{'fraction_non_alphanumeric': 0.02545838729466294, 'fraction_numerical': 0.010428736964078795, 'mean_word_length': 4.886258776328987, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 3, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
KidsTube: Detection, Characterization and Analysis of Child Unsafe Content&Promoters on YouTube

YouTube draws large number of users who contribute actively by uploading videos or commenting on existing videos. However, being a crowd sourced and large content pushed onto it, there is limited control over the content. This makes malicious users push content (videos and comments) which is inappropriate (unsafe), particularly when such content is placed around cartoon videos which are typically watched by kids. In this paper, we focus on presence of unsafe content for children and users who promote it. For detection of child unsafe content and its promoters, we perform two approaches, one based on supervised classification which uses an extensive set of video-level, user-level and comment-level features and another based Convolutional Neural Network using video frames. Detection accuracy of 85.7% is achieved which can be leveraged to build a system to provide a safe YouTube experience for kids. Through detailed characterization studies, we are able to successfully conclude that unsafe content promoters are less popular and engage less as compared with other users. Finally, using a network of unsafe content promoters and other users based on their engagements (likes, subscription and playlist addition) and other factors, we find that unsafe content is present very close to safe content and unsafe content promoters form very close knit communities with other users, thereby further increasing the likelihood of a child getting getting exposed to unsafe content.


I. INTRODUCTION
YouTube is the most popular video sharing platform on the web. It enjoys a global 2 nd rank among websites viewed in the world as of today. 1 According to the statistics released by YouTube [1], the user base of YouTube is over a billion users and 400 hrs of viewable content is getting uploaded in 60 seconds [2]. YouTube provides ease of publishing and is highly leveraged by content producers to host their video content on YouTube. Consequently, a wide variety of content is posted on YouTube and watched by users across all age groups [3]. Our work focusses on cartoon videos which are typically watched by children. Various cartoon production houses have uploaded their trademark cartoon series on YouTube for wider publicity and brand building. Figure 1a depicts one such cartoon video which clearly indicate that such cartoon videos receive large view counts and thus are widely watched. This large audience, typically in the lower age group, has very less experience of nuances and subtleties that Internet has to offer. Being a crowd sourced platform, YouTube, is no exception to users with 1 http://www.alexa.com/siteinfo/youtube.com malicious intent who are often found indulging in spamming and promotional activities. In the context of these children, the most disruptive behaviour by malicious users is to expose them to inappropriate content, Figure 1b is one such example. Unsafe content on YouTube is contributed either in form of indecent videos published by unsafe uploaders or in form of abusive/inappropriate words in comments post by unsafe commenters. We refer such uploaders and commenters in our paper as child unsafe content promoters. An otherwise safe video page can be rendered as inappropriate due to presence of abusive comments, as shown in Figure 1c. For the purpose of our work, indecent videos are those which either have graphic nudity or abusive/inappropriate dialogues. Table I depicts   Motivation: There have been a number of articles indicating the issue of unsafe content on YouTube, one of them claiming that kids are three clicks away from adult content on YouTube [4] and another suggesting that children are at a higher risk of accessing adult content on YouTube [5]. YouTube tried to address these concerns through YouTube Kids App [6]. However, it was based on user feedback (viewer flagging unsafe content), which could be manipulated. This solution could not provide expected results and consumer groups reported to FTC that it still has inappropriate content [7] which YouTube later assured would be addressed in future updates [8].
Key Contributions: We summarize our contributions as three fold. First, we provide two approaches to detect unsafe content promoters (Section IV). One uses machine learning based supervised classification model based on an extensive feature set at the level of video, user and comments. Second builds a Convolutional Neutral Network based deep learning model using features from the video frames. Second, we perform a detailed comparative characterization study (Section V) of unsafe content promoter behaviour and engagements received by them with other users spreading safe content and find distinguishing patterns. Third, using network analysis (Section VI), we show that transition of a YouTube user (typically a child in our case) watching a decent video to an indecent video is highly likely. Further, we model unsafe content promoters and other users as a graph built using their behaviours of likes, subscription and playlist. We then apply community detection algorithms to unravel closely knit communities of unsafe content promoters with normal users.

II. RELATED WORK
We discuss some key indicative research problems and challenges on YouTube that have been investigated related to the problem under study.

A. Detection of Inappropriate Content on YouTube
Detection of inappropriate video content (pornographic) by combining image features with motion information was studied by Jansohn et. al. [9] in which motion extracted in the form of MPEG-4 motion vectors was used. Ochoa et. al. [10] used spatial and temporal cinematographic features from video to build machine learning classifiers to perform binary classification of videos into adult and non-offensive. In our work too we followed the path of using video frame and image processing based features in one of our approaches based on Convolutional Neural Network.

B. Detection of malicious user behaviour
Being a crowd sourced platform, users often are found to exhibit malicious behaviour on YouTube. One work to detect spammers and content promoters was done by Benevenuto et. al. [11] in which authors manually annotated a set of YouTube users as spammers, promoters and legitimate users. This was followed by characterization and use of classification algorithms for categorizing a user into these categories. Our work draws methodological insights from their work. However, our work is focussed on the issue of unsafe content promotion in respect to cartoon videos in contrast to their work which looks at spammers and promoters in general. Another closely related problem of identification of fraudulent promotion of videos was addressed by Bulakh et. al. [12] in which measurement studies were performed to distinguish fraudulent promoters from legitimate users which was followed by development of supervised machine learning models to differentiate legitimate users from those indulging in fraudulent promotion. Spam campaigns in YouTube is another interesting problem studied by Callaghan et. al. [14] who observed broadly two spam strategies. One strategy worked by small group of users commenting on large set of videos and another worked by large group of users commenting on small set of videos. Sureka et. al. [13] investigated spamming activity in the comments posted on YouTube videos and presented an empirical analysis of comments obtained from YouTube and finally proposed a rule based classification method to detect spammers in comment activities. Our work also looks at comments but we do it from the point of view of detection of inappropriate words in it and study the relationship between commenters and uploaders of videos. Works of Agarwal et. al. [15] and Sureka et. al. [16] address the problem of mining and extracting hate and extremism videos on YouTube, but they were studied to understand the retrieval approaches being followed to obtain the desired set of videos on YouTube platform.

III. BACKGROUND
In this section we describe our problem statement and then discuss data collection and approaches adopted for building the ground truth.

A. Problem Statement
More formally, we state the three problems being addressed in this paper as follows. Detection Problem: Given a set of seed cartoon videos V , their corresponding set of uploaders U who upload those videos and commenters C who post comments on those videos, the goal is to find (identify) a subset of uploaders U unsaf e and commenters C unsaf e promoting unsafe content.
Characterization Problem: Given a set of unsafe content uploaders U unsaf e and safe content uploaders U saf e , the goal is to find the set of attributes of uploaders that distinguish them from each other to the maximum extent.

B. Data Collection
YouTube provides a platform for a huge repository of video content and engagements (likes, views , dislikes, comments, etc) around it. In lieu of our focus on content being watched by kids, we restricted ourselves to collection of cartoon videos only. We began searching and collecting videos using top 20 popular cartoon keywords (few indicative ones like mickey mouse, tom and jerry, etc.) programmatically through YouTube Data API. 2 From the search results, we randomly selected 408 videos which formed our seed input. Users who have uploaded these videos, referred as uploaders, were found to be 275. For each video, upto 100 latest comments were collected, which commutatively added up to 21,268 comments in total, which were found to be posted by 19,099 unique users, referred as commenters. Table II summarizes the data collected. This seed video dataset was further expanded to 1,178 videos liked by these uploaders & 123,390 videos liked by these commenters, 1,293 uploaders subscribed by these uploaders & 131,952 uploaders subscribed by these commenters and 1,068 videos added to playlist by these uploaders & 30,148 videos added to playlist by these commenters.
More than 80% of uploaders in the seed dataset contributes only one video in the seed video dataset and similarly around 90% of commenters in the seed dataset makes only one comment.

C. Building Ground Truth
All the seed videos that were collected using Cartoon keywords through the YouTube API were manually inspected (annotated) for presence ('1') or absence ('0') of unsafe 2 https://developers.google.com/youtube/v3/ content in video either in form of graphic nudity or abusive words spoken in dialogues. Out of the total 408 seed videos, 284 were found to be safe and remaining 124 videos were found to be unsafe for viewing by kids. With respect to the comments, we treat each comment as bag of words separated by spaces. We compared each word from the comment text with a set of bad words obtained from an online repository. 3 Out of 21,268 comments, 1814 comments were found to have atleast one bad word.

IV. DETECTION OF UNSAFE CONTENT PROMOTERS
In this section we explain our solution to the first problem of detection of unsafe content promoters. Such promoters manifest their malicious activities in two forms, first, by uploading indecent videos (unsafe content uploaders) and second, by posting indecent comments (unsafe content commenters).

A. Detecting Unsafe Content Uploaders
For identifying unsafe content uploaders, we adopt two independent approaches. One approach, referred a classifier approach uses features that capture responses of other users in a crowd sourced environment. Features at the level of video, user and comments are used. In the other, referred as CNN based approach, features from the actual video are used, details are provided below.
Classifier Approach: In this, we aim to build a classifier model to automatically mark users (uploaders) as unsafe or safe based on three types of features namely video-level, userlevel and comment-level which are explained in Table III, numbers below in brackets refer to number of features used.
Video-Level Features (19): These capture the cumulative response received from YouTube users in form of view count, comment count, like count and dislike count to the past upto 100 videos uploaded by the uploader. In addition, few other features associated with video included are video duration, length of title, length of description, description to title ratio, jaccard similarity between title and description, bad words found in title and description, number of question marks, hyperlinks and emoticons found in description.
User-Level Features (9): These include the user's profile related features like total number of videos uploaded, total views & comments received on those videos, number of subscriptions, number of days since joining YouTube and length of title & description. In addition, there are features associated with YouTube user's Google+ userID namely cir-cledByCount (number of other users in the network of user) and plusOneCount (number of likes received by user) which are also used. 4 Comment-Level Features (6): These capture the response of other users through the comments that they have been posting on videos uploaded by the user. Features related to comments used are cumulative likes and replies received by comments, number of positive, neutral and negative sentiment received on comments by the user and number of bad words in comments.  We apply a number of conventional classifiers (IV) on these features which are computed for the seed videos dataset as input with 80:20 training to test split and found that random forest classifier performs the best with respect to accuracy in predicting the class (safe or unsafe) of an input video. The classifier, thus developed, was used to predict the safety (classs of video whether decent or indecent) of upto 50 latest videos uploaded for each of the unique uploader in the seed dataset. Algorithm 1 describes the entire process of identifying unsafe content uploaders using video classifier. After applying Algorithm 1, it was observed that there are some users (uploaders) who have uploaded both decent and 4 Google+ API: https://developers.google.com/+/web/api/rest/ indecent videos, a cumulative distribution frequency (CDF) plot of proportion of indecent (unsafe) videos to total videos uploaded by users is depicted in Figure 2. This plot helps us in choosing a thresholds to mark an uploader as unsafe or safe based on the amount of unsafe (indecent) videos uploaded by them.
Algorithm 1: Detect-Unsafe-Promoter-By-Classifier (V ) 1: V ← set of seed videos 2: for all v ∈ V u do 3: V f ← f ind f eatures at level(video, user, comment) 4: end for 5: C v ← video classif ier(V f ) 6: U V ← set of unique uploaders of V 7: for all u ∈ U V do 8: V u ← f ind past uploaded videos(u) 9: for all v ∈ V u do 10: v label ← C v .predict(v) 11: end for 12: end for In reference to the Figure 2, we detect unsafe content uploaders and categorize them into extreme, high and moderate content promoters depending upon the degree of unsafe content in form of child unsafe videos uploaded by them in the past.
CNN based approach: In this approach we use the video frames and apply the concept of deep learning through Convolutional Neural Networks (CNN). The approach is based on the hypothesis that unsafe video would have transitions (either abrupt or gradual) arising due to the scenes which are depicting nudity in the video. Process of finding these transitions in a video is explained next. Key frames involving abrupt transitions (based on the visual similarity of neighbouring frames of the video) from each video are first extracted. The descriptive efficiency of both SURF (Speeded Up Robust Features) and HSV (Hue, Saturation, Value) histograms descriptors are exploited for assessing frame similarity. More specifically, these abrupt transitions are initially detected between successive video frames where there is a sharp change and thereafter the calculated scores are further analysed for the identification of frame sequences where a progressive change of the visual content takes place and in this way gradual transitions are detected as well. Finally, a post-processing step is performed to identify outliers due to object/camera movement and flash lights. We implement a CNN to detect the dissimilar image in a video frame. CNN comprises of an input layer, two convolutional layers, two sampling layers, five kernels each of size 3x3 in convolutional layer, mean filter of 2x2 in sampling layer, one fully connected layer and target output layer. The five kernels use five different feature maps namely gray, gradient-X, gradient-Y and last two kernels have randomly initialized values. This approach was found to detect unsafe video with 74% accuracy which is less than the accuracy obtained using the earlier approach. It was further observed that this approach is computationally expensive since it involves video processing on frame-by-frame basis. Due to low accuracy and high computational cost, this approach was not pursued further.

B. Detecting Unsafe Content Commenters
Since there is no way in which a user's past comments could be retrieved through the YouTube API, so a user is marked as unsafe (indecent) commenter if he or she has posted at least one comment which carries indecent words. Out of 21268 comments, 1814 comments were found to have atleast one bad word which were posted by 1755 unique users, all such users were marked as unsafe content commenters for the purpose of our work.

V. UPLOADER CHARACTERIZATION STUDY
After having identified unsafe content uploaders, in this section, we characterize these uploaders with respect to the popularity and engagements received on the videos uploaded by them. The goal is find distinguishing features which separates unsafe content promoters from those spreading safe content for kids.

A. Popularity Factors
Popularity is an important factor to characterize and distinguish unsafe content uploaders from safe content uploaders.
In context of YouTube, popularity can be gauged by various factors whose characterization study is depicted in Figure  3 comprising subscriber count, circledByCount, total videos count and total view count received on all the videos uploaded by the user. Number of subscribers to a YouTube channel is one of the key indicators of popularity of the uploader. Figure  3a depicts that unsafe content uploaders have a comparatively less number of subscribers than safe content uploaders which is suggestive of the fact that users subscribe more to those spreading safe content.
Number of videos uploaded by safe content uploaders are more than those uploaded by unsafe content uploaders as depicted in Figure 3d which indicates that users spreading unsafe content are not inclined towards maintaining a long standing profile through their video content on YouTube. Viewership trends for safe content uploaders is higher than that of unsafe content uploaders as per Figure 3b, which could perhaps be due to the fact the unsafe content uploaders upload less videos as well. Finally, each uploader represented as a YouTube Channel is typically managed through a Google+ account whose network is studied in Figure 3c which shows that unsafe content uploaders have a lessor users in their network (circle) as compared to those spreading safe content which is in coherence with other popularity metrics studied.

B. Engagement Factors
To further understand the key distinguishing features that separates safe content uploaders from unsafe content uploaders, we study engagements. For capturing engagements three factors namely comments, likes and dislikes received on past videos posted by uploaders are compared in Figure 4.
Comments, likes and dislikes received on videos uploaded by the safe and unsafe content uploader are depicted in Figure  4a, Figure 4b and Figure 4c, respectively. In all of them the engagements received by safe content uploaders is higher than unsafe content promoters suggesting that users (who are typically kids) engage more with those spreading safe content.
VI. COMMUNITY DETECTION After having characterized the popularity and engagement of safe and unsafe content uploaders, in this section, we perform network based analysis to understand the underlying interconnected structures among the uploaders and commenters on YouTube spreading safe and unsafe content. The purpose is to detect communities among the safe and unsafe content promoters (both in respect to uploaders and commenters). These communities would help us in understanding whether safe content promoters are closely knit with the unsafe content promoters. If it is so then such community structures could end up driving kids moving (or viewing) from safe content promotion space to a space comprising of unsafe content promoters, as would be argued in this section later. Three ways of detecting such communities are explained next.

A. Video Network Analysis
In our first approach for detecting communities, related videos feature of YouTube is leveraged to find a list of videos that are suggested for an given input video. We use this feature to find video-video communities based on these suggested (related) videos by using YouTube API. 5 We construct a directed graph comprising of videos as nodes, in which a directed edge between two videos v i and v j is formed if v j is found to be related to v i . Algorithm 2 constructs the graph by taking the seed videos dataset as input. For each video, algorithm finds top 10 related videos. If the related video is from among the set of seed videos dataset, then an edge is added in the graph. Procedure update transitions counts all possible transitions (edges) between safe and unsafe videos in the graph. From the set of 408 seed videos given as input, it was found that there are 262 nodes and 630 edges formed between them. Algorithm 2 Video-Video-Community-Detect (V ) 1: V ← set of seed video dataset 2: for all v ∈ V do 3: G ← add node(v) 4: end for 5: th ← 10 6: for all v ∈ V do 7: v related ← f ind related videos(v, th) 8: for all v r ∈ v related do 9: if v r is a video in V then 10: G ← add edge(v, v r ) 11: update transitions(v, v r ) 12: end if 13: end for 14: end for 5 https://developers.google.com/youtube/v3/docs/search/list Community detection algorithm was run based on the work of Vincent et. al. [17] provided by Gephi. 6 A total of 31 communities with Louvain Modularity value of 0.807 were found indicating that communities are fairly well connected among themselves. Figure 5 depicts the four set of transitions among decent and indecent videos that we intend to capture through this video-video graph. Table V   The implication of this analysis is to suggest that while safe to unsafe transition is quite a rare (9 and 14 in video-video and uploader-uploader, respectively) phenomena, the unsafe to unsafe transition is quite prevalent in the case of video-video transition where it happens 117 times. This indicates that once a user (typically a child watching cartoons) moves from decent (safe) video space to indecent (unsafe) video space, he or she would remain in it due to video suggestions. The idea of videovideo transitions is extended to the uploaders as well and an uploader-uploader graph is constructed on similar lines and uploader-uploader transitions are also mentioned in Table V.

B. Uploader-Commenter Network Analysis
Besides being a platform for video sharing, users on YouTube post comments on videos. We leverage this engagement on YouTube to construct uploader-commenter undirected graph by considering seed uploaders and seed commenters as nodes (users). An edge between two users is formed if one user comments on video uploaded by another user. Due to lack of space, the algorithm for graph construction is not mentioned. In order to capture only the significant relationships among commenters and uploaders, we considered only those commenters who have posted at least 4 comments. With this change, algorithm resulted in a undirected graph comprising of 1942 nodes (of commenters and uploaders) and 2373 edges among them. Running community detection algorithm on Gephi resulted in 147 communities with Louvain Modularity value of 0.973 again indicating well connected communities in the graph. Such a graph between uploaders (safe and unsafe) and commenters (safe and unsafe) brings forth many interesting observations. One of them being that even though an uploader may be quite decent (safe) and has posted a decent (safe) video, the fact that a commenter posts an indecent (unsafe) comment, could effectively undermine the uploader's safe behavior.

C. Uploader-Commenter Behavioural Analysis
Commenters and uploaders are also connected with each other through various other forms of behaviour engagements.
Three types behavioural engagements studied are 'who likes whom', 'who subscribes whom' and 'who adds whom to playlist'. Communities among safe and unsafe content promoters (uploaders and commenters) formed through the manifestation of these behaviours are investigated. It may be noted here that YouTube API doesn't provide a direct function to find list of users who have liked a particular video nor can we find a list of users who have subscribed a particular user.
In order to find this information, we take a user as input and first find all the videos liked, all the other users subscribed and all the videos added in the playlist by this user. We then take these results and do a reverse lookup to find if any of these users and videos exist in our seed dataset in order to establish a behavioural relationship. The detailed procedure for this approach is not mentioned due to space considerations. With 275 seed uploaders and 19099 seed commenters, Tables VII, VIII and IX summarize the results of behavioural engagements among them based on likes, subscription and playlist.
1) Likes Network Community: Self likes of users (uploaders and commenters) refer to the likes made to videos uploaded by themselves. As evident from Table VII, 24 out of 275 uploaders (nearly 8%) like videos uploaded by other uploaders whereas only 604 commenters are connected out of 19098 commenters through likes. Among the others users (referred as 'Other Users' because these YouTube channel IDs neither belong to uploaders nor commenters in our dataset) whose videos are liked by uploaders and commenters, there are 262 common other users which are liked by both uploaders and commenters suggesting similar interest between them.
2) Subscriber Network Community: Subscribers are other YouTube channels that a user typically subscribes to on the basis on his or her interest. In this section, we collect and analyze all the subscribers (YouTube channels) subscribed by uploaders and commenters. Table VIII refers to the related data and statistics related to the 'who subscribes whom' graph and analysis around it follows next. There are no self-subscribers since self subscription would not make any sense. Around 10% of uploaders are connected with each other through subscriptions while only 617 out of 19098 of commenters are connected with each other. Commenters subscribe to more number of uploaders while uploaders subscribing to commenters is very rare.
3) Playlist Network Community: YouTube provides a feature of adding videos that a user would typically want to view occasionally and combine such videos into a playlist. Give a user (YouTube channel ID which is either uploader or commenter), we can obtain details of all the playlist of that user. Using this approach, playlists created by all the uploaders and commenters are collected and analyzed, Table IX presents a brief summary of the same. Among uploaders, most (757 out of 1068) of the connections are due to uploaders adding their own uploaded videos in their playlist. Adding videos of other uploaders and commenters in their playlist is rare. In contrast among commenters, very few (2148 out of 30148) videos uploaded by commenters are in their playlist, most of the videos from other users are in their playlist. Commenters  and uploaders adds videos from 67 common users belonging to category of the other users. 4) Combined Network Community: To understand a combined behavioural analysis contributed through likes, subscription and playlist, we constructed a graph comprising of all uploaders and commenters as nodes. An edge is established between the nodes if they are related either through likes, subscription or playlist. Figure 6 depicts one of the largest communities formed in this graph. Nodes in 'red' are the unsafe content promoters (either uploaders or commenters) and those in 'blue' are safe content promoters. One can clearly visualize closely knit communities among safe and unsafe content promoters. Since these communities are built on behaviours, it further reinforces the concern expressed earlier that a naive user (kid) watching content from a safe content promoter could easily move into the space of unsafe content promoters.

VII. CONCLUSION
In this work, we were able to successfully detect child unsafe content and its promoters on YouTube. Further, we characterized such promoters with other users in terms of popularity and engagement. Finally, we found close communities of child unsafe promoters with other users.