Pith. sign in

REVIEW 4 major objections 4 minor 48 references

SliceNDice: Mining Suspicious Multi-attribute Entity Groups with Multi-view Graphs

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that suspicious groups in multi-attribute data can be found by scoring how unlikely a group's shared attribute mass is under a multi-view random-graph null model, and that the SliceNDice algorithm mines such groups at…

desk verdict SliceNDice is a real, well-engineered contribution to multi-view suspicious-group mining with a production case study, but the headline 89% precision does not establish the unsupervised claim because legitimate synchronized organizations were pruned before evaluation. read the letter →

arxiv 1908.07087 v3 pith:YY3ZJCEJ submitted 2019-08-19 cs.SI cs.IRcs.LG

Hamed Nilforoshan , Neil Shah This is my paper · ORCID
classification cs.SIcs.IRcs.LG
keywords multi-viewgraphssuspiciousgroupmininganomalydetectionfraudunsupervisedlearningdensesubgraphdiscoveryattributeddata
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out a single unsupervised framework for finding groups of entities that look coordinated because they share too many attribute values across several attributes at once. It models the data as a multi-view graph, where each view encodes similarity under one attribute, and defines suspiciousness as the negative log-likelihood of a group's observed edge-mass under a multi-view random graph model with independent exponential edge weights. The SliceNDice algorithm then greedily expands promising seeds through alternating node and view updates, letting practitioners pull ranked suspicious groups out of large attributed datasets without labels. The payoff, if correct, is one pipeline that can surface sybil accounts, payment scams, and fake engagement by the same mechanism, with reported 89% precision on Snapchat's advertiser ecosystem and over 97% precision/recall in simulated settings.

What carries the argument

The load-bearing object is the Multi-View Erdős-Rényi-Exponential null model together with the negative-log-likelihood score derived from it. The model treats each view's pairwise similarities as independent exponential draws, which gives a closed-form MLE $\lambda_i = P_i^{-1}$ and turns the mass of any candidate group into a Gamma-distributed random variable; the score then ranks groups by how improbable their mass is, preferring larger, denser, rarer-view groups. The same probability framework supplies the axioms and their proofs, and the greedy seed-and-expand procedure in SliceNDice is designed around maximizing this score.

What would settle it

Run SliceNDice on a dataset that contains legitimate synchronized cohorts (e.g., employees of one company sharing log-in IPs, zip codes, and campaign names) alongside planted fraud rings, without pre-pruning the benign cohorts; if a large fraction of the top-ranked groups are the benign cohorts, the i.i.d. exponential null is not a valid baseline for that data.

Watch

Extended reading notes

Core claim

The central claim is that group-level suspiciousness in multi-attribute data reduces to a likelihood computation under the Multi-View Erdős-Rényi-Exponential (MVERE) model: in each view $G_i$, edge weights are i.i.d. $\mathrm{Exp}(\lambda_i)$ with $\lambda_i = V/C_i = P_i^{-1}$, so the mass $c_i$ of an $n$-node subgraph in view $i$ follows $\mathrm{Gamma}(v, P_i^{-1})$ with $v = n(n-1)/2$. The suspiciousness score is $f(n,\vec{c},N,\vec{C}) = -\log \prod_i \Pr(M_i = c_i)$, and the paper proves that this score satisfies five desiderata (mass, size, contrast, concentration, cross-view distribution) that prior single-view or discrete metrics violate. SliceNDice mines groups by seeding small cohesive node/view sets and alternating greedy updates of nodes and views until suspiciousness converges, with TF-IDF-style inverse-entity-frequency edge weights and a compressed hashmap representation enabling linear-time mass updates. On production data from Snapchat's advertiser platform with 230K organizations and 12 attributes, the top-50 discovered groups yielded 89% precision over 2,736 organizations and uncovered diverse fraud rings; on simulated attacks it achieved over 97% precision/recall, dramatically outperforming baselines.

Load-bearing premise

The whole score rests on the assumption that within each attribute view every pair of entities' similarity weight is an independent draw from the same exponential distribution, so any legitimate group that shares attributes en masse—an ad agency, an affiliate network—is scored as suspicious unless it is removed from the data beforehand.

Editorial extensions

If this is right

  • A single unsupervised pipeline can surface diverse abuse types — sybil accounts, e-commerce fraud, fake engagement — without labels, because they all manifest as synchronized attribute sharing.
  • Practitioners can rank candidate groups by suspiciousness and prioritize manual review; the Snapchat deployment reports 89% precision over the top 50 groups.
  • The method scales linearly in the number of entities and iterations, making it usable at platform scale without materializing dense tensors.
  • Because the metric satisfies the five axioms, groups of different sizes, masses, and view compositions can be compared on one scale, which aggregate mass or density cannot do.
  • Stealthy fraud that keeps each shared value rare can still be detected by combining evidence across z views.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • This implies that a deployment must be paired with allowlists or pre-filtering for legitimately synchronized populations, since under the MVERE null model an ad agency or affiliate network is scored as suspicious by construction; the paper itself prunes 1.7K such organizations before evaluation.
  • The likelihood machinery is not tied to the exponential: replacing the null with heavy-tailed or view-dependent distributions, or modeling dependence between views, would keep the greedy mining framework and yield calibrated scores for different abuse patterns.
  • One testable extension is to apply the same pipeline to labeled fraud datasets on other platforms and compare it to supervised detectors; the paper's simulation results suggest the gain should be largest when attacks spread their signal over many rare attributes.
  • A caveat with the 89% precision figure is that it reflects one base rate of fraud among the top-ranked groups; on cleaner or dirtier platforms the same ranking scheme will show different precision even if the metric is correct.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes SliceNDice, an unsupervised method for detecting suspicious groups of entities that share attribute values across multiple views. The authors model multi-attribute data as a multi-view graph, define a suspiciousness score based on a Multi-View Erdős–Rényi Exponential (MVERE) null model, prove that the score satisfies five intuitive axioms, and present a greedy alternating-maximization algorithm with seed expansion. They evaluate the method on a Snapchat advertiser dataset, reporting 89% precision on manually reviewed top-ranked groups, and on synthetic attack settings, reporting over 97% precision/recall against several baselines. The paper also claims linear scalability and releases source code. The central claim is that a single unsupervised pipeline can discover fraud rings across abuse types by ranking groups according to how unlikely their multi-view mass is under the MVERE null model.

Significance. If the central claim holds, the paper contributes a useful and practical formulation: multi-attribute suspicious group detection as multi-view graph mining, with a principled suspiciousness metric and a scalable mining algorithm. The axiomatic framing is valuable, the production deployment on a large advertiser platform is a strength, and the release of source code and simulation code supports reproducibility. The evaluation on real data, however, currently does not support the unsupervised, abuse-agnostic claim because legitimate synchronized organizations were pruned before evaluation, and the synthetic experiments do not include benign synchronized cohorts. The MVERE model also has an internal inconsistency with zero-weight non-edges. These issues are load-bearing for the advertised contributions, though they appear fixable through model clarification and a more careful evaluation narrative.

major comments (4)
  1. [Section VI-A, real-data evaluation] The MVERE model defines w_i^{(a,b)} ~ Exp(λ_i) for all edges, but Section III-A constructs the graph with w_i^{(a,b)} = 0 for non-edges (attribute-value disjointness). A continuous Exponential draw has probability zero of being exactly zero, so the observed sparse graph is not a realization of the stated model. Consequently, the Gamma mass in Lemma 1 is not the likelihood of the observed weighted graph, and f is not literally a negative log-likelihood under MVERE. The paper should either introduce a zero-inflated model, restrict the Exponential assumption to positive-weight edges with a separate treatment of edge absence, or explicitly state that MVERE is a heuristic null model rather than a generative model for the observed graph. This is load-bearing because the metric's statistical interpretation underpins the axioms and the ranking.
  2. [Section VI-A, simulated settings] The central unsupervised claim is not supported by the 89% precision figure. The paper states that 1.7K organizations were pruned from the original 230K before evaluation, 'primarily including advertisement agencies and known affiliate networks which can have high levels of synchrony.' These are precisely the legitimate populations that an unsupervised detector must rank below fraudulent rings, so the precision number is measured after a domain-expert pre-filter. In addition, precision is reported only on the top 50 of 6,050 discovered groups, with no real-data recall or evaluation of the remaining groups. The authors should either report performance without the pruning, evaluate the pruned organizations separately, or substantially reframe the real-data result as a semi-supervised/domain-filtered case study rather than evidence for an unsupervised, abuse-agnostic detector.
  3. [Section VIII-A, Axiom 5 proof] The synthetic experiments do not test the key discrimination between fraudulent lockstep and benign lockstep. Normal entities are generated by independent Poisson draws over attribute values, so no legitimate cohort with en-masse attribute sharing exists in the simulated data. The reported over-97% precision/recall therefore only shows that SliceNDice can find injected attacks against an unstructured background; it does not show that the method separates fraud from legitimate synchronized organizations. The simulation generator should include a benign synchronized population (e.g., affiliate networks or agencies) to make the synthetic results relevant to the unsupervised claim.
  4. [Section VIII-A] The proof of Axiom 5 (Cross-view Distribution) is incomplete. The axiom requires showing that transferring a finite amount of mass M from a denser view j to a sparser view i increases f, i.e., f_i(M)+f_j(m) > f_i(m)+f_j(M). The proof instead compares derivatives at the point c_i = c_j and concludes that infinitesimal mass additions are more beneficial in the sparser view. Since the derivative difference ∂f_i/∂c_i - ∂f_j/∂c_j = 1/P_i - 1/P_j is constant in c, a short integration argument would repair the proof, but as written the finite-transfer inequality is not established.
minor comments (4)
  1. [Section IV] In the expanded formula for f, the second line has a sign inconsistency: the term is written as '- V c_i / C_i' but the following line and the subsequent derivative in the Axiom 1 proof use '+ V c_i / C_i'. The sign should be corrected throughout.
  2. [Section VIII-A] The intermediate equality '∂f_i/∂P_i = v log P_i + v ρ_i/P_i' is not a derivative; the correct derivative is v/P_i - v ρ_i/P_i^2. The final result is correct, but the displayed chain of equalities is erroneous.
  3. [Section VIII-A] The sentence 'x - log x > 1 always holds when x > 1 (which holds given ρ_i > ρ_i)' should read 'ρ_i > P_i'.
  4. [Section VI] There are several typos: 'deigned' should be 'designed' (Section VI-A), 'reasonS' should be 'reasons' (Section VI-B), and Algorithm 2 contains 't ¡ 20' which should be 't < 20'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the MVERE suspiciousness score is derived from an explicit null model and is not equivalent to its own inputs.

full rationale

The central derivation chain is self-contained. Definition 1 posits w_i(a,b) ~ Exp(lambda_i) as an explicit multi-view null model, the closed-form MLE lambda_i = V/C_i is computed from the graph's total mass, Lemma 1 derives the subgraph mass distribution as Gamma(v, P_i^{-1}), and Definition 2 defines f as the negative log-likelihood of the observed subgraph mass under that Gamma. No equation in this chain is defined in terms of the output MVSGs; the score is a likelihood under a stated model, and the greedy algorithm merely optimizes that score. The axioms in Section III-B are stated as independent desiderata, and their satisfaction by f is proved in Section VIII rather than assumed. The self-citations in the introduction ([10], [11]) motivate the lockstep premise but are not used to derive the metric, and no uniqueness theorem or ansatz is imported from the authors' prior work. The comparisons use external or non-author-overlapping baselines such as CSSusp, Mzoom, PARAFAC, MAF, SVD, and AvgDeg, and the simulated benchmarks provide independent evaluation. The pruning of 1.7K legitimate organizations in Section VI-A is an evaluation-protocol issue that may affect external validity, but it is not a circular reduction of the suspiciousness score to its inputs. No fitted parameter is renamed as a prediction, and no load-bearing argument reduces to a self-citation. Therefore the paper's derivation is not circular.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a statistical null model and on hand-chosen operating constants (z, q, eta, IEF exponent). No new physical entities are introduced. The MLE rate lambda_i is estimated from the data itself but is a standard statistical quantity, so it is not listed as a free parameter. The MVERE model is a mathematical construction, not an entity with an independent falsifiable handle.

free parameters (4)
  • z (view count constraint) = 3
    The number of views per mined group is fixed to z=3 based on Ad Review team input and interpretability; the metric and algorithm require this user-set constant (Sections III-C, VI-B).
  • q (view-sampling percentile) = >=95
    Seeding samples views with weights from the inverse of the qth frequency percentile; q>=95 is chosen as 'works well in practice' (Section V).
  • eta (Jaccard redundancy threshold) = 0.05
    Redundant MVSGs covering the same nodes are pruned using Jaccard similarity threshold eta=0.05; the value is chosen conservatively to minimize redundancy (Section VI-B).
  • IEF weighting exponent = 2
    Edge weights use ief(v) = (N / log(1 + |A^-1(v)|))^2; the exponent is a design choice in the weighting scheme that changes the metric's behavior (Section V-A).
assumptions (5)
  • domain assumption MVERE null model: within each view, edge weights are i.i.d. Exponential(lambda_i) with rate lambda_i = V/C_i estimated from the global view density; zero-weight non-edge cells are treated as draws from this continuous model.
    Defines the probability model from which suspiciousness is computed as negative log-likelihood; it is not a generative model of real attributed data, where missing edges are exactly zero and legitimate groups can share attributes (Section IV, Definition 1).
  • domain assumption Independence across K views.
    f factorizes as a product over views; the paper acknowledges this independence assumption and does not model inter-attribute dependencies (Section IV).
  • domain assumption Axioms 1-5 are the correct desiderata for suspiciousness.
    The metric is designed to satisfy these axioms; if the axioms mis-specify practitioner intuition, the metric optimizes the wrong objective (Section III-B).
  • standard math Global view density P_i is a sufficient null statistic, and the MLE lambda_i = V/C_i is valid.
    Closed-form MLE of the Exponential rate under the i.i.d. assumption is a standard derivation (Section IV, Lemma 1).
  • standard math Stirling approximation log Gamma(v) approx v log v - v.
    Used to simplify the metric expression; ignores lower-order terms for finite v (Section IV).

how reviews work

0 comments
Cite this review

Pith. "Pith review of SliceNDice: Mining Suspicious Multi-attribute Entity Groups with Multi-view Graphs." pith.science (2026). https://pith.science/paper/YY3ZJCEJ

@misc{pith2026190807087,
  author       = {Pith},
  title        = {Pith review of: SliceNDice: Mining Suspicious Multi-attribute Entity Groups with Multi-view Graphs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YY3ZJCEJ}},
  note         = {Machine review of arXiv:1908.07087}
}
read the original abstract

Given the reach of web platforms, bad actors have considerable incentives to manipulate and defraud users at the expense of platform integrity. This has spurred research in numerous suspicious behavior detection tasks, including detection of sybil accounts, false information, and payment scams/fraud. In this paper, we draw the insight that many such initiatives can be tackled in a common framework by posing a detection task which seeks to find groups of entities which share too many properties with one another across multiple attributes (sybil accounts created at the same time and location, propaganda spreaders broadcasting articles with the same rhetoric and with similar reshares, etc.) Our work makes four core contributions: Firstly, we posit a novel formulation of this task as a multi-view graph mining problem, in which distinct views reflect distinct attribute similarities across entities, and contextual similarity and attribute importance are respected. Secondly, we propose a novel suspiciousness metric for scoring entity groups given the abnormality of their synchronicity across multiple views, which obeys intuitive desiderata that existing metrics do not. Finally, we propose the SliceNDice algorithm which enables efficient extraction of highly suspicious entity groups, and demonstrate its practicality in production, in terms of strong detection performance and discoveries on Snapchat's large advertiser ecosystem (89% precision and numerous discoveries of real fraud rings), marked outperformance of baselines (over 97% precision/recall in simulated settings) and linear scalability.

Figures

Figures reproduced from arXiv: 1908.07087 by the authors.

Figure 1
Figure 1. Our work tackles suspicious behavior detection in multi-attribute entity data using a multi-view graph mining formulation, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of Axioms 1-5 through toy examples. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. SLICENDICE detects both blatant (left) and more stealthy (right) fraudsters on Snapchat’s ad platform. Attribute Views in each Legend are sorted by suspiciousness (Red = Highest, Purple = Lowest). Unless otherwise mentioned, for each scenario we fix param￾eters as N = 500 nodes, K = 10 views, ui = 50i attr. cardinality, n = 50 nodes per attack, k = 3 views per attack, λ = 5 mean values drawn per node and attribute, … view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: SLICENDICE (blue, near the top) consistently achieves extremely high precision/recall on various, realistic attack settings, despite changing attack complexity. Other methods fail due to their inability to respect differences between attributes/views and overemphasis o…
Figure 5
Figure 5. Figure 5: Our GREEDYSEED finds suitable seeds 100 − 1000× faster than random seeding (a). Moreover, SLICENDICE scales linearly in number of entities (b) and iterations (c). on the proposed MVERE model which satisfies these met￾rics, unlike alternatives. Next, we proposed the SLI…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 45 canonical work pages

  1. [1]

    Trafficking fraudulent accounts: The role of the underground market in twitter spam and abuse

    K. Thomas, D. McCoy, C. Grier, A. Kolcz, and V . Paxson, “Trafficking fraudulent accounts: The role of the underground market in twitter spam and abuse.” in USENIX Security, 2013, pp. 195–210

    work page 2013

  2. [2]

    Cyberbullying: Its nature and impact in secondary school pupils,

    P. K. Smith, J. Mahdavi, M. Carvalho, S. Fisher, S. Russell, and N. Tippett, “Cyberbullying: Its nature and impact in secondary school pupils,” J. of Child Psych. , vol. 49, no. 4, pp. 376–385, 2008

    work page 2008

  3. [3]

    Social bots distort the 2016 us presidential election online discussion,

    A. Bessi and E. Ferrara, “Social bots distort the 2016 us presidential election online discussion,” 2016

    work page 2016

  4. [4]

    Leveraging quality prediction models for automatic writing feedback,

    H. Nilforoshan and E. Wu, “Leveraging quality prediction models for automatic writing feedback,” in Twelfth International AAAI Conference on Web and Social Media , 2018

    work page 2018

  5. [5]

    Uncovering large groups of active malicious accounts in online social networks,

    Q. Cao, X. Yang, J. Yu, and C. Palow, “Uncovering large groups of active malicious accounts in online social networks,” in CCS. ACM, 2014, pp. 477–488

    work page 2014

  6. [6]

    Detecting clusters of fake accounts in online social networks,

    C. Xiao, D. M. Freeman, and T. Hwa, “Detecting clusters of fake accounts in online social networks,” in WAIS. ACM, 2015, pp. 91– 101

    work page 2015

  7. [7]

    Spotting suspicious link behavior with fbox,

    N. Shah, A. Beutel, B. Gallagher, and C. Faloutsos, “Spotting suspicious link behavior with fbox,” in ICDM. IEEE, 2014, pp. 959–964

    work page 2014

  8. [8]

    Catchsync: Catching synchronized behavior in large directed graphs,

    M. Jiang, P. Cui, A. Beutel, C. Faloutsos, and S. Yang, “Catchsync: Catching synchronized behavior in large directed graphs,” 2014

    work page 2014

Show all 48 references
  1. [9]

    Polonium: Tera-scale graph mining and inference for malware detec- tion,

    D. H. P. Chau, C. Nachenberg, J. Wilhelm, A. Wright, and C. Faloutsos, “Polonium: Tera-scale graph mining and inference for malware detec- tion,” in SDM. SIAM, 2011, pp. 131–142

    2011

  2. [10]

    False information on web and social media: A survey,

    S. Kumar and N. Shah, “False information on web and social media: A survey,” arXiv preprint arXiv:1804.08559 , 2018

    2018 arXiv

  3. [11]

    The many faces of link fraud,

    N. Shah, H. Lamba, A. Beutel, and C. Faloutsos, “The many faces of link fraud,” in ICDM. IEEE, 2017, pp. 1069–1074

    2017

  4. [12]

    Eigenspokes: Surprising patterns and scalable community chipping in large graphs,

    B. A. Prakash, A. Sridharan, M. Seshadri, S. Machiraju, and C. Falout- sos, “Eigenspokes: Surprising patterns and scalable community chipping in large graphs,” in PAKDD. Springer, 2010, pp. 435–448

    2010

  5. [13]

    Inferring lockstep behavior from connectivity pattern in large graphs,

    M. Jiang, P. Cui, A. Beutel, C. Faloutsos, and S. Yang, “Inferring lockstep behavior from connectivity pattern in large graphs,” PAKDD, vol. 48, no. 2, pp. 399–428, 2016

    2016

  6. [14]

    Greedy approximation algorithms for finding dense com- ponents in a graph,

    M. Charikar, “Greedy approximation algorithms for finding dense com- ponents in a graph,” in APPROX. Springer, 2000, pp. 84–95

    2000

  7. [15]

    Fraudar: Bounding graph fraud in the face of camouflage,

    B. Hooi, H. A. Song, A. Beutel, N. Shah, K. Shin, and C. Faloutsos, “Fraudar: Bounding graph fraud in the face of camouflage,” in KDD. ACM, 2016, pp. 895–904

    2016

  8. [16]

    Fast unfolding of communities in large networks,

    V . D. Blondel, J.-L. Guillaume, R. Lambiotte, and E. Lefebvre, “Fast unfolding of communities in large networks,” JSM, vol. 2008, no. 10, p. P10008, 2008

    2008

  9. [17]

    Fully automatic cross-associations,

    D. Chakrabarti, S. Papadimitriou, D. S. Modha, and C. Faloutsos, “Fully automatic cross-associations,” in KDD. ACM, 2004, pp. 79–88

    2004

  10. [18]

    Information-theoretic co- clustering,

    I. S. Dhillon, S. Mallela, and D. S. Modha, “Information-theoretic co- clustering,” in KDD. ACM, 2003, pp. 89–98

    2003

  11. [19]

    Description-oriented com- munity detection using exhaustive subgroup discovery,

    M. Atzmueller, S. Doerfel, and F. Mitzlaff, “Description-oriented com- munity detection using exhaustive subgroup discovery,” Information Sciences, vol. 329, pp. 965–984, 2016

    2016

  12. [20]

    Efficient descriptive community min- ing,

    M. Atzmueller and F. Mitzlaff, “Efficient descriptive community min- ing,” in Twenty-Fourth International FLAIRS Conference, 2011

    2011

  13. [21]

    Community detection in multi-layer graphs: A survey,

    J. Kim and J.-G. Lee, “Community detection in multi-layer graphs: A survey,” SIGMOD, vol. 44, no. 3, pp. 37–48, 2015

    2015

  14. [22]

    Malspot: Multi 2 malicious network behavior patterns analysis,

    H.-H. Mao, C.-J. Wu, E. E. Papalexakis, C. Faloutsos, K.-C. Lee, and T.-C. Kao, “Malspot: Multi 2 malicious network behavior patterns analysis,” in PAKDD. Springer, 2014, pp. 1–14

    2014

  15. [23]

    Spotting suspicious behaviors in multimodal data: A general metric and algorithms,

    M. Jiang, A. Beutel, P. Cui, B. Hooi, S. Yang, and C. Faloutsos, “Spotting suspicious behaviors in multimodal data: A general metric and algorithms,” TKDE, vol. 28, no. 8, pp. 2187–2200, 2016

    2016

  16. [24]

    Copy- catch: stopping group attacks by spotting lockstep behavior in social networks,

    A. Beutel, W. Xu, V . Guruswami, C. Palow, and C. Faloutsos, “Copy- catch: stopping group attacks by spotting lockstep behavior in social networks,” in WWW. ACM, 2013, pp. 119–130

    2013

  17. [25]

    M-zoom: Fast dense-block detec- tion in tensors with quality guarantees,

    K. Shin, B. Hooi, and C. Faloutsos, “M-zoom: Fast dense-block detec- tion in tensors with quality guarantees,” in ECML-PKDD. Springer, 2016, pp. 264–280

    2016

  18. [26]

    Time- crunch: Interpretable dynamic graph summarization,

    N. Shah, D. Koutra, T. Zou, B. Gallagher, and C. Faloutsos, “Time- crunch: Interpretable dynamic graph summarization,” in KDD. ACM, 2015, pp. 1055–1064

    2015

  19. [27]

    Scalable community discovery from multi-faceted graphs,

    A. Metwally, J.-Y . Pan, M. Doan, and C. Faloutsos, “Scalable community discovery from multi-faceted graphs,” in BigData. IEEE, 2015, pp. 1053–1062

    2015

  20. [28]

    Analysis and detection of fake views in online video services,

    L. Chen, Y . Zhou, and D. M. Chiu, “Analysis and detection of fake views in online video services,” TOMM, vol. 11, no. 2s, p. 44, 2015

    2015

  21. [29]

    Using naive bayes to detect spammy names in social networks,

    D. M. Freeman, “Using naive bayes to detect spammy names in social networks,” in WAIS. ACM, 2013, pp. 3–12

    2013

  22. [30]

    Beyond blacklists: learning to detect malicious web sites from suspicious urls,

    J. Ma, L. K. Saul, S. Savage, and G. M. V oelker, “Beyond blacklists: learning to detect malicious web sites from suspicious urls,” in KDD. ACM, 2009, pp. 1245–1254

    2009

  23. [31]

    Edgecentric: Anomaly detection in edge- attributed networks,

    N. Shah, A. Beutel, B. Hooi, L. Akoglu, S. Gunnemann, D. Makhija, M. Kumar, and C. Faloutsos, “Edgecentric: Anomaly detection in edge- attributed networks,” in ICDMW. IEEE, 2016, pp. 327–334

    2016

  24. [32]

    Birdnest: Bayesian inference for ratings- fraud detection,

    B. Hooi, N. Shah, A. Beutel, S. G ¨unnemann, L. Akoglu, M. Kumar, D. Makhija, and C. Faloutsos, “Birdnest: Bayesian inference for ratings- fraud detection,” in SDM. SIAM, 2016, pp. 495–503

    2016

  25. [33]

    Oddball: Spotting anoma- lies in weighted graphs,

    L. Akoglu, M. McGlohon, and C. Faloutsos, “Oddball: Spotting anoma- lies in weighted graphs,” in PAKDD. Springer, 2010, pp. 410–421

    2010

  26. [34]

    zoo r ank: Ranking suspicious entities in time-evolving tensors,

    H. Lamba, B. Hooi, K. Shin, C. Faloutsos, and J. Pfeffer, “zoo r ank: Ranking suspicious entities in time-evolving tensors,” in ECML-PKDD. Springer, 2017, pp. 68–84

    2017

  27. [35]

    Combating web spam with trustrank,

    Z. Gy ¨ongyi, H. Garcia-Molina, and J. Pedersen, “Combating web spam with trustrank,” in VLDB, 2004, pp. 576–587

    2004

  28. [36]

    Semi- supervised content-based detection of misinformation via tensor embed- dings,

    G. B. Guacho, S. Abdali, N. Shah, and E. E. Papalexakis, “Semi- supervised content-based detection of misinformation via tensor embed- dings,” ASONAM, 2018

    2018

  29. [37]

    A survey of algorithms for dense subgraph discovery,

    V . E. Lee, N. Ruan, R. Jin, and C. Aggarwal, “A survey of algorithms for dense subgraph discovery,” in Managing and Mining Graph Data . Springer, 2010, pp. 303–336

    2010

  30. [38]

    Random graph models of social networks,

    M. E. Newman, D. J. Watts, and S. H. Strogatz, “Random graph models of social networks,” PNAS, vol. 99, no. suppl 1, pp. 2566–2572, 2002

    2002

  31. [39]

    Inferring strange behavior from connectivity pattern in social networks,

    M. Jiang, P. Cui, A. Beutel, C. Faloutsos, and S. Yang, “Inferring strange behavior from connectivity pattern in social networks,” in PAKDD. Springer, 2014, pp. 126–138

    2014

  32. [40]

    C. C. Aggarwal and C. Zhai, Mining text data . Springer Science & Business Media, 2012

    2012

  33. [41]

    Do more views of a graph help? community detection and clustering in multi-graphs

    E. E. Papalexakis, L. Akoglu, and D. Ienco, “Do more views of a graph help? community detection and clustering in multi-graphs.” in FUSION. Citeseer, 2013, pp. 899–905

    2013

  34. [42]

    Multiaspectforensics: Pattern mining on large-scale heterogeneous networks with tensor analysis,

    K. Maruhashi, F. Guo, and C. Faloutsos, “Multiaspectforensics: Pattern mining on large-scale heterogeneous networks with tensor analysis,” in ASONAM. IEEE, 2011, pp. 203–210. VIII. R EPRODUCIBILITY A. Satisfaction of Axioms Below, we show that our suspiciousness metric f (and ...

    2011

  35. [43]

    An F -rank PARAFAC decomposition aims to approximate a multimodal tensor as a sum ofF rank-one factors which, when summed, best reconstruct the tensor according to a Frobenius loss

    PARAFAC: PARAFAC [41] is one of the most common tensor decomposition approaches, and can be seen as the higher-order analog to matrix singular value decomposition. An F -rank PARAFAC decomposition aims to approximate a multimodal tensor as a sum ofF rank-one factors which, whe...

  36. [44]

    Their intuition is to look for the largest “bands” of nodes which have similar factor scores, as they are likely clusters

    MAF: MAF [42] also utilizes PARAFAC decomposition, but proposes a different node inclusion method. Their intuition is to look for the largest “bands” of nodes which have similar factor scores, as they are likely clusters. Since in our case, ⃗ aand ⃗b both reflect node scores, w...

  37. [45]

    It has been shown outper- form [23] in terms of discovering blocks which maximize CSSusp metric, and hence we use it over the method proposed in [23]

    Mzoom: Mzoom [25] proposes a greedy method for dense subtensor mining, which is flexible in handling various block-level suspiciousness metrics. It has been shown outper- form [23] in terms of discovering blocks which maximize CSSusp metric, and hence we use it over the method ...

  38. [46]

    SVD: SVD [12], as discussed in Section IV-A, is a matrix decomposition method which aims to produce a low- rank optimal reconstruction of A according to Frobenius norm. In our case, since we aggregate over the K views and produce a resulting N×N matrix forG, a rank F SVD decom...

  39. [47]

    AvgDeg: [14] proposes an algorithm, which we call AvgDeg, for greedily mining dense subgraphs according to the AvgDeg notion of suspiciousness. The algorithm proposed gives a 2-approximation in terms of returning the maximally dense subgraph, and works by considering a single ...

  40. [48]

    Our im- plementation is written in Python, and will be made available publicly

    SLICE NDICE: We use the standard implementation as described in Section V-A, evaluating over 500 blocks. Our im- plementation is written in Python, and will be made available publicly. C. Source Code and Datasets All source code including calculation of the proposed suspicious...

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.