{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T20:08:25Z","timestamp":1780344505571,"version":"3.54.1"},"reference-count":69,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2017,7,25]],"date-time":"2017-07-25T00:00:00Z","timestamp":1500940800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1527939 and IIS-1321083"],"award-info":[{"award-number":["CNS-1527939 and IIS-1321083"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Web"],"published-print":{"date-parts":[[2017,11,30]]},"abstract":"<jats:p>The next generation of Internet services is driven by users and user-generated content. The complex nature of user behavior makes it highly challenging to manage and secure online services. On one hand, service providers cannot effectively prevent attackers from creating large numbers of fake identities to disseminate unwanted content (e.g., spam). On the other hand, abusive behavior from real users also poses significant threats (e.g., cyberbullying).<\/jats:p>\n          <jats:p>\n            In this article, we propose clickstream models to characterize user behavior in large online services. By analyzing clickstream traces (i.e., sequences of click events from users), we seek to achieve two goals: (1) detection: to capture distinct user groups for the detection of malicious accounts, and (2) understanding: to extract semantic information from user groups to understand the captured behavior. To achieve these goals, we build two related systems. The\n            <jats:italic>first<\/jats:italic>\n            one is a\n            <jats:italic>semisupervised<\/jats:italic>\n            system to detect malicious user accounts (Sybils). The core idea is to build a clickstream similarity graph where each node is a user and an edge captures the similarity of two users\u2019 clickstreams. Based on this graph, we propose a coloring scheme to identify groups of malicious accounts without relying on a large labeled dataset. We validate the system using ground-truth clickstream traces of 16,000 real and Sybil users from Renren, a large Chinese social network. The\n            <jats:italic>second<\/jats:italic>\n            system is an\n            <jats:italic>unsupervised<\/jats:italic>\n            system that aims to capture and understand the fine-grained user behavior. Instead of binary classification (malicious or benign), this model identifies the natural groups of user behavior and automatically extracts features to interpret their semantic meanings. Applying this system to Renren and another online social network, Whisper (100K users), we help service providers identify unexpected user behaviors and even predict users\u2019 future actions. Both systems received positive feedback from our industrial collaborators including Renren, LinkedIn, and Whisper after testing on their internal clickstream data.\n          <\/jats:p>","DOI":"10.1145\/3068332","type":"journal-article","created":{"date-parts":[[2017,7,25]],"date-time":"2017-07-25T12:14:39Z","timestamp":1500984879000},"page":"1-37","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":44,"title":["Clickstream User Behavior Models"],"prefix":"10.1145","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8910-8979","authenticated-orcid":false,"given":"Gang","family":"Wang","sequence":"first","affiliation":[{"name":"Virginia Tech and UC Santa Barbara, Blacksburg, VA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinyi","family":"Zhang","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, Harold Frank Hall, Santa Barbara, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shiliang","family":"Tang","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, Santa Barbara, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christo","family":"Wilson","sequence":"additional","affiliation":[{"name":"Northeastern University, Boston, MA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haitao","family":"Zheng","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, Santa Barbara, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ben Y.","family":"Zhao","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, Santa Barbara, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,7,25]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the International Conference on Information Technology (ICIT'00)","author":"Banerjee Arindam","year":"2000"},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of the Web Mining Workshop at the 1st SIAM Conference on Data Mining (CDM'01)","author":"Banerjee Arindam","year":"2001"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference (CEAS'10)","author":"Benevenuto Fabricio","year":"2010"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644900"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2488388.2488400"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2015.11.043"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2008\/10\/P10008"},{"key":"e_1_2_1_9_1","unstructured":"Armand Brahaj. 2009. English Stop Words. Retrieved from http:\/\/xpo6.com\/list-of-english-stop-words\/.  Armand Brahaj. 2009. English Stop Words. Retrieved from http:\/\/xpo6.com\/list-of-english-stop-words\/."},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the USENIX Conference on Networked Systems Design and Implementation (NSDI'12)","author":"Cao Qiang","year":"2012"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660269"},{"key":"e_1_2_1_12_1","volume-title":"Facebook has more than 83 million illegitimate accounts. BBC News. (August","author":"Cellan Rory","year":"2012"},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the AAAI International Conference on Web and Social Media (ICWSM'15)","author":"Correa Denzil"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS'09)","author":"Danezis George","year":"2009"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45748-8_24"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the International Conference on Knowledge Discovery and Data Mining (KDD'96)","author":"Ester Martin","year":"1996"},{"key":"e_1_2_1_17_1","unstructured":"Facebook. 2013. Verify Facebook Account. Retrieved from https:\/\/www.facebook.com\/help\/398085743567023\/.  Facebook. 2013. Verify Facebook Account. Retrieved from https:\/\/www.facebook.com\/help\/398085743567023\/."},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the ACM SIGCOMM Conference on Internet Measurement (IMC'10)","author":"Gao Hongyu"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2441776.2441873"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866311"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/956750.956815"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.2307\/2346830"},{"key":"e_1_2_1_23_1","volume-title":"Chi","author":"Heer Jeffrey","year":"2002"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/503376.503420"},{"key":"e_1_2_1_25_1","volume-title":"Hofgesang and Wojtek Kowalczyk","author":"Peter","year":"2005"},{"key":"e_1_2_1_26_1","volume-title":"Analyzing negative user behavior in a semi-anonymous social network. CoRR abs\/1404.3839","author":"Hosseinmardi Homa","year":"2014"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-22424-9_4"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879190"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623632"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2746403"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1006\/jpdc.1997.1404"},{"key":"e_1_2_1_32_1","volume-title":"Finding Groups in Data: An Introduction to Cluster Analysis","author":"Kaufman Leonard"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702529"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1038\/234034a0"},{"key":"e_1_2_1_35_1","volume-title":"Proceedings of the International Conference on World Wide Web (WWW'16)","author":"Li Yixuan"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the Web Mining and Web Usage Analysis Workshop (WebKDD'05)","author":"Lu Lin","year":"2005"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2470654.2466442"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879191"},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the USENIX Security Symposium (Usenix Security'10)","author":"Motoyama Marti","year":"2010"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068824"},{"key":"e_1_2_1_41_1","volume-title":"Proceedings of the USENIX Security Symposium (Usenix Security'11)","author":"Motoyama Marti"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2187836.2187863"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702527"},{"key":"e_1_2_1_44_1","volume-title":"Advances in Kernel Methods","author":"Platt John C."},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/1367497.1367617"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI.2004.50"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644899"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/846183.846188"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920263"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.elerap.2014.10.002"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1089\/cpb.1998.1.275"},{"key":"e_1_2_1_52_1","volume-title":"Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET'12)","author":"Thomas Kurt","year":"2012"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068840"},{"key":"e_1_2_1_54_1","volume-title":"Proceedings of the International Conference on Web Intelligence (ICWI'05)","author":"Ting Hsien","year":"2005"},{"key":"e_1_2_1_55_1","volume-title":"Proceedings of the USENIX Conference on Networked Systems Design and Implementation (NSDI'09)","author":"Tran Nguyen","year":"2009"},{"key":"e_1_2_1_56_1","unstructured":"Cecilia Vega. 2012. Yelp Outs Companies That Pay for Positive Reviews. ABC News. Retrieved from http:\/\/abcnews.go.com\/blogs\/business\/2012\/11\/yelp-outs-companies-that-pay-for-positive-reviews.  Cecilia Vega. 2012. Yelp Outs Companies That Pay for Positive Reviews. ABC News. Retrieved from http:\/\/abcnews.go.com\/blogs\/business\/2012\/11\/yelp-outs-companies-that-pay-for-positive-reviews."},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/1851182.1851226"},{"key":"e_1_2_1_58_1","volume-title":"Proceedings of the International Conference on Security and Cryptography (SECRYPT'10)","author":"Wang Alex Hai","year":"2010"},{"key":"e_1_2_1_59_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS'13)","author":"Wang Gang"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663728"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/2187836.2187928"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/1124772.1124851"},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2012.6400494"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519089"},{"key":"e_1_2_1_65_1","volume-title":"Proceedings of the International Conference on Machine Learning (ICML'97)","author":"Yang Yiming"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068841"},{"key":"e_1_2_1_67_1","volume-title":"Detecting spam in a Twitter network. First Monday 15, 1","author":"Yardi Sarita","year":"2010"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.13"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159945"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702419"}],"container-title":["ACM Transactions on the Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3068332","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3068332","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3068332","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:03:44Z","timestamp":1750215824000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3068332"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,7,25]]},"references-count":69,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2017,11,30]]}},"alternative-id":["10.1145\/3068332"],"URL":"https:\/\/doi.org\/10.1145\/3068332","relation":{},"ISSN":["1559-1131","1559-114X"],"issn-type":[{"value":"1559-1131","type":"print"},{"value":"1559-114X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,7,25]]},"assertion":[{"value":"2016-06-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2017-03-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2017-07-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}