A Hybrid Recurrent Neural Network Approach for Detecting Abnormal User Behavior in Social Networks

Abstract

With the recent advances in Internet technology, various aspects of the human lifestyle are influenced by the digital world. Users join social networks to communicate and perform their social activities. In addition to the vast benefits, social networks may also negatively affect different dimensions of user activities. One of the major challenges in social networks is the security issues of the individual user activities since usually there is no mechanism to detect abnormal behavior of the users. On the other hand, due to the continuous expansion and dynamic nature of social networks, identifying anomalies and abnormal behaviors of users in such networks is of particular importance. The literature offers several methods to manage the challenge of the security breach of user activities in social networks. A thorough inspection of these methods shows that most of them focus on two important factors: selecting the appropriate feature and increasing the accuracy of detecting abnormal behaviors. The main innovation of this paper is the proposal of a new hybrid method based on recurrent neural networks to analyze the abnormal behavior of users and manage the two challenges mentioned above. Our motivation for using recurrent neural networks as the basis of the proposed method is the temporal nature of user activities in social networks and the reasonable performance of these methods in identifying abnormal behaviors, processing time-series data, and the ability to analyze relationships between them. In the proposed method, statistical methods are used for the initial labeling of data. In the next step, the CNN-BiLSTM hybrid method is applied to the data in order to re-label them, establish order between the features and thus reduce the error. Then the abnormal batches are identified using the K-means clustering algorithm. The experiments show that the proposed method provides more accurate results compared to other statistical and learning-based methods. The efficiency of the proposed method is also reported on the VAST Challenge 2008 and Enron-Email datasets for the F-score benchmark, 0.82 and 0.88, respectively.