This paper overviews 9 vandalism detectors that have been developed and evaluated within PAN'10. We start with a survey of 55 different kinds of features employed in the detectors. Then, the detectors' performances are evaluated in detail based on precision, recall, and the receiver operating characteristic. Finally, we set up a meta detector that combines all detectors into one, which turns out to outperform even the best performing detector.
Wikipedia allows everyone to edit its articles, and most of Wikipedia’s editors do so for
the best. Some, however, don’t, and undoing their vandalism requires the time and effort
of many. In recent years, a couple of tools have been developed to assist with detecting
vandalism, but little is known about their detection performance, while research on
vandalism detection is still in its infancy. To foster both research and development, we
have organized the 1st competition on vandalism detection, held in conjunction with
the 2010 CLEF conference. In this paper we overview the detection approaches of the
9 participating groups and evaluate their performance.
1.1
We define an edit e as the transition from one Wikipedia article revision to another,
where E is the set of all edits on Wikipedia. The task of a vandalism detector is to
decide whether a given edit e has been done in bad faith or not. To address this task by
means of machine learning three things are needed: a corpus Ec ⊂ E of pre-classified
edits, an edit model α : E → E, and a classifier c : E → {0, 1}. The edit model
maps an edit e onto a vector e of numerical values, called features, where each feature
quantifies a certain characteristic of e that indicates vandalism. The classifier maps these
feature vectors onto {0, 1}, where 0 denotes regular edits and 1 vandalism edits. Some
classifiers map onto [
To evaluate a vandalism detector, a corpus of pre-classified edits along with detection
performance measures are required. The corpus is split into a training set and a test set.
The former is used to train a vandalism detector, while the latter is used to measure its
detection performance. For this purpose we have compiled the PAN Wikipedia
vandalism corpus 2010, PAN-WVC-10 [
Detection Performance Measures. A starting point for the quantification of any classifier’s performance is its confusion matrix, which contrasts how often its predictions on a test set match the actual classification:
P N
P TP FN
N FP TN In the case of vandalism detectors, vandalism is denoted as P and regular edits as N: TP is the number of edits that are correctly identified as vandalism (true positives), and FP is the number of edits that are untruly identified as vandalism (false positives). Likewise, FN and TN count false negatives and true negatives. Important performance measures are computed from this matrix, such as the TP rate, the FP rate, or recall and precision:
TP recall = TP -rate = TP + FN
TP precision = TP + FP
FP FP -rate = FP + TN
Plotting precision versus recall spans the precision-recall space, and plotting the TP rate versus the FP rate spans the ROC space. The former is used widely in information retrieval as performance visualization, while the latter is used preferably in machine learning. Despite the fact that recall and TP rate are the same, both spaces visualize different performance aspects and they possess unique properties. In Figure 1 the two
1 regular 2 vandalism 3 vandalism 4 vandalism 5 regular 6 regular 7 vandalism 8 vandalism 9 vandalism 10 vandalism
1 0.8 ion0.6 s i c e rP0.4 0.2 0 0 spaces are exemplified. Figure 1a lists 20 test edits along with the fact whether or not they are vandalism. For a vandalism detector A its predictions with regard to the classes of every edit are given. Figure 1b shows the confusion matrix of detector A when τ is set to 0.58 as well as the confusion matrices of three additional detectors B, C, and D. Note that every confusion matrix corresponds to one point in both spaces; Figures 1c and 1d show the precision-recall space and the ROC space: – Precision-Recall Space. The corners of precision-recall space denote extreme cases: at (0,0) none of the edits classified as vandalism are in fact vandalism, at (1,1) all edits classified as vandalism are vandalism; close to (1,0) all edits are classified as vandalism, and close to (0,1) all edits are classified as being regular. Observe that the latter two points are gaps of definition and therefore unreachable in practice: when constructing a test set to approach them, the values of the confusion matrix become contradictory. The dashed line shows the expected performances of detectors that select classes at random. Note that the classifier characteristics shown in precision-recall space depend on the class distribution in the test set. – ROC Space. The corners of ROC space denote extreme cases: at (0,0) all edits are classified as regular, at (1,1) all edits are classified as vandalism; at (1,0) all edits are classified correctly, at (0,1) all edits are classified incorrectly. The diagonal from (0,0) to (1,1) shows the expected performances of detectors that select classes at random; the ROC space is symmetric about this diagonal by flipping a detector’s decisions from vandalism to regular and vice versa. Note that classifier characteristics shown in ROC space are independent of the class distribution in the test set.
Changing the threshold τ of detector A will lead to a new confusion matrix and,
consequently, to a new point in precision-recall space and ROC space respectively. By
varying τ between 0 and 1 a curve is produced in both spaces, as shown in Figures 1c
and 1d. Note that in precision-recall space such curves have sawtooth shape, while in
ROC space they are step curves from (0,0) to (1,1). In information retrieval,
precisionrecall curves are smoothed, which, however, is unnecessary in large-scale classification
tasks, since the class imbalance is not as high as in Web search. By measuring the
area under a curve, AUC, a single performance value is obtained that is independent
of τ . The better a detector performs, the bigger its AUC. Observe that maximizing the
ROC-AUC does not necessarily maximize the precision-recall-AUC [
From the above it becomes clear that detector A performs best in this example, closely followed by detectors B and D, which perform equally well. Detector C is no better than a random detector that classifies an edit as vandalism with probability 0.7. 2
Out of 9 groups, 5 submitted a report describing their vandalism detector, while 2 sent brief descriptions. This section surveys the detectors in a unified manner. We examine the edit model used, and the machine learning algorithms that have been employed to train the classifiers.
An edit model function α is made up of features that are supposed to indicate vandalism. A well-chosen set of features makes the task to train a classifier that detects vandalism much easier, whereas a not so well-chosen set of features forestalls a betterthan-chance detection performance. Hence, feature engineering is crucial to the success of a vandalism detector. Note in this connection that no single feature can be expected to separate regular edits from vandalism perfectly. Instead, a set of features does the trick, where each feature highlights different aspects of vandalism, and where the subsequently employed machine learning algorithm is left with using the information provided by the feature set to train a classifier.
We organize the features employed by all detectors into two categories: features
based on an edit’s content (cf. Table 1) and features based on meta information about
an edit (cf. Table 2). Each table row describes a particular kind of feature. Moreover,
Character-level Features
Capitalization Ratio of upper case chars to lower case chars (all chars). [
Number of capital words. [
Length of the longest repeated char sequence. [
Vulgarism impact: ratio of new vulgar words to those present in the article. [
Spelling Frequency (impact) of spelling errors.
Grammar Number of grammatical errors.
Edit Size Features Revision size Size difference ratio between the old revision and the new one. Distance Edit distance between the old revision and the new revision.
Diff size Number of inserted (deleted, changed) chars (words).
Edit Type Features Edit Type The edit is an insertion, deletion, modification, or a combination. Replacement The article (a paragraph) is completely replaced, excluding its title. Revert The edit reverts an article back to a previous revision.
Blanking Whether the whole article has been deleted.
Links and Files Number of added links (files)
Article Trustworthiness Features Suspect Topic The article is on the list of often vandalized articles.
WikiTrust Values from the WikiTrust trust histogram.
Number of words with a certain WikiTrust reputation score.
Editor Reputation Features Anonymous Anonymous editor.
Known Editor Editor is administrator (on the list of reviewers) Edits Number of previous edits by the same editor.
Number of previous edits by the same editor on the same article.
Reputation Scores that compute a user’s reputation based on previous edits. Reverts Number of reverted edits, or participation in edit wars.
Vandalism Editor vandalized before.
Registration Time the editor was registered with Wikipedia. the right table column indicates who employed which feature in their detectors. Note that our descriptions are not as detailed as those of the original authors, and that they have been reformulated where appropriate in order to highlight similar feature ideas.
Content-based features as well as meta information-based features further subdivide into groups of similar kinds. Content-based features on character-level aim at vandalism that sticks out due to unusual typing, whereas features on word-level use dictionaries to quantify the usage of certain word classes and words often used by vandals. Some features even quantify spelling and grammar mistakes. The size of an edit is measured in various ways, and certain edit types are distinguished. The meta information-based features evaluate the comment left by an editor, and the time-related information about an edit. Other features quantify certain characteristics about the edited article in order to better inform the machine learning algorithm about the prevalence of vandalism in an article’s history. Moreover, information about an editor’s reputation is quantified assuming that reputable editors are less likely to vandalize.
Finally, all groups, who submitted a description of their approach, employed decision trees in their detectors, such as random forests, alternating decision trees, naive Bayes decision trees, and C4.5 decision trees. Two groups additionally employed other classifiers in an ensemble classifier. The winning detector uses a random forest of 1000 trees at 5 random features each. 3
In this section we report on the detection performances of the vandalism detectors that took part in PAN. To determine the winning detector, their overall detection performance is measured as AUC in ROC space and precision-recall space. Moreover, the detectors’ curves are visualized in both spaces to gain further insight into their performance characteristics. Finally, we train and evaluate a meta detector which combines the predictions made by the individual detectors to determine what performance can be expected from a detector that incorporates all of the aforementioned features. We find that the meta detector outperforms all of the other detectors. 3.1
n o i s i c e r P 0 0 Mola Velasco
Adler Javanmardi
Chichkov Seaward Hegedüs Harpalani
White
Iftene Random
Detector 0.2 0.4 0.6 0.8
1 Recall detector clearly outperforms the other detectors by far in precision-recall space, but it does not dominate all of them, which shows possibilities for improvements. Nevertheless, its threshold can be adjusted so that 20% of the vandalism cases will be detected with virtually perfect precision, i.e., it can be used without constant manual doublechecking of its decisions. This has serious practical implications and cannot be said of any other detector in the competition.
By contrast, in ROC space, the detectors’ curves appear to be much more uniform. Still, some detectors perform worse than others, but differences are less obvious. The top 4 detectors and the detectors on ranks 5–8 behave similar at FP rates below 0.4. The winning detector is outperformed by those of Chichkov and Javanmardi at FP rates between 0.1 and 0.2, as well as those of Adler et al., Hegedu˝ s et al., and Seaward at FP rates above 0.6. Altogether, this visualization supports the winning detector but e t a r P T
1 0.8 0 0 0.2 0.4 it does not set it apart from the rest, which may lead to the conclusion that the different approaches and feature sets employed are not so different, after all.
Discussion. The differences between precision-recall space and ROC space underline that they indeed possess unique properties, but they also raise the question, who’s right? To answer this question for a particular classification task, it has to be determined whether the precision or the FP rate is more important. For vandalism detection, due to the class imbalance between regular edits and vandalism edits, precision may be more important, which questions our decision made before the competition to use the ROC-AUC to rank vandalism detectors. 3.3
Our evaluation shows that there is definite potential to improve vandalism detectors even further: the winning detector does not dominate all other detectors, and more importantly, no detector uses all features, yet. In what follows, we report on an experiment to determine what the performance of a detector that incorporates all features would be. To this end, we have set up the PAN’10 meta detector that trains a classifier based on the predictions of all vandalism detectors for the set of test edits. The meta detector thus combines the feature information encoded in the detectors’ predictions.
Let Ec denote the PAN-WVC-10 corpus of edits whose classification is known, and
let C denote the set of detectors developed for PAN, where every c ∈ C maps an edit
model αc(e) = e, e ∈ Ec, onto [
Lessons learned from the competition include that the evaluation of vandalism detectors cannot be done solely based on the receiver operating characteristic, ROC, and the area under ROC curves. Instead, an evaluation based on precision and recall provides more insights. Despite the good performances achieved, vandalism detectors still have a long way to go, which pertains particularly to the development of vandalismindicating features. It is still unclear, which features contribute how much to the detection performance. Finally, the corpora used to evaluate vandalism detectors require further improvement with regard to annotation errors. Future evaluations of vandalism detectors will have to address these shortcomings.