Wikipedia describes itself as the “free encyclopedia that anyone can edit”. Along with the helpful volunteers who contribute by improving the articles, a great number of malicious users abuse the open nature of Wikipedia by vandalizing articles. Deterring and reverting vandalism has become one of the major challenges of Wikipedia as its size grows. Wikipedia editors fight vandalism both manually and with automated bots that use regular expressions and other simple rules to recognize malicious edits[5]. Researchers have also proposed Machine Learning algorithms for vandalism detection[19,15], but these algorithms are still in their infancy and have much room for improvement. This paper presents an approach to fighting vandalism by extracting various features from the edits for machine learning classification. Our classifier uses information about the editor, the sentiment of the edit, the “quality” of the edit (i.e. spelling errors), and targeted regular expressions to capture patterns common in blatant vandalism, such as insertion of obscene words or multiple exclamations. We have successfully been able to achieve an area under the ROC curve (AUC) of 0.91 on a training set of 15000 human annotated edits and 0.887 on a random sample of 17472 edits from 317443.
Wikipedia defines vandalism as “any addition, removal, or change of content made in a
deliberate attempt to compromise the integrity of Wikipedia”[
Vandalism detectors attempt to automatically distinguish integrity-violating edits
from integrity-preserving edits. Wikipedia currently uses a combination of manual and
automated vandalism detection. The automated “bots” employed by Wikipedia use
regular expressions and other simple rules to detect vandalism[
This paper presents a machine-learning-based vandalism detector that uses several
features to classify vandalism and that achieves an AUC score of over 0.887. Measuring
the performance of the vandalism detection algorithm in terms of AUC instead of other
measures makes sense as AUC score denotes the probability by which a classifier is
able to distinguish a randomly sampled vandalism edit from a randomly sampled
regular edit. Our results significantly outperform a baseline classifier based on a previous
approach[
The training corpus for the classification was provided by the organizers of the PAN
workshop[
Wikipedia articles in the training set were formatted in WikiMarkup[
We focus on content based vandalism as it is the most prominent type of vandalism
that exists. After analyzing samples of vandalized and regular edits, we observed that
certain attributes of the edits distinguished vandalism from regular edits. We used the
following features of the edits for classification:
Edit Distance: Our classifier calculates the Damerau-Levenstein Distance using the
LingPipe API[
Edit Type: Our classifier determines whether the edit inserted, deleted and/or modified text or a combination of these actions.
Text Changes: Our classifier determines the edit length, word count, words inserted,
words deleted, and words changed using java-diff[
Spelling Errors: Our classifier counts the number of apparent spelling mistakes in the
edit and the ratio of spelling errors to correctly spelled words. Our spell-checking[
Obscene Words: Our classifier enumerates the total number of obscene words in the
edit and the ratio of obscene words to benign words. We started with a dictionary of
obscene words[
Repeated Patterns: “Silly” vandalism often employs repeated patterns like upper case words, exclamation marks, and repetition of words/letters (e.g. “heyyyyyy”, “oh!!!!!”, “wow wow wow”, “hahahaha”, “WIKIPEDIAAA”). Our classifier counts these patterns using the regular expressions.
Grammatical errors: Wikipedia editors strive for good grammar, but vandals do not
generally follow these rules. They may insert words or phrases into the middle of
existing sentences or write ungrammatical sentences deliberately or unintentionally. Our
classifier parses the edits into sentences that had been inserted or changed by using
java-diff and LingPipe’s sentence tokenizer and counts the grammatical errors in them
using CMU’s Link Grammar Parser[
Sentiment Analysis: Statements expressing opinions are common features of vandalism. Our classifier performs a sentiment analysis of the edit to uncover subjective or opinionated (positive or negative) text. We use LingPipe’s Sentiment Analysis Tool trained on movie review data. The classifier counts objective or opinionated sentences and measures the change in total number of positive or subjective sentences. Sum of metrics: This simple but effective meta-feature is the sum of the number of Repeated Letters, Repeated Words, Capitalized Words and Multiple Exclamation Marks. Article History: Vandals do not necessarily perform vandalism across all articles at the same rate. Rather, some articles receive a disproportionate amount of vandalism than others (e.g. Michael Jackson). The feature is the number of times an article was vandalized in the previous 5000 edits on the article. We denote vandalism as a comment left by an editor that contains “reverted”, “user” and “vandalism” in this order. We count also how many times an article was reverted, regardless if it was explicitly vandalism or not.
Editor information: Knowing who contributed an edit can give us some expectation of the quality of the change. For example, we expect an active and registered Wikipedia editor with several thousand edits to be more trustworthy compared to an unregistered editor that is only identifiable from an IP address and who has not contributed before. Our classifier uses several editor-based features: whether the editor is registered or unregistered, how long the editor has been registered, the total number of contributions made to Wikipedia during the period that training data was collected, the total number of edits made to Wikipedia by the editor up to the date the training data was finalized, the number of reverts on previous revisions by the author deemed to be vandalism (using the same heuristic as for article history) and the total number of previous modifications made by the editor on the article they are revising. We were careful to make sure for edit totals to not include future modifications. If the user is not registered, the classifier uses their IP address as a proxy for their identity. 3
Modeling Classifiers. We compare in this section two different models for building
classifiers. We first investigate the Naive Bayes with Bag Of Words approach described
in Smets et al[
Reg(0) UnReg(1) User classifier (a hybrid between decision trees and Bayesian classifiers) and the features described above.
Baseline: Naive Bayes with the Bag Of Words model. In order to set a baseline for
comparison, we first started with classification of edits using the Bag of Words
approach. We used Mallet[
Building classifiers. We built classifiers using the features presented in the previous
section with three different algorithms: Naive Bayes, C4.5 Decision Trees[
We combined all the features described in the previous section and performed a 10-fold cross validation on all three algorithms. NBTree yielded the best result with the default settings, which uses 5-fold cross validation of Naive Bayes at a node to compute its utility and a split threshold of 5% of the relative reduction on error. Figure 1 shows the NBTree we constructed from the training data. 4
Our test corpus contained 15000 edits. Registered users contributed 67% of these edits, while anonymous users contributed 33%. Among these 93.9% of edits were not inRegular Edits Vandalism stances of vandalism. Not surprisingly, unregistered users more frequently vandalized articles than registered users, 16% to 1% respectively. See Figure 2 for Venn diagrams which highlight how often an article had text modified, deleted, inserted, or any combination of these actions. Note that vandals are significantly more likely to insert text and are much less likely to make multiple changes in one revision.
In Table 1, we present our top 10 ranked features according to information gain.
Table 2 compares the performance of our classifiers using stratified 10-fold cross
validation on the training data. Table 3 presents the results on the PAN 2010 Wikipedia
Vandalism test corpus[
The authors of [
C4.5 Decision Tree NBTree statistics for both registered and unregistered users as well as edits made by those users or IP addresses that frequently contribute to the article in Table 4. 5
Our NBTree-based classifier outperforms the baseline classifier for two reasons. First, the features we selected – editor information, sentiment change, etc. – convey more information about each edit than the simple bag of words model. Second, by using an NBTree, we enable the classifier to partition the diverse space of edits into regions that are more amenable to Bayesian classification.
Five of our top ten features involved editor information. Current Wikipedia bots make limited use of editor information, but our results show that they could do more. In fact, our NBTree approach benefited most from how many contributions a particular Wikipedia User or IP address has made. Other important editor attributes were edit frequency, i.e. whether the editor is currently active, and whether the editor had contributed to the article being revised.
Another observation yielded by our highest ranked features is that simple features outperformed our more sophisticated features. The only sophisticated feature that appeared in the top ten ranked attributes was change in sentiment. Figure 3 shows the values of the change in sentiment score. We note that for vandalizing edits, the mean change in sentiment was 0:14 with a standard deviation of 2:0 and for regular edits the mean change was 0:03 with a standard deviation of 1:1. Although most edits, vandalism and otherwise, had zero change in sentiment score, we note that vandalism skews towards a negative change in sentiment and regular edits positively, which appears to make sense intuitively. Because of time and resource constraints, we were not able to confirm if either A) vandalism introduces more polarizing than subjective statements, B) the polarity detector is more effective than the subjectivity detector software or C) Type of user FP rate Recall Precision Registered users < 0.1% 22.0% 68.4% Registered users that edited this article 10 times or more <0.01% 0.0% 0.0% Unregistered users 3.9% 40.8% 67.2% IP addresses that edited this article 10 times or more 1.7% 33.3% 50.0% Table 4. Performance of our classifier for registered and unregistered users as well as frequent contributors subjective or polarizing statements do not constitute a significant percentage of vandalism. We approached the more sophisticated features like the sentiment analysis with an off-the-shelf approach. Therefore, we used pre-existing datasets and software APIs to gather feature values. We hypothesize that employing Wikipedia specific examples may perform more precisely in detecting subjectivity and polarity in article revisions.
As mentioned before, the initial partition performed by the NBTree evaluated how many contributions a registered user or an IP address has made to Wikipedia. Interestingly the benefit of this feature is not exclusive to registered users. IP addresses that have contributed significantly in the past have a lower vandalism to regular edit ratio in this dataset than those IP addresses that have only contributed a handful of edits. In our training data, the ratio of regular edits to vandalized edits for IP addresses with more than 10000 previous edits and IP addresses with less than 100 previous edits is 76:0 and 3:6 respectively. We gathered information about 5 IP addresses in the training set with the most contributions and found that they were located near universities and one was owned by Microsoft (according to the reverse DNS). Therefore, what does this suggest for Wikipedia? Certain IP addresses and geographic areas are conducive to recruiting future Wikipedians - that these individuals have demonstrated a commitment to the integrity of the site. This would grant more accountability and perhaps better expose the malicious edits from these “good” IP addresses.
Two of our features unexpectedly behaved similarly to the edit distance feature. First, we note that the larger the edit distance, the more likely the edit is not vandalizing the article. We found that our grammar and misspelled words feature ultimately behaved in a similar fashion. For misspelled words, the larger the edit, the more likely our dictionary found misspelled words. Analyzing the top 10 edits with the most misspelled words (all non-vandalizing edits), we observed that these articles contained many nonEnglish or unique pronouns. For example, one article on the movie “Blue Hills Avenue” had many misspellings because the dictionary could not recognize several of the character names. Therefore, we suggest for future dictionaries to build an article specific dictionary that incorporates words that survive several revisions or appear to be integral to the article (a summarization technique could be a good first approximation for this approach). Our grammar checker also had similar issues, arising from difficulties with part-of-speech tagging certain words. Another problem unique to the grammar checker is that several different types of tabulations and enumerations are used throughout Wikipedia. An obvious improvement for implementing a grammar checker is to ignore any modification that occurs in either a table, list or infobox. In future testing, we plan to implement these changes.
Our classifier had tremendous difficulty classifying vandalism by registered users.
A sizable chunk of these vandalizing edits come from users that registered just before
submitting the edit, and therefore are very suspicious, but the rest of these vandalizing
edits are much more difficult to detect. Registered users infrequently vandalize articles,
so we have little training data to learn from. We noted in two of ten cases that we
manually inspected that there was a strong argument to not classify the edit as vandalism.
For example, one edit introduced a link to “Sex Magic”, which may appear on face
value to be nonsense. On further investigation, it turns out that this is indeed an article
in Wikipedia. As we are indebted to Potthast et al. for their dataset[
Lastly, we hypothesize the success of the NBTree arises from the fact that vandalism is too diverse to be captured by a “one-size-fits-all” approach and requires partitioning the training space to find edits with common features. In our experiments, the Weka toolkit allowed us to test several different types of classifiers including meta-classifiers, neural networks, support vector machines and decision trees. Ultimately, decision trees fared better than other classification schemes and the C4.5 and NBTree the best. Some partitions in the NBTree, as seen in Figure 1, take advantage of the fact that it is highly unlikely that edits which meet a certain criterion will contain vandalism (e.g. a frequent contributor to Wikipedia). We hope to explore how we can further identify particular types of vandalism and build precise and effective classifiers for them automatically. This paper presents new features and algorithms to improve classification of vandalism. We found that features regarding information about the editor, misspellings, obscene words, detection of repetitive patterns and change in sentiment effectively classified vandalism. These features combined with the NBTree classifier gave an AUC score of 91% for a 10-fold stratified cross validation of our training corpus and 88.7% on the PAN 2010 testing corpus. We hope to expand upon these features and look for new ways to compare the content inserted, modified or deleted with previous revisions to determine if such actions constitute vandalism.
We would like to acknowledge Tamara Berg and Luis Ortiz for their guidance and suggestions.