[Paper Review] No Place to Hide: Catching Fraudulent Entities in Tensors

Yikun Ban, Xin Liu+3 more|arXiv (Cornell University)|Oct 15, 2018

Tensor decomposition and applications36 references4 citations

TL;DR

This paper proposes ISG+D-Spot, a novel framework that models tensors as weighted graphs (Information Sharing Graphs) to detect fraudulent entities via dense subgraph mining. By capturing value-sharing patterns across heterogeneous features and using a fast, parallelizable algorithm, D-Spot achieves up to 11x speedup and guarantees subgraphs at least 1/2 as dense as the optimal, outperforming state-of-the-art methods in fraud detection on real-world datasets.

ABSTRACT

Many approaches focus on detecting dense blocks in the tensor of multimodal data to prevent fraudulent entities (e.g., accounts, links) from retweet boosting, hashtag hijacking, link advertising, etc. However, no existing method is effective to find the dense block if it only possesses high density on a subset of all dimensions in tensors. In this paper, we novelly identify dense-block detection with dense-subgraph mining, by modeling a tensor into a weighted graph without any density information lost. Based on the weighted graph, which we call information sharing graph (ISG), we propose an algorithm for finding multiple densest subgraphs, D-Spot, that is faster (up to 11x faster than the state-of-the-art algorithm) and can be computed in parallel. In an N-dimensional tensor, the entity group found by the ISG+D-Spot is at least 1/2 of the optimum with respect to density, compared with the 1/N guarantee ensured by competing methods. We use nine datasets to demonstrate that ISG+D-Spot becomes new state-of-the-art dense-block detection method in terms of accuracy specifically for fraud detection.

Motivation & Objective

• To address the limitation of existing dense-block detection methods that fail to identify fraud when dense signals appear only on a subset of tensor dimensions.
• To model tensor-based fraud detection as dense subgraph mining while preserving all density information and handling heterogeneous data types.
• To develop a scalable, parallelizable algorithm that guarantees high-quality dense subgraph detection with provable approximation bounds.
• To differentiate between hidden-densest blocks (fraudulent) and normal dense blocks by prioritizing critical features using information theory.
• To improve robustness against noisy features by automatically weighting features based on their information-theoretic contribution to value sharing.

Proposed method

• Construct an Information Sharing Graph (ISG) by transforming each value-sharing instance in a tensor into a weighted edge or node, preserving all density information.
• Assign edge weights using information-theoretic measures to prioritize features with higher distributional significance, such as IP addresses or device IDs over trivial ones like age or gender.
• Apply the D-Spot algorithm to detect multiple densest subgraphs in a single pass, leveraging a greedy iterative approach with a 1/2-approximation guarantee for density.
• Design D-Spot to be parallelizable, enabling efficient scaling on large-scale tensors by processing subgraphs independently.
• Use a single-pass scan of the tensor to build ISG, ensuring linear time complexity with respect to the number of entries.
• Integrate feature prioritization into the graph construction phase, allowing the method to naturally resist noise and emphasize semantically critical features.

Experimental results

Research questions

• RQ1 Can dense-block detection be effectively reframed as dense-subgraph mining in a transformed graph representation without losing density information?
• RQ2 Can a graph-based method detect hidden-densest blocks—those dense only on a subset of tensor dimensions—more effectively than existing search-based or decomposition-based approaches?
• RQ3 Can a scalable, parallelizable algorithm achieve both high speed and strong theoretical guarantees in dense subgraph detection for fraud detection?
• RQ4 How does the integration of information-theoretic feature weighting improve detection accuracy in the presence of noisy or irrelevant features?
• RQ5 To what extent does the proposed ISG+D-Spot framework outperform state-of-the-art methods in real-world fraud detection scenarios?

Key findings

• ISG+D-Spot achieves up to 11x speedup over the state-of-the-art algorithm, demonstrating significant performance gains in large-scale tensor analysis.
• The D-Spot algorithm guarantees that the detected subgraphs are at least 1/2 as dense as the optimal subgraph, outperforming competing methods that only guarantee 1/N density under the same conditions.
• On eight real-world datasets, ISG+D-Spot achieved higher AUC scores than existing methods, including M-Zoom, M-Biz, and D-Cube, especially in detecting small-scale, hidden dense blocks.
• In the Registration dataset, ISG+D-Spot maintained high AUC (0.9859) even with five features, while baseline methods dropped significantly (e.g., M-Zoom sus AUC fell to 0.4874), demonstrating robustness to noise.
• The method successfully detected a 51-member group sharing a single IP subnet—previously missed by baselines—by amplifying value-sharing signals through ISG construction.
• ISG+D-Spot scales near-linearly with dataset size, as evidenced by runtime performance on Amazon datasets, confirming its practicality for real-world deployment.