Composite Behavioral Modeling for Identity Theft Detection in Online Social Networks

TL;DR

This paper introduces a joint behavioral model leveraging multi-dimensional online and offline data to improve real-time online identity theft detection in social networks, demonstrating superior accuracy and low latency.

Contribution

It proposes a novel joint model that captures complementary online and offline user behaviors for enhanced identity theft detection in social networks.

Findings

Achieves high AUC scores of 0.956 and 0.947 on Foursquare and Yelp datasets.

Reaches up to 72.2% recall with less than 1% false positive rate.

Maintains low response latency by analyzing only one composite behavior per authentication.

Abstract

In this work, we aim at building a bridge from poor behavioral data to an effective, quick-response, and robust behavior model for online identity theft detection. We concentrate on this issue in online social networks (OSNs) where users usually have composite behavioral records, consisting of multi-dimensional low-quality data, e.g., offline check-ins and online user generated content (UGC). As an insightful result, we find that there is a complementary effect among different dimensions of records for modeling users' behavioral patterns. To deeply exploit such a complementary effect, we propose a joint model to capture both online and offline features of a user's composite behavior. We evaluate the proposed joint model by comparing with some typical models on two real-world datasets: Foursquare and Yelp. In the widely-used setting of theft simulation (simulating thefts via behavioral replacement), the experimental results show that our model outperforms the existing ones, with the AUC values $0.956$ in Foursquare and $0.947$ in Yelp, respectively. Particularly, the recall (True Positive Rate) can reach up to $65.3\%$ in Foursquare and $72.2\%$ in Yelp with the corresponding disturbance rate (False Positive Rate) below $1\%$. It is worth mentioning that these performances can be achieved by examining only one composite behavior (visiting a place and posting a tip online simultaneously) per authentication, which guarantees the low response latency of our method. This study would give the cybersecurity community new insights into whether and how a real-time online identity authentication can be improved via modeling users' composite behavioral patterns.