Abstract

The popularity of Twitter has fostered the emergence of various fraudulent user activities - one such activity is to artificially bolster the social reputation of Twitter profiles by gaining a large number of followers within a short time span. Many users want to gain followers to increase the visibility and reach of their profiles to wide audiences. This has provoked several blackmarket services to garner huge attention by providing artificial followers via the network of agreeable and compromised accounts in a collusive manner. Their activity is difficult to detect as the blackmarket services shape their behavior in such a way that users who are part of these services disguise themselves as genuine users. In this paper, we propose DECIFE, a framework to detect collusive users involved in producing ‘following’ activities through blackmarket services with the intention to gain collusive followers in return. We first construct a heterogeneous user-tweet-topic network to leverage the follower/followee relationships and linguistic properties of a user. The heterogeneous network is then decomposed to form four different subgraphs that capture the semantic relations between the users. An attention-based subgraph aggregation network is proposed to learn and combine the node representations from each subgraph. The combined representation is finally passed on to a hypersphere learning objective to detect collusive users. Comprehensive experiments on our curated dataset are conducted to validate the effectiveness of DECIFE by comparing it with other state-ofthe-art approaches. To our knowledge, this is the first attempt to detect collusive users involved in blackmarket ‘following services’ on Twitter.

CCS Concepts

• Information systems →Social networks; • Security and privacy;

Keywords

Followers, collusion, blackmarket, Twitter, OSNs

Introduction

Are you a Twitter user? Do you want to boost your Twitter profile (by increasing the follower count) within a limited time without getting suspended by Twitter? Several online services are ready to assist you. What you need to do is simple – pay them, and they will provide you followers; most of these followers would be legitimate Twitter users. If you can not afford to pay money, then you can opt for another option – just become a part of these services, start following their customers and earn credits; these credits can be used further to gain your own followers. Do not worry about being flagged by Twitter policy as these services are so smart in their following mechanism that they can easily deceive Twitter into thinking that their activity is legitimate. This is the philosophy behind many online blackmarket following services. Twitter is arguably the most popular Online Social Network (OSN) for mass communication. It is also one of the key platforms for digital campaigning, social networking and opinion dissemination. The popularity of Twitter has attracted with it new online markets that help its users to make their profiles attractive by increasing followers, retweets, likes, replies, etc. In this context, Stringhini et al. [33] coined the term “Twitter followers market" to characterize those syndicates catering to people willing to pay for a quick increase of their followers. Many people try to rapidly gain fame by exploiting this mechanism – they buy followers from these online markets. However, the coordinators of these services manage the activities of users to maintain the integrity and avoid societal, privacy and security problems. Controlling such type of artificial following activities has thus become one of the major challenges. There exist several blackmarket agencies which have created thriving and intelligent ecosystems of producing illicit followers. Users can gain such followers by paying money (premium services) or for free by following customers of those services (freemium services) [27]. In this paper, we focus our attention on the latter case, and call this type of users “collusive users” – users who gain followers from blackmarket services. Previous literature [3, 6, 10, 12, 13] on collusive entities in online media reported that collusive users are not ‘fake’ – they are not bots, the handles of these Twitter profiles are normal human beings, and their following activities are not mechanically controlled by any predefined policy. Rather, collusive users exhibit a hybrid following

Figure 1: A heterogeneous network for modeling collusive users and their interactions. (a) Three types of nodes. (b) User-tweet-topic heterogeneous network. (c) Three types of edges involved in the network. The detailed construction of the heterogeneous network can be found in Section 4.1.

behavior – on one hand, similar to non-collusive users, they organically follow other users due to similar topical interest; on the other hand, similar to fake users, they inorganically follow other blackmarket customers only to gain credits. Designing a system to identify collusive users would be useful for Twitter managers and social network analysts to figure out how and what extent the profile of a user has turned out to be popular due to the support of such blackmarket services. In this work, we propose DECIFE, a novel heterogeneous graph attention network for detecting collusive users who are involved in producing fake followers. We first create a heterogeneous network (c.f. Figure 1) based on the relationship and linguistic properties of users. We then decompose the network into four different subgraphs to capture semantic relations between users. Finally, we exploit a hierarchical aggregation network to learn node representations that are passed on to a hypersphere learning objective to detect collusive users. To evaluate our method, we collected data of collusive users from a popular blackmarket service by designing a customized web scraper. The entire data collection was carried out after taking proper IRB (institutional review board) approval from our institute. We show the effectiveness of our proposed DECIFE model by comparing it with three baseline methods – FakeFolss[5], FakeFols[5], FolMarket [2] and three individual components of DECIFE considered in isolation (ablation study). In summary, the major contributions of the paper are four-fold:

(1) We deal with a novel problem of detecting collusive users in Twitter where normal users get involved in artificial following activities through blackmarket services for boosting their online profiles. To the best of our knowledge, no existing work has investigated the problem of ‘collusive user detection involved in blackmarket following services’ on Twitter. (2) We introduce DECIFE, a novel framework to detect collusive users on Twitter. It uses a hierarchical subgraph aggregation

framework to leverage the follower/followee relationships and linguistic properties of users. (3) We prepare a new dataset of collusive users who are involved in blackmarket following services on Twitter. This, to our knowledge, is the first dataset of this kind. (4) We conduct extensive experiments on the curated dataset of collusive users to show the superiority of our method over state-of-the-art approaches. Reproducibility: To encourage reproducible research, we have made the codes and the anonymized version of the dataset publicly available at https://github.com/LCS2-IIITD/DECIFE.

Related Work

We discuss the related literature by dividing the existing work into two parts – (i) detection of fake followers in OSNs, and (ii) study of blackmarket services in OSNs.

Detection of Fake Followers in OSNs

Most of the approaches to detect fake followers identify a set of features and use machine learning techniques. Wiltshire, in her blog1, discussed the population of fake followers and found that there is an increase of 1-3% fake followers for a Twitter account every couple of months. Cresci et al. [8] mentioned that there are two reasons to buy fake followers: increase visibility and push advertisements. A tool, called “Fake Followers Check”2 was developed to detect fake followers on Twitter based on the ratio of friends and followers, usage of repeated spam phrases, count of retweets, etc. Cresci et al. [8] proposed a machine learning approach to detect fake followers using multiple features and different machine learning classifiers. Mehrotra et al. [23] used centrality-based graph features to detect fake Twitter followers. Lee et al. [19] found retweeters who can be used to spread the message effectively

1https://www.gshiftlabs.com/social-media-blog/the-fake-followers-epidemic 2https://bit.ly/2KzMRdd

among different group of people. Shah et al. [26] proposed fBox, an algorithm to detect suspicious friend and follower links on a large who-follows-whom Twitter dataset. Cresci et al. [7] developed a classifier for fake follower detection using profile, timeline and relationship based features. Jiang et al. [17] proposed CatchSync to detect suspicious nodes (followers and botnets) exhibiting synchronized behavior on Twitter social network. Kwak et al. [18] studied the dynamics of unfollow behavior in Twitter based on online relationships of Korean-speaking Twitter users. Aggarwal et al. [1] identified users with increased follower count using unsupervised local neighborhood detection method. Shen and Liu [28] proposed supervised spammer detection method with social interaction to detect spammers on twitter based on content and social interaction. Li et al. [20] detected campaign promoters by mapping the problem to relational classification and solved it using typed Markov Random Fields. Ferrara et al. [16] discussed how social bots which interact with humans and get unnoticed have risen in the present scenario. Shen et al. [29] distinguished fake followers from the legitimate users using several discriminative features. Zhang and Lu [39] used a network-based strategy to identify fake followers. Zhang et al. [40] focused on the detection of zombie followers in Sina Weibo.

Study of Blackmarket Services in OSNs

Blackmarket services have gained substantial attention recently because of the techniques they use to provide services to the customers. Stringhini et al. [33] was the first to analyze the Twitter follower markets based on the market size and market price. A detailed analysis of blackmarket services is presented in [9, 31] with the impact on multiple OSNs. Most of the prior studies showed how fake followers in social media help in promoting different agenda [2, 32, 33]. Farooqi et al. [15] showed how collusion networks collect ‘OAuth’ access tokens from colluding members and abuse them to provide fake likes or comments to their members. Zhu et al. [41] proposed an automated approach to detect collusive behavior in question-answering systems. Weerasinghe et al. [37] studied models for detecting Instagram posts that gained interaction through collusive networks. Aggarwal and Kumaraguru [2] also discovered an oligopoly structure of merchants involved in blackmarket services. Shah et al. [27] studied multiple types of blackmarket agencies and analyzed a honeypot fraudster ecosystem to provide insights about multifaceted behaviour of fraudsters. Motoyama et al. [24] analyzed structure of social networks present on six different underground forums to understand the social dynamics of e-crime markets. Thomas [35] studied various blackmarkets and developed a classifier to detect fraudulent accounts sold by these marketplaces. Singh et al. [30] studied the behavioral characteristics of Twitter follower market merchants based on user and content based features. Liu et al. [21] detected ‘volowers’ (followers who provide voluntary following services) who make profit in the follower markets. Recently, there are some preliminary works of collusive user detection on Twitter and YouTube. Arora et al. [3], Dutta and Chakraborty [10], Dutta et al. [12] proposed techniques to detect collusive users involved in blackmarket-based retweeting service on Twitter. Dutta et al. [14] proposed CollATe, an end-toend framework to detect collusive entities on YouTube fostered by various blackmarket services. We encourage the readers to go

through [11] for a comprehensive survey on collusive activities in different online media platforms.

Differences with Previous Studies: The fundamental differences between the studies discussed above on fake follower detection and the collusive user detection are two-fold: (i) unlike fake followers who are mostly bots or whose activities are mechanically controlled by predefined policies, collusive users are normal human beings, and they themselves control their accounts. Therefore, unlike fake users who mostly show “synchronous behavior” [17], collusive users are asynchronous in nature [12]. (ii) Unlike fake followers, collusive users exhibit a hybrid following behavior – in one hand, being a normal user, they follow other users organically due to similar topical interest; on the other hand, being a collusive user, they randomly follow other blackmarket customers inorganically to gain credits [10]. To the best of our knowledge, ours is the first work to detect collusive users who gain artificial followers from blackmarkets.

Background and Dataset

Approaching blackmarket services is one of the quickest ways to boost the impact of users on social media. These blackmarket services offer promotional services on multiple online media such as OSNs (e.g., likes on Facebook; followers, retweets, likes on Twitter; followers on Instagram), subscription-sharing platforms (e.g., views, subscribers, likes on Youtube), music-sharing platforms (e.g., plays, followers, likes, reposts, comments on SoundCloud, fans on Reverb- Nation), business and employment-oriented platforms (e.g., followers, connections, endorsements on LinkedIn), etc. We identified the blackmarket services providing collusive follower appraisals for Twitter by querying on search engines with keywords such as “buy free followers”, “get me followers”, “get followers quickly”. To collect collusive users, we selected YouLikeHits3, a popular creditbased freemium blackmarket service4. Customers on navigating to these services can see a dashboard (earning area) of other customers who are also using that service. YouLikeHits provide the customers with an initial credit of 50 which can be utilized to use various facilities offered by the service. After taking proper IRB approval from our institute, we developed a web scraper that used Selenium5

to start a headless web browser navigating to the URL of the blackmarket service. We used popular Python packages such as Requests, BeautifulSoup etc. to parse the Twitter user IDs who submitted their profile for collusive follower appraisals. We further used the Tweepy library6 to collect the metadata and timeline of the Twitter users. Note that we also collect a set of non-collusive users who surely have not participated in any kind of blackmarketdriven activities to gain artificial appraisals. This set of users is only collected for the test phase of our experiment and is not the part of original dataset.

3https://www.youlikehits.com/twitter2.php 4Though there exist several blackmarket services to get collusive appraisals, we choosed only YouLikeHits for our study due to its popularity and extensive amount of literature [10, 12, 14] investigating this service. 5https://www.seleniumhq.org/ 6https://github.com/tweepy/tweepy

Figure 2: Architecture of our proposed DECIFE model for collusive user detection on Twitter.

DECIFE: Our Proposed Model

The objective of collusive user detection task is to learn how to automatically identify Twitter users who submitted their accounts to blackmarket services to gain collusive followers. Formally, given a set of collusive users𝑢𝑖= {𝑢1,𝑢2, . . . }, connected via relationships Δ𝑚= {Δ1, Δ2, . . . } in a heterogeneous network G, DECIFE learns a hypersphere boundary S(𝑟,𝑐) (with radius 𝑟and center 𝑐) around the collusive users to identify whether a new user is a collusive user or not. In this section, we present the architecture of DECIFE. It consists of four major components: network construction, feature extraction, hierarchical subgraph aggregation and collusive user detection. In this section, we introduce each of these components in detail. Figure 2 shows the schematic architecture of DECIFE.

Network Construction

Here, we show the construction of the heterogeneous network and subsequent subgraphs for modeling the interactions of Twitter users. Heterogeneous Network: To model the Twitter network, we construct a heterogeneous network [34] as a directed network G = (V, E), where each node 𝑣∈V and each edge 𝑒∈E are related with their node-type mapping functions 𝜌(𝑣) : V →X and edge-type mapping functions 𝜑(𝑒) : E →Y, respectively. X = {user(𝑈), tweet(𝑇), topic(𝑂)} denote the node-types and Y = {follows(𝑟), posts(𝑝), contains(𝑐)} denote the edge-types such that

> 2 (a heterogeneous network contains at least 2 nodetypes or edge-types). An illustration of this network is shown in Figure 1. Every Twitter user 𝑢𝑖∈𝑈is represented with a feature vector 𝑥𝑖in G and is connected with its corresponding tweets 𝑡𝑖𝑗∈𝑇and to users she follows or is followed by. Every tweet 𝑡𝑖𝑗 of a user 𝑢𝑖is connected to a topic node 𝑜𝑘∈𝑂via one-to-one mapping, where 𝑘is the set of topics. Network Decomposition: The heterogeneous network is decomposed into subgraphs based on multiple relationships. A Relationship Δ between a labelled7 user-node 𝑢𝑖and another labelled usernode 𝑢𝑗is a sequence of connected relations M1 ⇌M2 · · · ⇌M𝑛 in G. Each relation M from source node 𝑣1 ∈V to target node 𝑣2 ∈V with edge 𝑒∈E is denoted as ⟨X(𝑣1), Y(𝑒), X(𝑣2)⟩. Note that (𝑣1, 𝑣2) can belong to any node-type connected via edge 𝑒. To capture different aspects of a user’s behavior, we use four types of relationships, Δ𝑚,𝑚= {1, 2, 3, 4} which are detailed below: (1) Δ1: To describe a connection between users in the ‘following’ blackmarket services, we formulate a relationship having a common follower.

user1 𝑓𝑜𝑙𝑙𝑜𝑤𝑠 −−−−−−−→user𝑥 𝑓𝑜𝑙𝑙𝑜𝑤𝑠 ←−−−−−−−user2 (2) Δ2: Users in a blackmarket service tend to participate in a barter system where they follow other users to gain credits that can later be used to obtain followers of their accounts. As an example, a transition user (user𝑥) signed up on the

7We refer to a labelled user as a user whose ground-truth label is known. In our case, it refers to a collusive user which we collected from the blackmarket service.

service, follows users (user1) to gain credits which can be availed to gain followers (user2) in return. To exploit this characteristic, we formulate a relationship between users in a 1-hop manner.