In this project, we developed effective solutions to address Reputation-Escalation-as-a-Service (REaaS) in different application domains, including E-commerce market, recommender systems, online reviews, and mobile app stores.

E-commerce portals is among the sites hit hardest by malicious bots: about 20% of traffic to e-commerce portals is from malicious bots; malicious bots even generated up to 70% of Amazon.com traffic. As one of the largest e-commerce companies in the world, Alibaba also observed a certain amount of malicious bot traffic to its two main subsidiary sites, i.e., Taobao.com and Tmall.com. In this project, we developed a novel and efficient approach for detecting web bot traffic. We then deployed and evaluated the approach on Taobao/Tmall platforms, and it shows that our detection approach performed well on those large websites by identifying a large set of IP addresses (IPs) used by malicious web bots. Then, we conducted an in-deep behavioral analysis on a sample of web bot traffic to better understand the distinguishable characteristics of web bot traffic from normal web traffic initiated by human users. The analysis results reveal their differences in terms of active time, search queries, item and store preferences, and many other aspects. These findings provide new insights for public websites to further improve web bot traffic detection for protecting valuable web contents.

Recommender systems have been increasingly used in a variety of web services, providing a list of recommended items in which a user may have an interest. While important, recommender systems are vulnerable to various malicious attacks. Inthis project, we studied a new security vulnerability in recommender systems caused by web injection, through which malicious actors stealthily tamper any unprotected in-transit HTTP webpage content and force victims to visit specific items in some web services (even running HTTPS), e.g., YouTube. By doing so, malicious actors can promote their targeted items in those web services. To obtain a deeper understanding on the recommender systems of our interest (including YouTube, Yelp, Taobao, and 360 App market), we first conducted a measurement-based analysis on several real-world recommender systems by leveraging machine learning algorithms. Then, we implemented  web injection in three different types of devices (i.e., computer, router, and proxy server) to investigate the scenarios where web injection could occur. Based on the implementation of web injection, we demonstrated that it is feasible and sometimes effective to manipulate the real-world recommender systems through web injection. We also developed several countermeasures against such manipulations.

Online reviews, which play a crucial role in the ecosystem of nowadays business, have been the primary source of consumer opinions. Due to their importance, professional review writing services are employed for paid reviews and even being exploited to conduct opinion spam. Posting deceptive reviews could mislead customers, yield significant benefits or losses to service vendors, and erode confidence in the entire online purchasing ecosystem. In this project, We developed a novel approach to detecting deceptive reviews written by professional review writers. We leveraged authorship attribution to identify the writing style of reviewers, and employed a multiview clustering method to group authors with similar writing style. In addition, we compared different neural network models for modeling deceptive writing styles. We compared the performance of different classifiers showing that a convolutional neural network has the best overall detection performance, achieving 90% accuracy. Finally, we evaluated the effectiveness of the multiview clustering framework based on large scale Amazon datasets as a case study and we demonstrated that clustering method outperforms existing K-means andhierarchical methods.

In order to promote apps in mobile app stores, for malicious developers and users, manipulating average rating is a popular and feasible way. In this project, we developed a two-phase machine learning approach to detecting app rating manipulation attacks. In the first learning phase, we generated feature ranks for different app stores and found that top features match the characteristics of abused apps and malicious users. In the second learning phase, we chose top N features and trained our models for each app store. With cross-validation, our training models achieve 85% f-score. We also used our training models to discover new suspicious apps from our data set and evaluated them with two criteria. Finally, we conducted some analysis based on the suspicious apps classified by our training models and some interesting results are discovered. The average review lengths of higher rating levels are lower than those of lower rating levels. The higher rating level, the shorter its reviews are. This is because the higher rating apps get, the less bugs they have and users usually use more words to complain and report bugs in lower level reviews.

Last Modified: 07/10/2020
Modified by: Haining Wang