Cited by 152Complex Network Analysis TechniquesSpam and Phishing DetectionAnomaly Detection Techniques and Applications

CatchSync: catching synchronized behavior in large directed graphs

Jiang, Meng, Cui, Peng, Beutel, Alex, Faloutsos, Christos, Yang, Shiqiang·2014·Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining

Abstract

Given a directed graph of millions of nodes, how can we automatically spot anomalous, suspicious nodes, judging only from their connectivity patterns? Suspicious graph patterns show up in many applications, from Twitter users who buy fake followers, manipulating the social network, to botnet members performing distributed denial of service attacks, disturbing the network traffic graph. We propose a fast and effective method, CatchSync, which exploits two of the tell-tale signs left in graphs by fraudsters: (a) synchronized behavior: suspicious nodes have extremely similar behavior pattern, because they are often required to perform some task together (such as follow the same user); and (b) rare behavior: their connectivity patterns are very different from the majority. We introduce novel measures to quantify both concepts ("synchronicity" and "normality") and we propose a parameter-free algorithm that works on the resulting synchronicity-normality plots. Thanks to careful design, CatchSync has the following desirable properties: (a) it is scalable to large datasets, being linear on the graph size; (b) it is parameter free; and (c) it is side-information-oblivious: it can operate using only the topology, without needing labeled data, nor timing information, etc., while still capable of using side information, if available. We applied CatchSync on two large, real datasets 1-billion-edge Twitter social graph and 3-billion-edge Tencent Weibo social graph, and several synthetic ones; CatchSync consistently outperforms existing competitors, both in detection accuracy by 36% on Twitter and 20% on Tencent Weibo, as well as in speed.

Integrity signals

Registry

Crossref · 10.1145/2623330.2623632

Cites

41 of 41 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The paper's work can complement other methods used in prior work to detect fake and compromised accounts, such as unsupervised anomaly detection, temporal features, IP addresses, and generic supervised learning.

    “Finally, we highlight that our work can complement other methods used in prior work to detect fake and compromised accounts, such as using unsupervised anomaly detection techniques [50], temporal features [23, 24], IP addresses [45], as well as generic supervised learning [3].”

    From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [23]

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S.
Affiliations
  • Tsinghua University (CN)
  • Carnegie Mellon University (US)
Venue
Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining
Publisher
ACM
Published
2014-08-24
Pages
941-950
OpenAlex
W2101447063
Cited by
151
References
41
Citations by year
2026: 2 · 2025: 3 · 2024: 7 · 2023: 5 · 2022: 6 · 2021: 15 · 2020: 20 · 2019: 12 · 2018: 19 · 2017: 32 · 2016: 16 · 2015: 14
FWCI
19.02
Type
conference paper
Language
en
Open access
closed
Locations
ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) (publishedVersion)
Funders
  • Division of Computer and Network Systems (CNS-1314632)
  • Army Research Office (W911NF-11-C-0088)
  • U.S. Army Research Laboratory (W911NF-09-2-0053)
  • Media Development Authority - Singapore (WBS:R-252-300-001-490)
  • National Natural Science Foundation of China (61210008, 61303075, 61370022)
  • Defense Advanced Research Projects Agency (W911NF-11-C-0088)
  • Ministry of Science and Technology of the People's Republic of China (2013DFG12870, 2011CB302206)
Topics
  • Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
Keywords
directed graphs, synchronicity, normality, connectivity patterns, bot detection, fake followers, parameter-free algorithms, Weibo, large-scale graphs

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review