GrFrauder: A Novel Unsupervised Clustering Algorithm for Identification Group Spam Reviewers

Byun et al. [13] introduced SC-Com, an enhanced framework for collusive community detection. The approach builds reviewer graphs based on behavior collusion and separates a network into communities based on mutual suspicion. The framework only takes into account main data, such as ratings and time data. The method has a 91% F1 score in a live scenario, making it a trustworthy and solid solution. The spammers' concealment is prohibited under the model. For the purpose of evaluating the framework's effectiveness, the publishers compared 7 various models. The framework helps identify two-way abnormalities. The users will be divided up into smaller communities by the model, and supervised categorization will take place. The work illustrates the importance of collusiveness given spam detection. Only 4 of the dataset's 6 attributes were taken into consideration by the authors. Better outcomes might be obtained using more intricate strategies like deep neural networks. This concept can be applied to issues like cyber bullying, social media, disputes within online communities, etc.

Paul and Nikolaev [14] published a paper. The study is a SLR (Systematic Literature Review) that emphasizes both technical approaches and FRD modeling methodologies. The report also analyses the strategies and laws now in place that have not been successful in eradicating the negative impacts of fake review activity in daily life. Decentralized information systems with user empowerment were emphasized by the writers. Only the user reviews that have been synthesized can be found in reliable sources. The key findings are that expert attackers are well-equipped to mimic the behavior of honest reviews, feature-based approaches require training datasets and cannot function in real-time, training dataset construction is time- and money-consuming, and algorithms that use textual, rating, or graph-based features frequently run slowly and are not scalable. All of the approaches listed fail to distinguish between malicious reviews and honest reviews. This can result in the harassment of trustworthy reviewers.

Hussain et al. [15], the DSR (Diversified Set of Reviews) technique, which chooses a diversified set of top-k evaluations with negative, positive, and unbiased reviews, was proposed by Hussainet al. English and Roman Urdu real-world datasets are used for evaluation. The study suggests using Spammer Group Detection (SGD) identifies spam groups that may be questionable. To identify potential spam groups, the model applies the SCAN (Structural Clustering Algorithm for Networks) algorithm. CNN (Convolutional Neural Network), LSTM, GRU, and BERT are the classifiers that were used. The DSM technique will save reviewers time by allowing them to make decisions about the goods and services without taking into account all of the reviews. The K-fold Cross-validation approach is applied to assess suggested method's performance. For training and testing, the datasets Yelp and Daraz are split 80:20. Dataset can be enhanced with other parameters like email id, spammer's IP address, and location to increase accuracy.

Bhuvaneshwari et al. [16], The Self Attention-based CNN BI-LSTM model, a novel framework built on deep learning, was proposed byBhuvaneshwari et al. The model determines the relative importance of each word in the phrase and looks for any indicators of spamming in the text. The weighting of each word is determined by the self-attention mechanism. The BI-LSTM layer gains knowledge of the document's structure and extracts contextual data. A non-linear layer with 10 neurons using ReLU as an activation function is provided vectors as input, and a dropout of 0.25 is used. With a decay of 10-6 and a learning rate of 0.0001, RMSprop is employed as an optimizer. For training and testing, the balanced dataset was 70% and 30%, respectively. It is necessary to accomplish the detection based on aspect level and rating deviance. The use of spam detection algorithms can improve analytical capabilities in several industries, including healthcare, marketing, and law.

Danilchenko et al. [17] described a novel approach that combines ML with a message-passing algorithm to categorize reviewers as spammers or benign. The CRSD-net (Clique Reviewer Spammer Detection Network) model combines the strengths of traditional graphical models like Brief propagation with machine learning capabilities. The model was built using raw data. A careful edge sparsification approach is used to solve computational problems. Belief Propagation, a label propagation algorithm, is utilized for the first time. The edge and node potentials were calculated using the random forest machine learning algorithm. Combining domain experience and ML can improve the performance of the model. This model was only applied to one platform by the authors. Simply user categorization was put into the model. The model can be improved to classify reviews. The Wolfram Language, which has good support for graph structures, was employed by the authors.

Wang et al. [12] developed a novel technique called GSBP to find the loose spam reviewer’s group. They initially constructed a reviewer bi-connected graph through relations among the reviewers in which they gave similar rating over a period of time. The dataset is converted in to a bipartite graph as a connection between reviewers and products they reviewed. Then used divide and conquer algorithm to generate loose spammer groups from bipartite graph. On each identified group calculated group spam indicator score and the groups which are above the threshold are treated as spammer groups. They evaluated their model on unlabelled Amazon dataset. Authors identified their previous method GSBP generating reviewer graph revealing the behavioral similarity between two reviewers which is not applicable for all reviewers. To overcome the drawback authors developed a new model called GGSpam [18] to detect spammer groups based on co-review collusiveness. GGSpam initially converts review data as a graph with nodes of reviewers and collusiveness among reviewers as edges. Then based on divide and conquer method graph reduced to smaller groups and with spamity score of each group authors identified the spam groups from dataset.

HIN-RNN was utilized by Shehnepoor et al. [19] to model the co-review relationships of the reviewers in a group over a set period—of 28 days. To forecast the spatiotemporal relationships of the group's reviewers, RNN is also applied to geographical interactions. Thirdly, the vector representations of the reviewers are improved via a GCN (Graph Convolution Network). K-means clustering is used to identify outliers after refining. The authors used a GCN with two layers. The suggested approach consists of three steps: Cluttering to weed out anomalous reviewers, SoWE group level representation, and a fully connected layer. On the available datasets, Continuous Bag of Words (CBoW) is trained. It is not believed that the stochastic modeling of the relationships between the reviewers would offer a more accurate behavioral depiction of the reviewers. All the reviewers remain in the group if there are no outlier reviewers in the group.

Summary of the literature survey is provided in the Table 1, which represents the techniques used by the authors. All of the studies listed in the literature are attempted to generate spammer groups based on the perspective of reviewers either with temporal patterns or Content Similarity and Graph Structure (refer Table 2). But our proposed GrFrauder method which equally contributes on all features and it also makes equal contribution on group detection and ranking of groups.

The proposed model "GrFrauder" is a two-step approach. The first step identifies the group of candidate spammers by examining the tightness of the product and reviewers based on their neighbourhood from the graph. In the second step, ranking groups depending on the group spam score calculated using co-reviewing pattern in the embedding space.

4.1 Detection of candidate spam groups

A group of spammers have similar properties in terms of: a) Reviewed products; b) ratings given to products; c) time spent reviewing products. By incorporating above three factors the model initially construct a graph – G (V, E). It segregates the users based on the products purchased; then, it generates sub-groups based on the similar reviews given by the different users. The proposed system aims to find the group of spammers by finding the neighbourhood properties. The algorithm for the identification of SPAM groups is presented below.

Algorithm 1: Generate Groups

Input:

         P – Set of Products

         R – Set of Reviewers

         G (V, E) – Product – Product Graph

         CGgroups – Empty set of Candidate Groups

Output:                      

         Candidate Groups

Description:

1. for every isolated node v_i in G do
2. CGgroups $\leftarrow$ remove (v_i), add v_i from Graph G
3. end for
4. for every pair $\left(e_i, e_j\right) \in E \times E$  do
5.          if $a_i^e \subset a_j^e$  then
6.             If $J\left(P_{a_j^e}, P_{a_j^e}\right)>\delta$ then
7.             CGgroups.add $\left(a_i^e \cup a_j^e\right)$
8.    end if
9. end if
10. remove $a_i^e$  from G
11. end for
12. for every group $g \in C G g r o u p s$ do
13.    if SpamScore(g) <= ¥_spam, then
14.             CGgroups.delete(g)
15.    end if
16. end for

As mentioned, the graph – G(V,E), where $v_{i j} \in V$  represents a pair of product–rating (p_i, r_j) and this node attribute $a_{i j}^v$  gives r_j rating given reviewers set on p_i. Example: P1-1 {R1, R2, R3}, it means Product1 with rating 1 given by set of reviewers {R1, R2, R3}. Edge $e_{(i j, m n)}=\left(u_{i j}, v_{m n}\right) \in$ E , it explains two ratings (j, n) and two products (i, m) co-rating & co-reviewing patterns. The edge attribute $a_{(i j, m n)}^e$  represents the co-reviewers R_(ij,mn) who gave review on same Гt time with similar ratings rj and rn on pi and pm products. It is important to note that an edge linking the same product with various rating values will not exist in G since we consider that a reviewer is not entitled to provide many reviews/ratings for a single product.

Then, model build up Candidate Groups, from a unique group detection method which accepts G as an input. Lines 1-3 are used to remove isolated nodes in a given Graph G. Then each edge on graph with the subset of reviewers who reviewed products (i, j) (Line 4-11) such reviewers Jaccard Similarity (JS) value is above the edge weight threshold δ=0.4 as taken [20] are merged as a group and edge is removed from the graph. The iteration process is repeated until no edges stay in the resulting G and a list of candidate groups are returned. SpamScore is defined as the average of RT, NT, PT, RV, RR and TW mentioned in section 3, where the spam score will be used to assess the suspiciousness of candidate groups, and believe those groups as potential groups whose SpamScore is above threshold value ¥spam (Lines 12-16).

4.2 Ranking of candidate spam groups

GrFrauder evaluates candidateSpamgroups based on spamicity after detecting them. It consists of two steps: based on their co-reviewing tendencies, placing reviewers into an embedding space, ranking groups according to how near the embedding space the member reviewers are. Our proposed ranking strategy is different than other researchers ranking strategy as [11, 18] authors used average of group spam indicator values to generate rank of a spammers group.

Reviewer2Vec: Embedding Reviewers

The motivation for proposed research suggested Reviewer2Vec embedding technique [11]. To identify the collusive spamicity between the reviewers identified from Candidate Groups, we constructed an individual reviewer-reviewer spammer graph for each group Gg=(Vg, Eg), which is bi-connected and weighted. Here, Vg stands for the set of reviewers R, while Eg is the edge that connects two reviewers i and j with the weight $W_{i j}^g=\omega(i, j)$ .

The weight of the edge represents the overall collusive spamicity between two reviewers.

When two (i, j) reviewers given reviews$r_p^i$ and $r_p^j$ , ratings $b_p^i$ and $b_p^j$  at different times $t_p^i$ and $t_p^j$ , on product p, then the collusive spamicity of i, j with regard to product p is identified as in Eq. (8):

$\operatorname{Coll}(i, j, p)=\left\{\begin{array}{l}0,\left|t_p^i-t_p^j\right|>\tau_t \vee\left|b_p^i-b_p^j\right| \geq \tau_b \\ \zeta(i, j, p), \text { else }\end{array}\right.$          (8a)

$\zeta(i, j, p) \equiv s^p\left[\alpha\left(1-\frac{\left|t_p^i-t_p^j\right|}{\tau_t}\right)+\beta\left(1-\frac{\left|b_p^i-b_p^j\right|}{\tau_b}\right)+\gamma \cdot \operatorname{Cosin} e\left(r_p^i, r_p^j\right)\right]$          (8b)

α, β, γ are the coefficients used to control the significance of time, rating and review text similarity(0≤α, β,γ≤1 and sum of α,β,γ=1). $\zeta(i, j, p)$  gives collusion of reviewer's in Eq. (9).

$s^p=\frac{2}{1+e^{-(M P-\operatorname{deg}(p))^\theta+2^\theta}}-1$          (9)

S^p represents the product p suspicion degree and the parameters of the model are τ_t, τ_r, θ.

Model does not take into account if the co-reviewing patterns of the ratings difference (τ_r) or time difference (τ_t) between reviewers i and j on p deviates threshold value. After translating two reviews using Word2Vec into an embedding space, model take the cosine of each. After adding the collusive spamicity of a pair of reviewers, model is able to calculate the in general collusive spamicity between reviewers i, j as in 10:

$\omega(i, j)=\frac{2}{1+e^{-\sigma(i, j)}}-1$           (10a)

where,

$\sigma(i, j)=\left[\sum_{p \in\left\{P_i \cap P_j\right\}} \operatorname{coll}(i, j, p)\right] \frac{\left|\mathrm{P}_{\mathrm{i}} \cap \mathrm{P}_{\mathrm{j}}\right|}{\left|\mathrm{P}_{\mathrm{i}} \cup \mathrm{P}_{\mathrm{j}}\right|}$           (10b)

When the evaluation is more similar among two reviewers on majority of items then collusion ill occur as shown by σ(i, j). Using the Sigmoid function, σ(i, j) may be seen as the normalization of ω(i, j).

Ranking the Groups:

$\operatorname{Gspam}(g)=\frac{1}{\left|R_{(g)}\right|} \sum_{\left.k \in R_{(g)}\right)}\left[\vec{k}-\left[\frac{1}{\left|R_{(g)}\right|} \sum_{k \in R_{(g)}} \vec{k}\right]\right]^2$          (11)

To rank detected groups model measure the (Euclidean) distance between each reviewer in the group and the centroid of the group within the embedding space is used to calculate the density of each detected group. Let $\vec{k}$  is the reviewer k representation in embedding space. The mean of all distances is used to determine a group's spamicity. The group spam score Gspam(g) of any group g is calculated as in Eq. (11). The group with high spam score is represented as first spam group and so on. The top ranked spammers are more dangerous in e-commerce applications.