This document proposes techniques for detecting user aliases in social media. It discusses two cases of multiple aliases: altered ego aliases intended to be concealed, and multiple aliases not intended to be concealed. Techniques explored include string matching on user names, time profile analysis, stylometric analysis of writing style, and social network analysis of friends and forum posts. An experiment applies these techniques to a dataset from an Irish discussion forum to detect aliases.

1. Detecting
Multiple
Aliases
in
Social
Media
Amendra
Shrestha,
Lisa
Kaati,
Fredrik
Johansson
26th
August

2. Overview
• Introduction
• Reasons
for
multiple
aliases
• Techniques
for
detecting
aliases
• Dataset
• Experiment
and
Results
• Conclusion
and
Future
work

3. Motivation
1.
A.
Y.
Zelin
and
R.
B.
Fellow,
“The
state
of
global
jihad
online,”
New
America
Foundation,
2013.
2.
J.
Brynielsson,
A.
Horndahl,
F.
Johansson,
L.
Kaati,
C.
Mårtenson,
and
P.
Svenson,
“Harvesting
and
analysis
of
weak
signals
for
detecting
lone
wolf
terrorists,”
Security
Informatics,
2013,
2:11.
3.
http://www.businessinsider.com/facebook-­‐fake-­‐likes-­‐and-­‐accounts-­‐2012-­‐12
[1]
[3]
[2]
terrorists
make
extensive
use
of
social
media
/
discussion

4. Problems
• changing
IP
address
and
URLs
frequently
• use
of
anonymization
techniques
like
Onion
Routing
and
Crowds

5. Our
Objective
•
Develop
methods
for
detecting
users
with
multiple
aliases

6. Use
of
multiple
aliases

7. Bizhant
Pokheral
Use
of
multiple
aliases

8. Bizhant
Pokheral
Use
of
multiple
aliases

9. Cases
for
multiple
aliases
• Case
I
:
Alter
Ego
Aliases
• concealed
case
• Case
II
:
Multiple
Aliases
• non-­‐concealed
case

10. • Case
–
I
:
Alter
ego
aliases
• banned
by
administrator
• lost
trust
of
the
group
• developed
bad
personal
relationships
• to
support
his
arguments
• privacy
reasons
• Case
–
II
:
Multiple
aliases
• banned
by
administrator
• banned
for
inactivity
• forgotten
password
• alias
name
is
already
used
Possible
reasons
for
multiple
aliases

11. Assumptions
• Case
I
:
Alter
ego
aliases
• doesn’t
have
same
friend
network
• write
in
at
least
one
common
thread
• no
name
equality
• similar
time
profile
• similarity
in
writing
style
• Case
II:
Multiple
aliases
• has
similar
friend
network
• doesn’t
write
in
same
thread
• equality
in
name
• similar
time
profile
• similarity
in
writing
style

12. Techniques
for
detecting
aliases
• String-­‐based
matching
• Time
profile-­‐based
matching
• Stylometric
matching
• Social
network-­‐based
matching

13. String
based
matching
• Based
on
aliases
name
• For
multiple
aliases
case
• Edit
distance
measures
• implemented
Jaro-­‐Winkler
distance
[1]
1.
W.
E.
Winkler,
“String
comparator
metrics
and
enhanced
decision
rules
in
the
Fellegi-­‐Sunter
model
of
record
linkage,”
in
Proceedings
of
the
Section
on
Survey
Research
Methods,
1990,
pp.
354–359.

14. Time
profile-­‐based
matching
• Post
created
time
• Time
profiles
based
on
relative
distribution
of
the
time
of
day
• Times
of
post:
<7:01,
7:25,
7:29,
7:40,
8:05,
8:55,
9:27,
10:17,
10:43,
13:11,
14:19,
14:59>
• Frequency
count:
<0,
0,
0,
0,
0,
0,
4,
2,
1,
2,
0,
0,
1,
2,
0,
0,
0,
0,
0,
0,
0,
0,
0,
0>
• Normalized
feature
vector<
0,
0,
0,
0,
0,
0,
0.33,
0.16,
0.083,
0.16,
0,
0,
0.083,
0.16,
0,
0,
0,
0,
0,
0,
0,
0,
0,
0
>
• Calculate
Euclidean
distance
between
vectors
Fig:
Time
profile
distribution

15. Stylometric
matching
• Everyone
has
unique
writing
style
• Statistical
analysis
of
writing
style
• “writeprint”
• Calculate
cosine
of
angle
between
feature
vectors
where
​ 𝑝↓𝑖
and
​ 𝑞↓𝑖
are
feature
vector
of
aliases
p
and
q
respectively
1.
A.
Narayanan,
H.
Paskov,
N.
Gong,
J.
Bethencourt,
E.
Stefanov,
E.
Shin,
and
D.
Song,
“On
the
feasibility
of
internet-­‐scale
author
identification,”
in
2012
IEEE
Symposium
on
Security
and
Privacy
(SP),
may
2012,
pp.
300
–314.
1

16. Social
network-­‐based
matching
•
Friend
Equality
• friend
network
• number
of
common
friends
• Thread
Equality
(Discussion
Boards)
• thread
network
• communication
patterns
• Jaccard
similarity
coefficient
aliases belong to the same user or not. In general, it is likely
that both aliases will make postings in the same thread if they
are alter egos, since the reason for creating an alter ego or
sockpuppet often is to support one’s own arguments.
No matter if the constructed social network is based on
friend-, thread- or topic information, we use vertex similarity
to calculate how similar two aliases are in terms of their social
network. The vertex similarity can be calculated as a function
of the number of neighbors in common for two aliases. If the
total number of neighbors should not impact the results too
much, a normalization process in which the node degrees are
taken into account is needed. Let p be the neighborhood of
vertex (alias) p in the network and q be the neighborhood
of vertex (alias) q. Now, the number of common neighbors
is calculated as | p q|. The normalization can be done
in various ways (such as with dice or cosine similarity), but
in our implementation we make use of the Jaccard similarity
coefficient J(p, q), where:
J(p, q) =
| p q|
| p [ q|.
(3)
In Figure 2 we illustrate the ego networks of aliases A and
C, where they have two neighbors in common (E and F).
Fig:
Friend
Network

17. Matching
of
aliases
• Multiple
aliases
• all
above
techniques
• Alter
ego
• all
except
string-­‐based
technique
• Combination
of
techniques
• depending
upon
size
of
dataset
• all
at
once
• one
at
a
time
• Average
of
the
results
of
the
matching
techniques

18. Dataset
• Irish
discussion
forum
boards.ie
data
• SIOC
format
• Available
data
• 10
years
data
• 50
gigabytes
of
disk
space
• 9
million
documents
• Used
data
• 2008
year
data
• 995
megabytes
in
size
• forums,
threads,
posts,
users
and
FOAF
documents
• more
than
1200
users
(posted
more
than
60
messages)
• 220K
posts

19. Experiment
Experiment
Result
User
1
User
2
Stylo
(Rank)
Time
(Rank)
Fusion
1_A
1_B
1
1
1
3_B
2
2
2
2_B
3
3
3
.
.
.
.
.
.
.
.
4_B
.
.
.
N_B
N
N
N
1
1_A
1_B
2
3
4
N
1_A
1_B
2_B
3_B
4_B
N_B
2_A
2_B

20. Result
0%
20%
40%
60%
80%
100%
50
100
150
200
250
300
350
400
450
500
550
600
650
700
750
800
850
900
950
1000
ACCURACY
NUMBER
OF
USERS
TOP-­‐3
Time+Stylometry
Time
Stylometry
0%
20%
40%
60%
80%
100%
50
100
150
200
250
300
350
400
450
500
550
600
650
700
750
800
850
900
950
1000
ACCURACY
NUMBER
OF
USERS
TOP-­‐1
Time+Stylometry
Time
Stylometry

21. Conclusion
• Presented
4
different
types
of
techniques
• Implemented
matching
techniques
• Experiments
using
time
and
stylometric
• Time
gives
better
results
than
stylometric
• Combining
the
results
of
each
matching
technique
gives
better
results

22. Future
Work
• This
is
just
the
beginning
• Maximize
test
result
percentage
• Fusion
of
techniques
• Test
on
big
dataset

23. Questions