Faculty: Dr. Chengcui ZhangStudents: Wei-Bang Chen

Song Gao Richa Tiwari

Past projects

• Image Spam Clustering Project– Cluster image spam through common visual

features present in image attachments– Reveal common origins of image spam

examples

3

These two spam images exemplify illustrations with similar color composition but different layouts.

This example demonstrates illustrations in spam with similar layouts but different color composition.

• Ongoing projects:– Phishing website clustering by text and visual

similarity

Nat West Helpful BonkingAccessibility I HelpGot a question? We can help…

Nat West Helpful Bonking Help 24x7can’t I log in?Accessibility I Help…

RBSThQ Roy& Bank cq3codandMake it happen…

Text Recognized by OCR

A Sample Cluster for PayPal

4 Clusters Relate to PayPalCluster ID: 15 (76 Images) Cluster ID: 28 (20 Images) Cluster ID: 49 (13 Images) Cluster ID: 57 (22 Images)

Dataset Statistics• 8 Days (7-10,17-19 & 22 Feb., 2011)• Total number of phishing website screen-shot images:

1461• Total number of produced clusters (cutoff similarity value = 60%):

156 + 1(ungrouped)

2 3 4 5 6 7 8 9 10 11 13 15 17 18 20 21 22 28 29 32 34 38 42 76 1160

5

10

15

20

25

30

35

40

45

50

Cluster Size (Number of Images)

Coun

t (N

umbe

r of C

lust

ers)

• Observations: high cluster purity• Hard to measure completeness• Next step:– Incorporate visual features such as visual layout – Brand

• Ongoing projects: – Uncovering auction fraud from eBay transaction

graph - Initial study

• Data set: eBay transaction feedbacks– A total of 220,000 (two-hundred and twenty

thousand) users are crawled.• Idea of belief propagation: – Fraudsters create two types of identities - fraud and accomplice, where fraud identities are the ones used eventually to carry out the actual fraud, and the accomplice identities are the ones used to help build the reputation for the fraud identities. This pattern forms a near bipartite core in the transaction graph.

• Algorithm:– Each vertex in the transaction graph is labeled by

one of {fraud, accomplice, honest} based on their pattern of interaction with other vertexes.

– Belief propagation (BP) is used to optimize the labeling across the entire graph by maximizing the joint probabilities of all the vertexes.

– Honest user model: Barabasi-Albert model

• Evaluation results on the sparse eBay transaction dataset– 20% accomplice– 50% fraud???

• What can be improved:– Network too sparse (average degree is ~5, ideally

>=10)– Initial probabilities (1/3, 1/3, 1/3) may not make

sense.– BP seems not to scale well with large graphs.

• Projects under plan:– Modeling online user navigation patterns and

detecting anomalies using click stream data

• Idea #1: Each user session is represented by an n-dimensional feature vector, where n is the number of Web pages in the session.– The value of each feature is a weight, indicating

the degree of interest of the user in the particular Web page.

– Based on these vectors, clusters of similar sessions are produced and characterized by the Web pages with the highest associated weights.

• Idea #2: Markov Model– Pages (or page categories) as states

• Or page+parameters as nodes

– Transition probabilities between nodes• Idea #3: Graph partitioning– Pages as nodes– Edges as connectivity/weight between a pair of pages

• Co-occurrence, time difference, etc.

– Graph partitioning to find groups of strongly correlated pages

• Projects under plan:– Novel biometrics

• Palm print photo

• Touch panel: handdrawing