Using Overlapping Methods to Counter Adversaries in Community Detection

TL;DR

This paper investigates how overlapping community detection methods can be more robust against adversarial attacks in large graphs, especially when attackers aim to hide specific nodes, and formulates this as a Stackelberg game.

Contribution

It introduces an analytic framework modeling the interaction between community detection and adversarial attacks, demonstrating the superiority of overlapping methods under attack scenarios.

Findings

Overlapping methods outperform non-overlapping ones under attack.

Robustness increases with attacker budget and capability.

Framework allows incorporation of new attacks and detection methods.

Abstract

When dealing with large graphs, community detection is a useful data triage tool that can identify subsets of the network that a data analyst should investigate. In an adversarial scenario, the graph may be manipulated to avoid scrutiny of certain nodes by the analyst. Robustness to such behavior is an important consideration for data analysts in high-stakes scenarios such as cyber defense and counterterrorism. In this paper, we evaluate the use of overlapping community detection methods in the presence of adversarial attacks aimed at lowering the priority of a specific vertex. We formulate the data analyst's choice as a Stackelberg game in which the analyst chooses a community detection method and the attacker chooses an attack strategy in response. Applying various attacks from the literature to seven real network datasets, we find that, when the attacker has a sufficient budget, overlapping community detection methods outperform non-overlapping methods, often overwhelmingly so. This is the case when the attacker can only add edges that connect to the target and when the capability is added to add edges between neighbors of the target. We also analyze the tradeoff between robustness in the presence of an attack and performance when there is no attack. Our extensible analytic framework enables network data analysts to take these considerations into account and incorporate new attacks and community detection methods as they are developed.