Spotting Suspicious Link Behavior with fBox: An Adversarial Perspective
  How can we detect suspicious users in large online networks? Online
popularity of a user or product (via follows, page-likes, etc.) can be
monetized on the premise of higher ad click-through rates or increased sales.
Web services and social networks which incentivize popularity thus suffer from
a major problem of fake connections from link fraudsters looking to make a
quick buck. Typical methods of catching this suspicious behavior use spectral
techniques to spot large groups of often blatantly fraudulent (but sometimes
honest) users. However, small-scale, stealthy attacks may go unnoticed due to
the nature of low-rank eigenanalysis used in practice.
  In this work, we take an adversarial approach to find and prove claims about
the weaknesses of modern, state-of-the-art spectral methods and propose fBox,
an algorithm designed to catch small-scale, stealth attacks that slip below the
radar. Our algorithm has the following desirable properties: (a) it has
theoretical underpinnings, (b) it is shown to be highly effective on real data
and (c) it is scalable (linear on the input size). We evaluate fBox on a large,
public 41.7 million node, 1.5 billion edge who-follows-whom social graph from
Twitter in 2010 and with high precision identify many suspicious accounts which
have persisted without suspension even to this day.
