# Spotting Suspicious Link Behavior with fBox: An Adversarial Perspective

arXiv: https://arxiv.org/abs/1410.3915 · HTML: https://mlsanity.com/paper/1410.3915/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Oct 2014.

## Built on by (most cited first, 6 of 6)

- [A Comprehensive Survey on Graph Anomaly Detection with Deep Learning](https://mlsanity.com/paper/2106.07178/) (2021)
- [Graph Data Augmentation for Graph Machine Learning: A Survey](https://mlsanity.com/paper/2202.08871/) (2022)
- [Graph Mining for Cybersecurity: A Survey](https://mlsanity.com/paper/2304.00485/) (2023)
- [Anomaly Detection in Graph Structured Data: A Survey](https://mlsanity.com/paper/2405.06172/) (2024)
- [Anomaly Mining -- Past, Present and Future](https://mlsanity.com/paper/2105.10077/) (2021)
- [Multi-scale Anomaly Detection for Big Time Series of Industrial Sensors](https://mlsanity.com/paper/2204.08159/) (2022)

## Abstract (arXiv)

How can we detect suspicious users in large online networks? Online popularity of a user or product (via follows, page-likes, etc.) can be monetized on the premise of higher ad click-through rates or increased sales. Web services and social networks which incentivize popularity thus suffer from a major problem of fake connections from link fraudsters looking to make a quick buck. Typical methods of catching this suspicious behavior use spectral techniques to spot large groups of often blatantly fraudulent (but sometimes honest) users. However, small-scale, stealthy attacks may go unnoticed due to the nature of low-rank eigenanalysis used in practice. In this work, we take an adversarial approach to find and prove claims about the weaknesses of modern, state-of-the-art spectral methods and propose fBox, an algorithm designed to catch small-scale, stealth attacks that slip below the radar. Our algorithm has the following desirable properties: (a) it has theoretical underpinnings, (b) it is shown to be highly effective on real data and (c) it is scalable (linear on the input size). We evaluate fBox on a large, public 41.7 million node, 1.5 billion edge who-follows-whom social graph from Twitter in 2010 and with high precision identify many suspicious accounts which have persisted without suspension even to this day.