simone1977
Regular Member
- Mar 23, 2022
- 305
- 121
Key account parameters used by Facebook
Account age: A young account can be more prone to abuse.
Number of friends: Some bots may have an unusually large number of friends.
Account Location: Accounts registered in certain regions may be more prone to abuse.
Analysis of an account's behavior on a social network, such as how often the account posts, comments or likes other users' posts.
Interaction network analysis: Facebook analyzes who an account interacts with on the social network and identifies unusual networks of connections between accounts.
The operating system of the device from which the account was registered.
Information about the IP addresses from which the account was registered.
Group Membership: Accounts that belong to certain groups may be more prone to abuse.
Analysis of content posted on account pages.
Analysis of activity on the site as a whole, such as how much time the user spends on the site, what pages they view, etc.
Aggregating features such as the average number of groups per friend or the percentage of accounts in a particular region can help reveal patterns associated with account abuse.
Full transcript of the speech
Thank you all. My name is Sarah Kodir and I am a software engineer at Facebook. I'm working on the Deep Entity Classification (DEC) model, which is one of our main models for detecting malicious accounts. Unfortunately, there are people who benefit both financially and personally by engaging in harmful activities. For example, they will spam, deceive people, distribute malware, and worst of all, exploit children and spread terrorism. But to do this, you need a fake account.
To understand the extent of the problem, let's take a look at our Q1 2019 report. We removed 2.2 billion fake accounts in the first three months of 2019. And while that's a huge number, we still estimate that around 5% of our monthly active users are fake. This is a fight we have been waging for many years. We delete them and they come back with even more volume and we delete them again. This is an endless game of cat and mouse.
So what are the approaches to solve this problem? We can ask people to view accounts. But on Facebook, we have a complex system for ensuring the quality of markup. But on such a huge platform, where tens of millions of users sign up every day and there are billions of existing accounts, it's impossible to quickly view all of these accounts manually. Another approach is to write manual rules to detect attacks. But in this case, we have to write thousands of rules, and attackers can respond to them quickly, perhaps even faster than we can write them.
Given the nature of the problem, the obvious solution is to use machine learning. Let's see how we would traditionally approach this from a machine learning perspective. First, we'll compile a number of characteristics, such as the age of the account, the number of friends it has, or its location. Then we will connect these signs with a label whether this account is malicious or not. We will then take this training data and feed it into a model, such as gradient-increasing decision trees or a neural network. The output of this model is whether this account is malicious or not?
While machine learning is a great solution, we still have some problems. Let's say we're doing some research and realize that the younger the account, the more malicious it is likely to be. We create a new feature, account age, and insert it into our classifier. So let's implement a classifier. Malefactors begin to realize that their accounts are blocked. And they just age their accounts before they start abusing. And in this way they can bypass our systems. However, Deck can handle it. We not only mine direct attributes of an account, but we also mine and aggregate attributes for other accounts it interacts with. This allows us not only to model the account itself, but also its behavior across the social network.
Another problem with traditional machine learning is that the number of features humans can write is usually limited. When we have a small number of signs, it is much easier for attackers to figure out what exactly these signs are. However, Deck is recursive in nature and we get tens of thousands of features for every single account. This is much more difficult for attackers to understand.
Another problem is getting a lot of tags from people. As we have seen in the report
Account age: A young account can be more prone to abuse.
Number of friends: Some bots may have an unusually large number of friends.
Account Location: Accounts registered in certain regions may be more prone to abuse.
Analysis of an account's behavior on a social network, such as how often the account posts, comments or likes other users' posts.
Interaction network analysis: Facebook analyzes who an account interacts with on the social network and identifies unusual networks of connections between accounts.
The operating system of the device from which the account was registered.
Information about the IP addresses from which the account was registered.
Group Membership: Accounts that belong to certain groups may be more prone to abuse.
Analysis of content posted on account pages.
Analysis of activity on the site as a whole, such as how much time the user spends on the site, what pages they view, etc.
Aggregating features such as the average number of groups per friend or the percentage of accounts in a particular region can help reveal patterns associated with account abuse.
Full transcript of the speech
Thank you all. My name is Sarah Kodir and I am a software engineer at Facebook. I'm working on the Deep Entity Classification (DEC) model, which is one of our main models for detecting malicious accounts. Unfortunately, there are people who benefit both financially and personally by engaging in harmful activities. For example, they will spam, deceive people, distribute malware, and worst of all, exploit children and spread terrorism. But to do this, you need a fake account.
To understand the extent of the problem, let's take a look at our Q1 2019 report. We removed 2.2 billion fake accounts in the first three months of 2019. And while that's a huge number, we still estimate that around 5% of our monthly active users are fake. This is a fight we have been waging for many years. We delete them and they come back with even more volume and we delete them again. This is an endless game of cat and mouse.
So what are the approaches to solve this problem? We can ask people to view accounts. But on Facebook, we have a complex system for ensuring the quality of markup. But on such a huge platform, where tens of millions of users sign up every day and there are billions of existing accounts, it's impossible to quickly view all of these accounts manually. Another approach is to write manual rules to detect attacks. But in this case, we have to write thousands of rules, and attackers can respond to them quickly, perhaps even faster than we can write them.
Given the nature of the problem, the obvious solution is to use machine learning. Let's see how we would traditionally approach this from a machine learning perspective. First, we'll compile a number of characteristics, such as the age of the account, the number of friends it has, or its location. Then we will connect these signs with a label whether this account is malicious or not. We will then take this training data and feed it into a model, such as gradient-increasing decision trees or a neural network. The output of this model is whether this account is malicious or not?
While machine learning is a great solution, we still have some problems. Let's say we're doing some research and realize that the younger the account, the more malicious it is likely to be. We create a new feature, account age, and insert it into our classifier. So let's implement a classifier. Malefactors begin to realize that their accounts are blocked. And they just age their accounts before they start abusing. And in this way they can bypass our systems. However, Deck can handle it. We not only mine direct attributes of an account, but we also mine and aggregate attributes for other accounts it interacts with. This allows us not only to model the account itself, but also its behavior across the social network.
Another problem with traditional machine learning is that the number of features humans can write is usually limited. When we have a small number of signs, it is much easier for attackers to figure out what exactly these signs are. However, Deck is recursive in nature and we get tens of thousands of features for every single account. This is much more difficult for attackers to understand.
Another problem is getting a lot of tags from people. As we have seen in the report