Publisher Copyright: © 2026 Owner/Author.

Detecting social bots is crucial for mitigating the spread of misinformation and preserving online conversation authenticity. State-of-the-art solutions typically leverage graph neural networks (GNNs) to model user representations from social relationships and metadata. However, these approaches overlook two key factors: the similarity of a user and her neighbors, as well as the coordinated behaviors of social bots, resulting in a suboptimal detection performance. To address these issues, we propose HyperScan, a novel representation learning method for social bot detection. Specifically, we introduce three effective learners to capture pair-wise, hop-wise, and group-wise relations. HyperScan learns pair-wise user representations based on social relations and user features. It then enhances user representations by building hop-wise interactions across the learned pair-wise user representations for capturing the structure-level proximity information. Subsequently, it models user representations by constructing higher-order (group-wise) relations derived from user profiles, tweets, and social relations to capture the feature-level proximity knowledge. By leveraging hop-wise interactions and higher-order relations, HyperScan significantly improves bot detection performance. Our extensive experiments demonstrate that HyperScan outperforms state-of-the-art methods on three benchmark datasets. Additional studies validate the robustness and effectiveness of each component of HyperScan.

Recently, decentralized online social networks (DOSNs) such as Mastodon have emerged quickly, bringing new opportunities for studies in user behavior modeling and multi-modal learning. However, their decentralized architecture presents two key challenges: 1) Distributed data and inconsistent access strategies across several individual instances make a unified collection difficult; 2) user-generated content (UGC) contains multiple modalities while lacking standard organization and high-quality annotation. To address these issues, we constructed FediData, a comprehensive multi-modal dataset from Mastodon. Our dataset integrates user profiles, text, images, and social interactions. To validate FediData's usefulness, we designed and analyzed several tasks and systematically evaluated the performance of existing state-of-the-art methods. Our analysis reveals the unique challenges of DOSNs and highlights the value of FediData in DOSN-related studies. We believe FediData could serve as a foundational dataset for advancing user behavior analytics, multi-modal learning, and future decentralized web research. All data and documentation are available in a Zenodo repository at https://zenodo.org/records/15621243 (DOI: 10.5281/zenodo.15621243).

Phone number recycling (PNR) refers to the event wherein a mobile operator collects a disconnected number and reassigns it to a new owner. It has posed a threat to the reliability of the existing authentication solution for e-commerce platforms. Specifically, a new owner of a reassigned number can access the application account with which the number is associated, and may perform fraudulent activities. Existing solutions that employ a reassigned number database from mobile operators are costly for e-commerce platforms with large-scale users. Thus, alternative solutions that depend on only the information of the applications are imperative. In this work, we study the problem of detecting accounts that have been compromised owing to the reassignment of phone numbers. Our analysis on Meituan’s real-world dataset shows that compromised accounts have unique statistical features and temporal patterns. Based on the observations, we propose a novel model called temporal pattern and statistical feature fusion model (TSF) to tackle the problem, which integrates a temporal pattern encoder and a statistical feature encoder to capture behavioral evolutionary interaction and significant operation features. Extensive experiments on the Meituan and IEEE-CIS datasets show that TSF significantly outperforms the baselines, demonstrating its effectiveness in detecting compromised accounts due to reassigned numbers.

Online-to-Offline (O2O) e-commerce service platforms and their users are faced with various fraud risks. Among them, financial identity theft is a widely existing challenge. However, existing methods are insufficient to detect this type of fraud. In this paper, we address the financial identity theft detection problem in e-commerce services by leveraging access environment and behavior sequence. To explore the fraud patterns, we first make a detailed analysis using real cases of identity theft from Meituan, a leading O2O e-commerce platform in China. Our findings are twofold. First, fraudulent accounts sharing the same personal ID would have different access environments, such as devices and IP addresses. Second, a group of fraudulent accounts may have aggregations of devices, IP addresses, and delivery addresses. Based on these observations, we propose a hybrid method termed EnvIT to detect financial identity theft based on the heterogeneous graph and the behavior sequence. EnvIT is able to characterize the access environment and the historical behavior of the accounts. Furthermore, an attentive module is adopted to assign weights to different features automatically. We further evaluate EnvIT via extensive experiments using a real-world dataset from Meituan. Our experimental results demonstrate that EnvIt outperforms several baseline methods in fraudulent account detection and achieves an AUC of 0.9210.

Account takeover is a type of malicious attack where a fraudster steals accounts and passwords from normal users, causing the loss of money and the exposure of personal information. Existing solutions either rely on extensive manual labeling, or require behavior sequences and context graphs of accounts. In this paper, I propose a Siamese neural Network-based Multi-Relation Graph Embedding method (MRGE-SiameseNet) to detect stolen accounts. The key idea of MRGE-SiameseNet is that the two inputs from the same users are similar. I adopt the idea of the siamese neural network to judge whether two different inputs are from the same user. To get a powerful representation of each account, I integrate several embeddings of multiple relationships of accounts and profile feature embedding for each account with multi-head attention mechanism. The fully connected module is employed to obtain the similarity score, which can be utilized to identify whether the account is stolen by account takeover.

Summary The problem of influence maximization (IM) has become an important research topic due to the rapid growth of mobile social networks. It attempts to identify a set of nodes, referred to as influencers, contributing to the spread of maximum information. In this article, we present the construction of social relation graph based on mobile communication data. And we propose a new centrality measure—activity degree to characterize the activity of nodes. By combining the local attributes of nodes and the behavioral characteristics of nodes to measure node activity degree, which can be used to evaluate the influence of users in mobile social networks, we introduce Susceptible‐Infected‐Susceptible model to simulate the dynamic spreading of information. We take advantage of the two indicators the degree centrality and the betweenness centrality to get a better ranking results. In comparison with spanning graph and initial graph, the results of comparison demonstrate that our algorithm has advantages in the scope of influence propagation.