conrbuons of all roup members exclusvely. Le w we employ w 2 [ ] o compue he spam conrbuon by a member m owards produc p. We model w 2 as follows: w2 ( m p ) [ IRD( m p ) ICS( m p ) IETF ( m p )] 3 W MP = [w 2 (m p )] M x P (9) w 2 (m p ) = f m dd no revew p. Smlar o (6) w 2 capures ndvdual member spam conrbuon over he spam dmensons: IRD (ndvdual ran devaon of m owards ICS (ndvdual conen smlary of revews on p by m) and IETF (ndvdual early me frame of spam nflcon by m owards. Smlar o (8) we compue he spamcy of m by summn s spam conrbuons owards varous producs w 2 wehed by s(p ) (2). And le (7) we updae p o reflec he exen was spammed by members. We sum he ndvdual conrbuon of each member w 2 wehed by s spamcy (2). P s ( m ) w ( m p ) s( p ); V W V (2) M 2 M T s ( p ) w ( m p ) s( m ); V W V (2) roup Spam Member Spam Model Clearly he spamcy of a roup s relaed o he spamcy of s members and vce-versa. If a roup consss of members wh hh spamces hen he roup s spam nflcon s lely o be hh. Smlarly a member nvolved n spam roups of hh spamcy affecs s own spamcy. We frs compue he conrbuon of a member m ( ) owards a roup. From Sec. 5 we see ha he conrbuon s capured by IMC (deree of m s coupln n ) S (sze of wh whch m wored) and SUP (number of producs owards whch m wored wh ). We model as follows: w3 ( m ) [ IMC( m ) ( S( )) SUP( )] 3 W M = [w 3 ( m )] x M (22) w 3 ( m ) = when m. As S s normalzed over [ ] for lare roups he ndvdual conrbuon of a member dmnshes. Hence we use -S( ) o compue w 3. Usn (22) (23) compues he spamcy of a roup by summn up he spamces of all s members s(m ); each wehed by hs conrbuon o he roup w 3 ( m ). Snce roups can share members (24) updaes he spamcy of a member by summn up he spamces of all roups wored wh each wehed by s own conrbuon o ha roup. M P s ( ) w ( m ) s( m ); V W V (23) 3 T s ( m ) w ( m ) s( ); V W V. (24) 3 8. SRan: Rann roup Spam Usn he relaon models each eny s nferred wce once from each oher eny. As he wo nferences for each eny are condoned on oher wo enes hey are hus complemenary. For example V s nferred once from V P (8) and hen from V M (23). Boh of hese nferences complemen each oher because roup spamcy s relaed o boh s collecve spam acves on producs and also he spamces of s members. Ths complemenary connecon s furher explcly shown n Lemma. Snce he relaons are crcularly defned o effecvely ran he roups SRan uses he erave alorhm below. M MP MP M M M P M Alorhm: SRan Inpu: Weh marces W P W MP and W M Oupu: Raned ls of canddae spam roups. Inalze V [.5] ; ; 2. Ierae:. V P W P V (-) ; V M W MP V P ;. V W M V M ; V M W T M V ;. V P W T MP V M ; V () W T P V P ; v. V () V () / V () ; unl V () V (-) < δ 3. Oupu he raned ls of roups n descendn order of V * In lne we frs nalze all roups wh spamcy of.5 over he spamcy scale [ ]. Nex we nfer V P from he curren value of V ; and hen nfer V M from he so updaed V P (lne 2-). Ths complees he nal boosrappn of vecors V V P and V M for he curren eraon. Lne 2- hen draws nferences based on he roup Spam Member Spam model. I frs nfers V from V M because V M conans he recen updae from lne 2- and hen nfers V M from so updaed V. Ths ordern s used o ude he nference procedure across he eraons. Lne 2- hen updaes V P based on he Member Spam Produc model frs and defers he nference of V from so updaed V P based on he roup Spam Produc model unl he las updae so ha V es he mos updaed value for he nex eraon. Fnally lne 2-v performs normalzaon o manan an nvaran sae (dscussed laer). Thus as he eraons proress he fac ha each eny affecs he oher s aen no accoun as he score vecors V V M and V P are updaed va he nferences drawn from each relaon model. The eraons proress unl V converes o he sable V *. Snce V conans he spamcy scores of all roups lne 3 oupus he fnal ordern of spam roups accordn o he spamcy scores of he sable vecor V *. We now show he converence of SRan. Lemma : SRan sees o aln V owards he domnan eenvecor and s an nsance of an eenvalue problem. Proof: From lne 2 of SRan we have: (-) V = W M W MP W P V (25) V () = W T P W T MP W T M V (26) Subsun (25) n (26) and len Z = W M W MP W P we e: V () = ( Z T (-) Z ) V (27) Clearly hs s an nsance of power eraon for he eenvalue problem of compun he roup vecor V as he eenvecor of Z T Z correspondn o he domnan eenvalue [2]. From (25) (26) and (27) we can see how he wo nferences for each eny are lned. For example spamcy of roups V based on he spamcy of s members V M (lne 2-) and based on he collecve spam behavor on producs V P (lne 2-) are boh lned and accouned for by he produc of marces W M and W T P n (27). Smlar connecons exs for V M and V P when nferred from oher enes. Thus all model nferences are combned and encoded n he fnal erave nference of V n (27). Theorem : SRan converes Proof: As SRan sees o aln V owards he domnan eenvecor o show converence s suffcen o show ha he sable vecor V * s alned o he domnan eenvecor afer a ceran number of eraons. Le A = Z T Z. From (27) and lne 2-v of SRan we e: ( ) ( ) AV V whch when appled recursvely ves: ( ) AV V ( ) () A V AV ( ) (28)

8 We noe ha A s a square marx of order. Assumn A o be daonalzable 7 V () can be expressed as a convex combnaon of he eenvecors of A [2]. ( ) V v (29) Also le λ denoe he eenvalue correspondn o he eenvecor v wh λ v ben he domnan eenvalue-vecor par of A. Then usn (28) and (29) we oban: ( ) V v v v ( ) ( ) 2 AV AV snce λ s domnan λ / λ < >. Thus for lare v and he sable vecor V * v. 2 Normalzaon: Before each eraon V s normalzed (lne 2-v). L normalzaon manans an nvaran sae beween wo consecuve eraons so ha converence s observed as a very small chane n he value of V [9]. We employ L (as s a max) norm of he dfference of V over consecuve eraons o be less han δ =. as our ermnan condon 8. Normalzaon also prevens any overflow ha mh occur due o he eomerc rowh of componens durn each eraon [2]. Complexy: A each eraon SRan requres he mulplcaon of A wh V so aes O( E ) where E s he number of nonzero elemens n A and s he oal number of eraons. In erms of P and M aes O(( ( M + P ) + M P )) whch s lnear n he number of canddae roups dscovered by FIM. The acual compuaon however s que fas snce he marces W P W MP W M are que sparse due o he power law dsrbuon followed by revews [4]. Furhermore SRan ben an nsance of power eraon can effcenly deal wh lare and sparse marces as does no compue a marx decomposon [2]. 9. EXPERIMENTAL EVALUATION We now evaluae he proposed SRan mehod. We use he 243 roups descrbed n Sec. 3. We frs spl 243 roups no he developmen se D wh 43 roups (randomly sampled) for parameer esmaon and he valdaon se V wh 2 roups for evaluaon. All evaluaon mercs are averaed over -fold cross valdaon (CV) on V. Below we frs descrbe parameer esmaon and hen rann and classfcaon expermens. 9. Parameer Esmaon Our proposed behavoral model has wo parameers τ and β whch have o be esmaed. s he parameer of TW.e. he me nerval beyond whch members n a roup are no lely o be worn n colluson. β s he parameer of ETF whch denoes he me nerval beyond whch revews posed are no consdered o be early anymore (Sec. 5.). For hs esmaon we aan use he classfcaon sen. The esmaed parameers acually wor well n eneral as we wll see n he nex wo subsecons. Le θ denoe he wo parameers. We learn θ usn a reedy hll clmbn search o maxmze he lo lelhood of he se D: 7 A marx A n x n over he feld F s daonalzable ff he sum of he dmensons of s eenspaces s equal o n. Ths can be shown o be equvalen o A ben of full ran wh n lnearly ndependen eenvecors. The proof remans equally vald when A s defecve (no daonalzable).e. has < lnearly ndependen eenvecors and hence he summaon n (29) oes up o. Converence of SRan s sll uaraneed because of he follown arumen: Lm v Lm 2 v whenever 2 as <. 8 Usn hs hreshold our mplemenaon converes n 96 eraons. esmaed ar max lo P ( spam ) (3) where D. To compue P( = spam) we rea = [X X 8 ] as a vecor where each X aes he values aaned by he h feaure f. As each feaure models a dfferen behavor we can assume he feaures o be ndependen and express P( =spam) = ΠP( = spam). To compue P( =spam).e. P( =spam) for we dscreze he rane of values obaned by f no a se of nervals { f f } such ha f = [ ]. P(X =spam) hen reduces o P( f = spam) whenever X les n he nerval f. And P( f =spam) s smply he fracon of spam roups whose value of f les n nerval f. We used he popular dscrezaon alorhm n [9] o dvde he value rane of each feaure no nervals. To boosrap he hll clmbn search we used nal seeds τ = 2 monhs and β = 6 monhs. The fnal esmaed values were: τ = 2.87 β = Rann Expermens To compare roup spam rann of SRan we use reresson and learnn o ran [26] as our baselnes. Reresson s a naural choce because he spamcy score of each roup from he udes s a real value over [ ] (Sec. 4). The problem of rann spammer roups can be seen as opmzn he spamcy of each roup as a reresson are. Tha s he learned funcon predcs he spamcy score of each es roup. The es roups can hen be raned based on he values. For hs se of expermens we use he suppor vecor reresson (SVR) sysem n SVM lh [6]. Learnn o ran s our second baselne approach. ven he rann samples x x n a learnn o ran sysem aes as npu dfferen ranns y y of he samples eneraed by queres q q. Each rann y s a permuaon of x x n based on q. The learnn alorhm learns a rann model h whch s hen used o ran he es samples u u m based on a query q. In our case of rann spam roups he desred nformaon need q denoes he queson: Are hese roup spam? To prepare rann ranns we rea each feaure f as a rann funcon (.e. he roups are raned n descendn order of values aaned by each f f 8 ). Ths eneraes 8 rann rans. A learnn alorhm hen learns he opmal rann funcon. ven no oher nowlede hs s a reasonable approach snce f f 8 are sronly correlaed wh spam roups (Sec. 6). The ran produced by each feaure s hus based on a ceran spamcy dmenson. None of he rann rans may be opmal. A learnn o ran mehod bascally learns an opmal rann funcon usn he combnaon of f f 8. Each roup s vecorzed wh (represened wh a vecor of) he 8 roup spam feaures. We ran wo wdely used learnn o ran alorhms [26]: SVMRan [7] and RanBoos []. For SVMRan we used he sysem n [7]. RanBoos was from RanLb 9. For boh sysems her defaul parameers were appled. We also expermened wh RanNe [3] n RanLb bu s resuls are snfcanly poorer on our daa. Thus s resuls are no ncluded. In addon we also expermened wh he follown baselnes: roup Spam Feaure Sum (SFSum): As each roup feaure f f 8 measures spam behavor on a specfc spam dmenson an obvous baselne (alhouh naïve) s o ran he roups n descendn order of he sum of all feaure values. Helpfulness Score (HS): In many revew ses readers can provde helpfulness feedbac o each revew. I s reasonable o assume ha spam revews should e less helpfulness feedbac. HS uses he mean helpfulness score (percenae of people who found a revew helpful) of revews of each roup o ran roups n ascendn order of he scores. 9 hp://

9 SRan.2 SVR SVMRan RanBoos SVMRan_H.2 RanBoos_H SFSum HS Fure 5: NDC@ comparsons (NDC for op ran posons) (a) The spamcy hreshold of =.5 (b) The spamcy hreshold of =.7 Fure 6: n = ran posons. All he mprovemens of SRan over oher mehods are sascally snfcan a he confdence level of 95% based on pared -es. Heursc rann ranns (H): In our prelmnary sudy [29] hree heursc ranns usn feaure mxures were proposed o enerae he rann rans for learnn o ran mehods. We ls hem brefly here. For deals please see [29]. h () : R + h () = CS() + MCS() h 2 () : R + h 2 () = S() + SUP() + TW() h 3 () : R + h 3 () = SR() + ETF() + D() Usn hese hree funcons o enerae he rann rans we ran he learnn o ran mehods. We denoe hese mehods and her resuls wh RanBoos_H and SVMRan_H. To compare ranns we frs use Normalzed Dscouned Cumulave an (NDC) as our evaluaon merc. NDC s commonly used o evaluae rereval alorhms wh respec o an deal rann based on relevance. I rewards ranns wh he mos relevan resuls a he op posons [26] whch s also our obecve.e. o ran hose roups wh he hhes spamces a he op. The spamcy score for each roup compued from udes (Sec. 4) hus can be rearded as he relevance score o enerae he deal spam rann. Le R(m) be he relevance score of he m h raned em. s defned as: R( m) DC@ 2 NDC@ ; (3) Z m lo2( m) where Z s he dscouned cumulave an (DC) of he deal rann of he op resuls. We repor NDC scores a varous op posons up o n Fure 5. In our case R(m) refers o he score( m ) compued by each rann alorhm (normalzaon was appled f needed) where s he roup raned a poson m. To compue Z = DC@ for he deal rann we use he spamcy( m ) from our exper udes. SRan SVMRan SVMRan_H SFSum SVR RanBoos RanBoos_H HS SRan SVMRan SVMRan_H SFSum SVR RanBoos RanBoos_H HS From Fure 5 we observe ha SRan performs he bes a all op ran posons excep a he boo whch are unmporan because hey are mos lely o be non-spam (snce n each fold of cross valdaon he es se has only 2 roups and ou of he 2 here are a mos 38% spam roups; see Table below). Pared -ess for ran posons = show ha all he mprovemens of SRan over oher mehods are snfcan a he confdence level of 95%. Alhouh reresson s suable for he as dd no perform as well as RanBoos and SVMRan. RanBoos_H and SVMRan_H behave smlarly o RanBoos and SVMRan bu performed slhly poorer. SFSum fared medocrely as rann based on summn all feaure values s unable o balance he wehs of feaures because no all feaures are equal n dscrmnave srenh. HS performs poorly whch reveals ha whle many enune revews may no be helpful spam revews can be que helpful (decepve). Thus helpfulness scores are no ood for dfferenan spam and non-spam roups. Snce n many applcaons he user wans o nvesae a ceran number of hhly lely spam roups and NDC does no ve any udance on how many are very lely o be spa we hus also use n o evaluae he ranns. In hs case we need o now whch es roups are spam and non-spam. We can use a hreshold on he spamcy o decde ha whch can reflec he user s srcness for spam. Snce n dfferen applcaons he user may wan o use dfferen hresholds we use wo hresholds n our expermens =.5 and =.7. Tha s f he spamcy value s he roup s rearded as spa oherwse non-spam. These hresholds ve us he follown daa dsrbuons: =.5 =.7 Spam 38% 29% Non-spam 62% 7% Table : Daa dsrbuons for he wo spamcy hresholds Fure 6 (a) and (b) show he and op ran posons for =.5 and =.7 respecvely. We can see ha SRan conssenly ouperforms all exsn mehods. RanBoos s he srones amon he exsn mehods. 9.3 Classfcaon Expermens If a spamcy hreshold s appled o decde spam and non-spam roups supervsed classfcaon can also be appled. Usn he hresholds of =.5 and.7 we have he labeled daa n Table. We use SVM n SVM lh [6] (wh lnear ernel) and Losc Reresson (LR) n WEKA ( as he learnn alorhms. The commonly used measure AUC (Area Under he ROC Curve) s employed for classfcaon evaluaon. Nex we dscuss he feaures ha we consder n learnn: roup Spam Feaures (SF) f f 8 : These are he proposed eh (8) roup feaures presened n Sec. 5.. Indvdual Spammer Feaures (ISF): A se of feaures for deecn ndvdual spammers was repored n [24]. Usn hese feaures we represened each roup wh her averae values of all he members of each roup. We wan o see wheher such ndvdual spammer feaures are also effecve for roups. Noe ha hese feaures cover hose n Sec Lnusc Feaures of revews (LF): In [3] word and POS (par-of-speech) n-ram feaures were shown o be effecve for deecn ndvdual fae revews. Here we wan o see wheher such feaures are also effecve for spam roups. For each roup we mered s revews no one documen and represened wh hese lnusc feaures. Table 2 (a) and (b) show he AUC values of he wo classfcaon alorhms for dfferen feaure sens usn -fold cross

10 Feaure Sens SVM LR SVR SVM Ran Ran Boos SVM Ran_H Ran Boos_H S Ran SF ISF LF SF + ISF + LF Feaure Sens SVM (a) The spamcy hreshold of =.5 LR SVR SVM Ran Ran Boos SVM Ran_H Ran Boos_H S Ran SF ISF LF SF + ISF + LF (b) The spamcy hreshold of =.7 Table 2: AUC resuls of dfferen alorhms and feaure ses. All he mprovemens of SRan over oher mehods are sascally snfcan a he confdence level of 95% based on pared -es. valdaon for =.5 and =.7 respecvely. I also ncludes he rann alorhms n Sec. 9.2 as we can also compue her AUC values ven he spam labels n he es daa. Noe ha he relaon-based model of SRan could no use oher feaures han SF feaures and he feaures n Sec. 5.2 (no shown n Table 2). Here aan we observe ha SRan s snfcanly beer han all oher alorhms (wh he 95% confdence level usn pared - es). RanBoos aan performed he bes amon he exsn mehods. Indvdual spam feaures (ISF) performed poorly. Ths s undersandable because hey canno represen roup behavors well. Lnusc feaures (LF) fared poorly oo. We beleve s because conen-based feaures are more useful f all revews are abou he same ype of producs. The lanuae used n fae and enune revews can have some suble dfferences. However revewers n a roup can revew dfferen ypes of producs. Even f here are some lnusc dfferences amon spam and non-spam revews he feaures become que sparse and less effecve due o a lare number of produc ypes and no so many roups. We also see ha combnn all feaures (Table 2 las row n each able) mproves AUC slhly. RanBoos acheved AUC = 6 ( =.5) and 8 ( =.7) whch are sll snfcanly lower han AUC =.93 ( =.5) and.95 ( =.7) for SRan respecvely. Fnally we observe ha he resuls for =.7 are slhly beer han hose for =.5. Ths s because wh he hreshold =.7 he spam and non-spam roups are well separaed (see Table ). In summary we conclude ha SRan ouperforms all baselne mehods ncludn reresson learnn o ran and classfcaon. Ths s mporan consdern ha SRan s an unsupervsed mehod. Ths also shows ha he relaon-based model used n SRan s ndeed effecve n deecn opnon spammer roups.. CONCLUSIONS Ths paper proposed o deec roup spammers n produc revews. The proposed mehod frs used frequen emse mnn o fnd a se of canddae roups from whch a labeled se of spammer roups was produced. We found ha alhouh labeln ndvdual fae revews or revewers s hard labeln roups s consderably easer. We hen proposed several behavor feaures derved from colluson amon fae revewers. A novel relaon-based model called SRan was presened whch can consder relaonshps amon roups ndvdual revewers and producs hey revewed o deec spammer roups. Ths model s very dfferen from he radonal supervsed learnn approach o spam deecon. Expermenal resuls showed ha SRan snfcanly ouperformed he sae-of-he-ar supervsed classfcaon reresson and learnn o ran alorhms.. ACKNOWLEDMENT Ths wor was parally suppored by a oole Faculy Research Award. 2. REFERENCES [] Arawal R. and Sran R. Fas alorhms for mnn assocaon rules. VLDB [2] Benevenuo F. Rodrues T. Almeda V. Almeda J onvalves M. A. Deecn spammers and conen promoers n onlne vdeo socal newors. SIIR. 29. [3] Bures C. Shaed T. Renshaw E. Lazer A. Deeds M. Hamlon N. Hullender.. Learnn o ran usn raden descen. ICML. 25. [4] Casllo C. Davson B. Adversaral Web Search Foundaons and Trends n Informaon Rereval 5 2. [5] Casllo C. Donao D. Becche L. Bold P. Leonard S. Sann M. and Vna S. 26. A reference collecon for web spam. SIIR Forum S. 26. [6] Chra P.A. Dederch J. and Nedl W. MalRan: usn rann for spam deecon. CIKM. 25. [7] Douceur J. R. The sybl aac. IPTPS Worshop. 22. [8] Eale N. and Penland A. Realy Mnn: Sensn Complex Socal Sysems. Personal and Ubquous Compun. 25. [9] Fayyad U. M. and Iran K. B. Mul-nerval dscrezaon of connuous-valued arbues for classfcaon learnn. IJCAI [] Fless J. L. Measurn nomnal scale areemen amon many raers. Psycholocal Bullen 76(5) pp [] Freund Y. Iyer R. Schapre R. and Sner Y. An effcen boosn alorhm for combnn preference. JMLR. 23. [2] Heah M. T. Scenfc Compun: An Inroducory Survey. McrawHll New Yor. Second edon. 22. [3] Hsu W. Dua D. Helmy A. Mnn Behavoral roups n Lare Wreless LANs. MobCom. 27. [4] Jndal N. and Lu B. Opnon spam and analyss. WSDM. 28. [5] Jndal N. Lu B. and L E. P. Fndn Unusual Revew Paerns Usn Unexpeced Rules. CIKM. 2. [6] Joachms T. Man lare-scale suppor vecor machne learnn praccal. Advances n Kernel Mehods. MIT Press [7] Joachms T. Opmzn Search Ennes Usn Clchrouh Daa. KDD. 22. [8] K S.M. Panel P. Chlovs T. and Pennaccho M. Auomacally assessn revew helpfulness. EMNLP. 26. [9] Klenber J. M. Auhorave sources n a hyperlned envronmen. ACM-SIAM SODA 998. [2] Kolar P. Java A. Fnn T. Oaes T. Josh A. Deecn Spam Blos: A Machne Learnn Approach. AAAI. 26. [2] Koura. Effend F. A. yöny Z. Heymann P. and H. arca-molna. Comban spam n an sysems. AIRWeb. 27. [22] Lands J. R. and Koch.. The measuremen of observer areemen for caeorcal daa. Bomercs [23] L F. Huan M. Yan Y. and Zhu X. Learnn o denfy revew Spam. IJCAI. 2. [24] L E. Nuyen V. A. Jndal N. Lu B. and Lauw H. Deecn Produc Revew Spammers Usn Ran Behavor. CIKM. 2. [25] Lu J. Cao Y. Ln C. Huan Zhou M. Low-qualy produc revew deecon n opnon summarzaon. EMNLP 27. [26] Lu T-Y. Learnn o Ran for Informaon Rereval. Foundaons and Trends n Informaon Rereval 3(3): [27] Marnes B. Cauo C. and Menczer F. Socal spam deecon. AIRWeb. 29. [28] Marnez-Romo J. and Arauo A. Web Spam Idenfcaon Throuh Lanuae Model Analyss. AIRWeb. 29. [29] Muheree A. Lu B. Wan J. lance N. Jndal N. Deecn roup Revew Spam. WWW. 2. (Poser paper) [3] Noulas A. Naor M. Manasse M. Feerly D. Deecn Spam Web Paes hrouh Conen Analyss. WWW 26. [3] O M. Cho Y. Carde C. Hancoc J. Fndn Decepve Opnon Spam by Any Srech of he Imanaon. ACL. 2. [32] Wan. Xe S. Lu B. and Yu P. S. Revew raph based Onlne Sore Revew Spammer Deecon. ICDM. 2. [33] Wan Y. Ma M. Nu Y. and Chen H. Spam Double-Funnel: Connecn Web Spammers wh Adversers. WWW 27. [34] Wu. reene D. Smyh B. and Cunnnha P. 2. Dsoron as a valdaon creron n he denfcaon of suspcous revews. Techncal repor UCD-CSI-2-4 Unversy Collee Dubln. [35] Wu B. oel V. & Davson B. D. Topcal TrusRan: usn opcaly o comba Web spam. WWW. 26. [36] Yan F. Jan J. Lu Y. Luo Q. Zhan M. Communy dscovery based on socal acors' neress & socal relaonshps. SK. 28. [37] Zhan Z. and Varadaraan B. Uly scorn of produc revews. CIKM. 26.