[Paper Review] Follow Spam Detection based on Cascaded Social Information

Sihyun Jeong, Giseop Noh+2 more|arXiv (Cornell University)|May 2, 2016

Spam and Phishing Detection34 references3 citations

TL;DR

This paper proposes a cascaded social information-based approach to detect follow spam on Twitter by analyzing local two-hop social networks. It introduces TSP-Filtering (using triad significance profiles) and SS-Filtering (using social status theory), with an ensemble method, Cascaded-Filtering, achieving 96.3% true positive rate and 5.7% false positive rate on real Twitter data, outperforming prior methods with lower computational cost.

ABSTRACT

In the last decade we have witnessed the explosive growth of online social networking services (SNSs) such as Facebook, Twitter, RenRen and LinkedIn. While SNSs provide diverse benefits for example, forstering interpersonal relationships, community formations and news propagation, they also attracted uninvited nuiance. Spammers abuse SNSs as vehicles to spread spams rapidly and widely. Spams, unsolicited or inappropriate messages, significantly impair the credibility and reliability of services. Therefore, detecting spammers has become an urgent and critical issue in SNSs. This paper deals with Follow spam in Twitter. Instead of spreading annoying messages to the public, a spammer follows (subscribes to) legitimate users, and followed a legitimate user. Based on the assumption that the online relationships of spammers are different from those of legitimate users, we proposed classification schemes that detect follow spammers. Particularly, we focused on cascaded social relations and devised two schemes, TSP-Filtering and SS-Filtering, each of which utilizes Triad Significance Profile (TSP) and Social status (SS) in a two-hop subnetwork centered at each other. We also propose an emsemble technique, Cascaded-Filtering, that combine both TSP and SS properties. Our experiments on real Twitter datasets demonstrated that the proposed three approaches are very practical. The proposed schemes are scalable because instead of analyzing the whole network, they inspect user-centered two hop social networks. Our performance study showed that proposed methods yield significantly better performance than prior scheme in terms of true positives and false positives.

Motivation & Objective

• Address the growing threat of follow spam on Twitter, where spammers follow legitimate users to increase visibility and spread spam.
• Overcome limitations of content-based spam detection, which fails against evolving message patterns with URLs and images.
• Develop a scalable, real-time spam detection mechanism that leverages local network structures instead of global network analysis.
• Investigate whether structural differences in local two-hop social networks can effectively distinguish spammers from legitimate users.
• Propose and evaluate a hybrid detection framework combining triad significance profiles (TSP) and social status (SS) theory for improved accuracy.

Proposed method

• Use Triad Significance Profile (TSP) to measure the frequency and distribution of 13 isomorphic subgraphs (triads) in each user’s two-hop social network to detect structural anomalies.
• Apply Social Status (SS) theory to model follower behavior: legitimate users tend to follow higher-status users, while spammers follow randomly, enabling classification based on status imbalance.
• Design TSP-Filtering and SS-Filtering as standalone detection schemes, each analyzing user-centered two-hop subnetworks to reduce computational load.
• Combine both TSP and SS features via an ensemble technique, Cascaded-Filtering, to improve detection performance by leveraging complementary structural signals.
• Train and evaluate models on real Twitter datasets, focusing on local network structures to ensure scalability and real-time applicability.
• Explore unsupervised extensions using Self-Organizing Maps (SOM) to dynamically cluster new accounts based on similarity to known spammer patterns.

Experimental results

Research questions

• RQ1 Can local two-hop social network structures effectively differentiate follow spammers from legitimate users on Twitter?
• RQ2 To what extent do triad significance profiles (TSP) in local networks serve as discriminative features for detecting follow spam?
• RQ3 How does social status theory help in identifying spammers who follow users without regard to status hierarchy?
• RQ4 Can combining TSP and SS features via ensemble learning significantly improve detection accuracy compared to individual methods?
• RQ5 Is the proposed method scalable and suitable for real-time deployment, given its reliance on local network analysis rather than global network computation?

Key findings

• The TSP-Filtering method alone achieved a 92.1% classification accuracy for identifying spammers using only two-hop local network structures.
• The SS-Filtering method effectively detected spammers by identifying anomalous follower behavior inconsistent with social status hierarchy.
• The hybrid Cascaded-Filtering approach achieved a 96.3% true positive rate and only 5.7% false positive rate, significantly outperforming the CollusionRank baseline.
• The proposed methods require only local network data, making them scalable and suitable for real-time deployment in large-scale SNS environments.
• The results confirm that spammer networks exhibit distinct structural and behavioral patterns in cascaded social information, validating the core assumption of the approach.
• Future work suggests potential for extending the framework to detect other malicious behaviors, such as false rumor propagation, using similar structural analysis.