-Generally, users of an 'ego' social network provide Still it is highly desirable to have an automatic analysis personal information and actively participate in groups to discuss that can dynamically incorporate data available on the social some topic. We propose a multi-agent driven system to analyse network over time. This is fundamental for building advanced aucsteirvibteiehsavainodursahnodwint hteartesatsmboyrgeatchoemripnrgehdeantasivreelaidteednttiotydicffaenrebnet services such as e.g. the timely identification of autogenous built from sparse data, while possibly reveal the tentative of some threats. An automated mechanism should take advantage of users to deceive other people. In our approach, user profiles are soft computing approach such as soft artificial intelligence [5], given to a profiling agent that retains relevant data by using particle swarm optimisation and positioning [6], [7], [8], ANN technologies that find categories for users. Even new users, evolutionary methods [9], swarm intelligence [10], neural netcwahteogseorpyr,otfilheerisefsotriell tmheosttrlayitusnodfefinsuecdh, aarecagteivgeonryaa'rme oisntf-elirkreeldy'for works [11], etc.... Neural networks has been proven effective new users. Since a group in a social network such as Facebook for a large number of problems which cannot be solved in can be seen as a category, the agent driven system is also able terms of a priori mathematical models [12], [13], especially to classify user profiles and recommend new groups users can when used with hybrid architectures [14]. We propose an agent subscribe to, according to their interests and preferences. driven artificial intelligence system based upon a Radial Basis Index Terms-Neural Networks, Social Networks, Artificial Probabilistic Neural Network (RBPNN), which is well known Intelligence, Security, Multi-agent Systems. for its capability to classify and generalise datasets and can be continuously trained to recognise novel features, hence can I. INTRODUCTION easily cope with changing data. The proposed neural network Trust and reliability of data available on social networks has been embedded into a Classification Agent that builds a are important concerns for both service providers and sub- model out of data coming from user profiles, and handled scribers. Given the large size of a social network, in terms by other agents, such as a Profiling Agent and a Crawler of subscribers, data exchanged, and number of links (such as Agent, which retain useful data from different parts of an 'ego' friendship, following, membership to groups, endorsements, social network [15], such as Facebook(R). When analysing etc.), it is desirable to have an automatic way to efficiently a social network, as Facebook, the main difficulties are due process data to ensure security and validate at least some con- to: the unknown number of subscribers, friendship relations, tents. User feature and behavioural analysis are two interesting groups, followers, etc.; and the unknown size of data and and important means upon which a solution can be build. features for each subscriber. We overcome such difficulties The first step in this direction is to group users into thanks to several agents, which handle data and retain a categories. Interesting performances have been achieved by representation (in our previous analyser version, a big amount systems analysing user interests, however, in general, such sys- of data has been properly processed using a GPU based tems are only intended for a small context, or for analysing se- solution [16], [17], [18], [19]). Specifically, our Classification lected users. Even though statistical methods make it possible Agent, according to the proposed RBPNN solution, can handle to characterise features and interests for a single user [1], it is partial data, acting as a modeller for dynamically changing difficult to build a proper analytical model for user interactions user' s profiles. With our classification approach, we are able due to the vastness of data available in a social network, i.e. to perform early identification of autogenous threats: firstly, an number of links, undetermined number of subscriber features, incoherent user profile could be identified when the RBPNN etc. A huge amount of features characterise subscribers, how- prediction of user behaviour, obtained by assigning the user ever a relevant portion of values for such features is missing to a category, differs from the actual behaviour; secondly, for many subscribers in a real environment, hence a complete deception can be revealed by matching user features with formulation of a comprehensive analytical model would be others of undesirable categories of users. Moreover, the agent unfeasible [2], [3], [4]. Moreover, the large amount of data system can use the same classification approach to recommend and the frequency of changes make the numerous reiterations new groups that fit user interests: this is achieved using group needed to formulate the analytical model very computationally subscriptions as categories, instead of the ones specifically costly. designed by the administrator to classify user behaviour.
This work analyses ‘ego’ networks and Facebook is
considered as a significant representing example. In ‘ego’ social
networks, the small-world properties are an important
characteristic for the actual social dynamic of the network [
Moreover, social networks follow a scale-free behaviour [
Our solution comprises different collaborating agents that can be considered independent parts of the social network that
make the social network administrators able to classify and still satisfy the scale-free properties. Clusters generally consist
monitor the user behaviour for security enforcement, other of users sharing a set of interests and activities, and users of
than enhancing their experience suggesting new groups they the same cluster form a sort of social neighbourhood [
The rest of this paper is structured as follows. Section II while being on the same group. When considering the
relagives the background on the dynamics of a social network. tionship of users and groups, we can see that a group acts as
Section III reports about analytical models for classification. a bridge for the contents to flow from a cluster to another (the
Section IV describes the proposed multi-agent system based clusters of the correspondent users). Hence, different parts of
on RBPNNs. Section V describes the Classification Agent. the network become mutually capable of exchanging contents,
Section VI and Section VII reports respectively the performed fostering the small-world behaviour of the social network [
and an online social network is given by the percolation of
links [
For social networks, such as Facebook, we identify two This decrease of interest is still true even in a social network, different kinds of relationships among users. A bidirectional however it has no corresponding support in practice. Such a interaction between a pair of users occurs when such a difficulty on the classification of links results into hard to grip pair exchanges a friendship. Additionally, Facebook provides data when performing an automatic analysis. Moreover, in a groups, i.e. a user is given means to broadcast contents to social network user features change steadily, thus it is difficult all the members of the same group where s/he belongs to. to determine the correlation between a user and his/her specific We define the mutual exchange of friendship between a pair field of interests. Generally, for social networks that let users of users as a strong connection between the pair, whereas participate in a group, an average subscriber tends to sign into for a pair of users that are members of the same group, the a large number of groups, while only a small amount of such membership provides a weak connection between such a pair. groups are really interesting for the user. When a user posts a content into a group, then the resulting The said wide-spread user behaviour would be difficult to one-to-all interaction provides a weak, and sometimes random, generalise using traditional approaches, which are not noise connection with members of the group, who generally share robust. In turn, automatic selections and suggestions of posts a limited number of interests. provided by friends or groups become less useful, because
We define the distance between a pair of users as follows. of such inaccuracies. Moreover, it is difficult to distinguish
When a pair has exchanged a friendship, then the distance is between trustworthy users and dishonest or unreliable ones.
simply 1, otherwise the distance is the minimum count of hops Even though the user profile can be potentially genuine,
differbetween the pair by following friendship or group connections. ently from social networks, human networks evolve following
Hence, weak connections (available to users belonging to the a homophily law [
From the friend list of each subscriber we identify clusters the stochastic behaviour typical of human beings is exhibited, of users. Clusters consist of users having a higher number an advanced nonlinear model is needed. of friendships toward users within the same cluster rather Due to the said untrustworthy, erratic, inconstant and unrethan toward users not belonging to the cluster. Analogous to liable behaviour of users, we maintain that it is paramount to distance between users, we define distance between a pair of uncover hidden or un-explicit interests, giving a representation clusters as the minimum count of hops between one user on of the effective relationships among users. Such (hidden) relathe first cluster from one in the second cluster. Distant clusters tionships are significant to findcategories of users exhibiting some common traits. Such an identified category would unveil features that can not be directly detected from the user profile.
datasets that determine properties and allow grouping data into
classes. Generative models are based on stochastic block
structures [
The main issue of class-based models is the type of relational structure that such solutions describe. Since the definition of a class is attribute-dependent, generally the reported models risk to replicate the existing classes for each new attribute added.
E.g. such models would be unable to efficiently organise (inherit) similarities between (from) the classes ‘cats’ and ‘dogs’ as child classes of the more general class ‘mammals’.
Such attribute-dependent classes would have to be replicated as the classification generates two different classes of ‘mammals’: the class ‘mammals as cats’ and the class ‘mammals as dogs’. Consequently, in order to distinguish between the different races of cats and dogs, it would be necessary to further multiply the ‘mammals’ class for each one of the identified race. As a consequence, such models quickly lead to an explosion of classes. In addition, we would either have to add another class to handle each specific use or a mixed membership model, as for crossbred species.
Another paradigm concerns the Non-Parametric Latent Feature Relational Model, i.e. a Bayesian nonparametric model in which each entity has boolean valued latent features that influence the model’s relations. Such relations depend on wellknown covariant sets, which are neither explicit or known in the case of a social network during the initial analysis. be reported to the administrator for further surveys on the user behaviour. This is achieved giving the profile of the threatening user to the Alert Agent, that constantly handles all the received notifications, timely warning the administrator with the potentially threats intercepted.
The administrator has also the ability to manually define categories built over the activity information of misbehaving users (see Section IV-C); if one of these categories is assigned to a user profile during classification, the Verification Agent will ask the Alert Agent to notify the administrator with the potential threat detected.
The administrator is then able to gather deeper information
IV. THE MULTI-AGENT SYSTEM on the user activities using the functionalities provided by Our aim is to provide to social network administrators a another agent, the Profiling Agent . Using this information, practical and effective tool to predict and monitor user be- s/he can decide what to do according to social network haviour and interests, both for security purposes and user expe- policies. If the user behaviour is considered not compliant rience enhancing. Figure 1 shows the agents for our designed with such policies, the administrator has the ability to use system: a Crawler Agent periodically and autonomously gath- the classification information to automatically identify other ers user information from their social network profiles, other users in the network with the same behaviour, asking the than the list of their group subscriptions. After some pre- Classification Agent to update the inner RBPNN model. On processing tasks, data are given to the Classification Agent the other hand, if the behaviour of the user can be considered that using the inner RBPNN assigns user profiles to known trustworthy, then the new classification label can be simply categories, according to the statistical model built on user in- passed to the Category Agent. formation during training phases. Due to the intrinsic dynamics Since we can see a group of a social network as a category that the social network imposes, this model is constantly and of users, that gets together people with common interests, incrementally updated. we can use the same approach just seen to classify user
The classification results, i.e. the associations between user profiles with the groups that better suit their interests. This profiles and categories, are given to the Verification Agent , type of classification results could be directly provided by the that asks the Category Agent to provide the categories already Classification Agent as recommendations for groups that user assigned to a specific user (if any), comparing them with the can subscribe to (see Section IV-D). ones just given from the Classification Agent results. If a specific user had no category assigned, the Verification Agent A. Computing comprehensive identities will notify the Category Agent with the newly one found; if User categories can be chosen by the Classification Agent instead the user already had a category assigned, but differing alone, which is statistically driven, and such categories have from the one just discovered, we could think at this as a a probabilistic meaning that contributes to identify the most clue for an autogenous threat (see Section IV-B) that should appropriate conceivable model for users. The ‘model’ should be intended as a kind of representation of the behaviour of a user on the social network. The identified category, provided by the inner RBPNN classifier, can complement and integrate the online identity provided by each subscriber.
Such a comprehensive identity, assigned automatically, can help further understanding user behaviours. To make this solution as independent as possible from the social network data infrastructure, we store and manage additional data with a further agent, that is the Category Agent, but where a more integrated solution is desirable (and conceivable), we can Fig. 2. RBPNN setup values: NF is the number of considered features, NS imagine to add such data directly inside the social network number of analysed subscribers, and NG desired number of categories. user profiles. Once a user belongs to a given category, the administrator can be warned by the Alert Agent to check Although in some moments it would depend on human whether the subscribers linked to a category of misbehaving activities (i.e. administrators), such a control system can users are performing activities that conflict with social network then be used to automatically restrict deeper surveys on a policies. When a user posts a content or subscribes to a small number of possibly dangerous users, so that situations group, the social network administration is aware of the when urgent actions are needed can be timely handled. This implicit or explicit choices made beforehand by that user. This automatic selection of users would avert the risk of having to ‘history’ helps understanding whether the current user activity restrain the entirety of subscribers. is coherent or appropriate.
Data are continuously sent to the Classification Agent, D. Group recommendation hence tentative categories identified for a new user are either Although in this work the RBPNN model has been used confirmed or changed according to the recent activities. Hence, to assign categories, which correspond to groups, the term more refined alert are given over time. ’categories’ has been used on purpose for its more general meaning. The Classification Agent, with its RBPNN model, B. Preventing deception and threats is able to find and propose non explicit groups, i.e. groups
Theoretically, the RBPNN used by the Classification Agent that have not yet been chosen by a subscriber, but which unveils behavioural patterns that the user is expected to follow. are very likely to be eventually chosen since they match the If a user begins to act according to a different behavioural preferences of the subscriber. In a similar way, this RBPNN pattern with respect to those for which s/he has been classified, can be arranged to select users having an high affinity toward then this variation can be used as an alert that let an admin- a group. I.e. the RBPNN can be asked to unveil the affinity of istrator monitor him/her and possibly apply some restrictions a user with a certain category of users, which can be intended after a deeper check has occurred. Such an alert is meant to not only as a group, but also as a behavioural category. reveal a compromised account that has been stolen. V. PROPOSED RBPNN BASED CLASSIFICATION AGENT
Once a user account has been confirmed as compromised, either manually or automatically, the supporting system can be set to rise a warning toward all the users that are the target of the activities of the perpetrator, in order to possibly avoid tentative deceptions.
Therefore, the proposed Classification Agent can be used to avoid autogenous threats, such as a misbehaving user or a thief, as much as a wide range of other online frauds and several violations. The more online behaviours are modelled, by training the RBPNN model with existing user data, the more positive and negative activities can be identified by the Classification Agent.
input dataset (see Section III). On the other hand, neural
networks have been largely used to uncover data classification and
find probabilistic categories for data. Therefore, we use Radial
Basis Probabilistic Neural Networks (RBPNN), managed by
an independent agent, to automatically findcategories of users,
whereby a category reveals common traits for users. Note
that group of ‘ego’ networks and social networks, such as
Facebook, can be seen as categories, which the RBPNN finds.
Our neural network, after being correctly trained, generates a
model for the latent user features, and finds users having such
features. This is usually considered both an interesting and
difficult task [
In a RBPNN both the input and the first hidden layer exactly match the PNN architecture. In a PNN, each hidden layer neuron performs the dot product of the input vector u by
Suppose that a user is disposed toward a bad behaviour on the network, then the Classification Agent would associate such a user with a category previously built by administrators, consisting of other misbehaving users. For building such a category, administrators would simply need to manually flag some selected users, interacting with the Category Agent to store these expert supervised associations. a weight vector W(0), and then gives output x(1) that is provided to the following summation layer. While preserving the PNN topology, to obtain the RBPNN capabilities, the activation function is a radial basis function (RBF). We name f the chosen RBF, so the output of the first hidden layer for the j-esime neuron is x(j1) , f ||u − W(0)|| β variable could report if the user is male or female; then in case the profile does not state the gender, the latter feature has no meaning and should not be considered. However, since our dataset gives no labels, we can not exclude any feature.
Although data are anonymised, users are identified with a unique ID. Moreover, the memberships of users to groups is indirectly identified from the list of subscribers to each group.
Data intended to be input for our RBPNN have been passed to a preprocessing stage, whereby for each user the corresponding feature list has been paired with the list of group memberships. This enables us to build a statistically driven classifier that identifies the correspondence between user features and their groups. where β is a parameter that controls the distribution shape.
The second hidden layer in a RBPNN is identical to that of a PNN, it just computes weighted sums of the values received from the preceding neurons. The training for the output layer is performed as in a classic RBNN, however since the number of summation units is very small and in general remarkably VII. RBPNN FINDINGS less than in usual RBNNs, training becomes simplified and Both user profiles, consisting of features, and user memberspeed greatly increased. ships to groups were provided to our RBPNN classifier during
The devised topology enable us to distribute different parts the training phase. Therefore, the RBPNN classifier has learnt of the classification task to different layers (see Figure 2). The how to reproduce the correct paths that associate lists of profile first hidden layer of the RBPNN is responsible to perform features with groups. the fundamental task expected from a neural network, i.e. Initially, we have asked our RBPNN to reconstruct the generalise and build an implicit model. The second hidden groups for 250 users. The RBPNN was able to correctly layer selectively sums the output of the first hidden layer. The assign users to the proper groups with only a 5.67% of output layer fulfils the nonlinear mapping, such as classifica- missing assignments: as a remarkable side effect while a tion, approximation and prediction. few groups were not found, no false positive was given (see
In order to have a proper classification of the input dataset, Figure 3). Moreover, if we compare the features for such i.e. of users into categories, the size of the input layer matches unclassified users and the average features of their groups, the number NF of features, labelled elements of the dataset relevant differences can be uncovered with respect to the (see Section VI), given to the RBPNN, whereas the size of the average (and correctly classified) user. Just for validation RBF units matches the number of examined subscribers NS . purposes, we have performed the same comparison for users The number of units in the second hidden layer is equal to the with an almost empty profile that the RBPNN could not insert number of output units, these match the number of categories into any category.
NG to be found for the subscribers. Then, we have asked our RBPNN to identify categories for new users. In Figure 3 new users are reported in black or
VI. EXPERIMENTAL SETUP green and are assigned to a group they have not expressed Since the paramount importance of the classification com- preferences in. For an appreciable percentage of users, i.e. ponent in the proposed multi-agent solution, we have deeply about 20%, the proposed RBPNN has indicated a group that tested the performance of the conceived RBPNN classifier (unknown to the RBPNN) users had membership to. Indeed, a used by the Classification Agent. We used a dataset consist- relevant number of the other 80% of user profiles is (almost) ing of features, i.e. a trace of the user activities and their empty, therefore no classifier, not only our RBPNN, would preferences, coming from real Facebook profiles. Data for manage. On the other hand, how many and which features the features that we have been given have a label which is suffice for a user to be classified depend on the model built a numerical ID, i.e. the feature itself can not be recognised, by the RBPNN (simply counting the number of empty features however this does not affect the scope of this work nor the is ineffective since they are not equally meaningful). analysis performed.
As far as the feature lists is concerned, data provide boolean VIII. CONCLUDING REMARKS
values. The presence or absence of a specific value is expressed With the recent growth of social networks usage, a keen
as a boolean flag, e.g. 1 if the user has declared his job or 0 if interest for privacy and deception has arisen. In [
The intrinsic structure of the dataset prevents us from social networking sites is not yet understood to a sufficient
considering only a reduced portion of the feature list for a degree. In [
have taken into account the category of words appearing in
texts [
We have proposed a multi-agent system for automatic analysis of data on a social network and have shown that interesting results can be obtained in terms of the knowledge on the behaviour of users. The proposed solution is based on RBPNN and finds for a user the most similar category (or social network group) s/he could belong to. Once the above solution would possibly be integrated with the servers handling user data, higher security levels could be achieved and the safety of the subscribers would be preserved, e.g. by timely warning administrator to intervene to check and stop autogenous threats.
PON04a2 A/F funded by the Italian Ministry of University within PON 2007-2013 framework, and by project PRIME funded by the Italian Ministry of University and Research within POR FESR Sicilia 2007-2013 framework.