In this work, we aim at building a bridge from coarse behavioral data to an effective, quick-response, and robust behavioral model for online identity theft detection. We concentrate on this issue in online social networks (OSNs) where users usually have composite behavioral records, consisting of multidimensional low-quality data, e.g., offline check-ins and online user-generated content (UGC). As an insightful result, we validate that there is a complementary effect among different dimensions of records for modeling users’ behavioral patterns. To deeply exploit such a complementary effect, we propose ajoint(instead offused) model to capture both online and offline features of a user’s composite behavior. We evaluate the proposed joint model by comparing it with typical models and their fused model on two real-world datasets: Foursquare and Yelp. The experimental results show that our model outperforms the existing ones, with the area under the receiver operating characteristic curve (AUC) values 0.956 in Foursquare and 0.947 in Yelp, respectively. Particularly, therecall(true positive rate) can reach up to 65.3% in Foursquare and 72.2% in Yelp with the correspondingdisturbance rate(false-positive rate) below 1%. It is worth mentioning that these performances can be achieved by examining only one composite behavior, which guarantees the low response latency of our method. This study would give the cybersecurity community new insights into whether and how real-time online identity authentication can be improved via modeling users’ composite behavioral patterns.

Workflow nets and their extensions with data flows, e.g., workflow nets with data and colored workflow nets, can well model the business processes of workflow systems, and their soundness guarantees that systems have neither deadlock nor livelock. However, some design requirements related to the changes of data values within multiple business cases are not reflected by these models, and thus, some errors of the modeled systems cannot be detected by them. In this article, we propose workflow nets with tables (WFT-nets) to model workflow systems that are closely related to the database (i.e., different users, records, and attributes). We define the firing rule of WFT-nets via data refinements in order to avoid infinite states caused by unbounded data. We use first-order linear temporal logic to represent the design requirements of records and attributes' values and then define the soundness of WFT-nets. We construct an algorithm to verify soundness. A tool is developed, and a group of experiments are done to illustrate the effectiveness of our methods.

We aim at exploiting users' coarse behavioral records for identity theft detection in online services. We concentrate on this issue in online social networks (OSNs) that users' behavioral records usually consist of multiple dimensional behavior data. The behavioral records in each dimension are possibly coarse and insufficient for effectively modeling users' behavioral patterns. In this paper, we investigate whether there is a complementary effect among different dimensions of records for modeling users' behavioral patterns. We focus on three typical dimensions of behaviors in OSNs, i.e., offline check-ins, online tip-postings, and social contacts. We devise the dedicated behavior models based on each dimension of data, i.e., users' behavioral projection models. Then, by examining all feasible logical combinations of them, we find the optimal ones for two real-world data sets: Foursquare and Yelp. Notably, we analyze the potential correlation between customized demand and optimal logical fusion scheme. As an insightful result, we find that the correlation is independent of the specific data. This study would give the cybersecurity community new insights into the possibility and methodology to achieve a customized identity theft detection in OSNs by integrating multiple behavioral projection models.

Petri nets are used to detect the errors of data inconsistency in concurrent systems. The detection methods usually apply a breadth-first or depth-first search to the reachability graphs of Petri nets. However, they spend too much space and time due to the blind search strategy. In this paper, we propose a heuristic method that can save lots of space and time. First we define structural data inconsistency of Petri nets which is more likely to cause the errors of data inconsistency. Then, in order to detect the errors as fast as possible, a heuristic function is proposed to guide the construction of a reachability graph. Furthermore, we propose a detection algorithm and develop a tool. Our experiments illustrate the advantage and effectiveness of our method.

In this paper we aim at addressing the correlation between two critical factors in mobile social networks (MSNs): the social-relationship networking among users and the spatial mobility pattern of users. Specifically, we investigate the impact of users' spatial distribution on their social relationship formation in MSNs. Based on the geolocation data (check-in records) and social relation data of MSN users, we propose a model, called neighborhood-cardinality-based model (NCBM), to describe this impact by taking into account both the multiple home-points/hotspots property of spatial mobility and the long-tailed social relationship degree distribution of MSN users. We define a fundamental quantity for each user, i.e., the so-called neighborhood cardinality, to measure how many and how often other MSN users visit his nearby area with a given range. The core of NCBM is a principle: The probability that a user, say u, is followed by another user, say v, obeys a power law distribution of the neighborhood cardinality of user u. The proposed formation model is evaluated on two large check-in datasets: Brightkite and Gowalla. Our experimental results indicate that the proposed formation model provides a useful paradigm for capturing the correlation between MSN users' mobility patterns and social relationships.

User behavioral analysis is expected to be a key technique for identity theft detection in the Internet, especially in mobile social networks (MSNs). While traditional methods prefer to use explicit behaviors, a series of behaviors implicit in user's texts can probably provide much more accurate identity. And these implicit behaviors can be digged from texts by LDA. Besides the latent feature in texts, a behavior also include other features (e.g., spatial and temporal features). A joint feature including these features can be a better evidence for identity theft detection. In this paper, we use a probabilistic generative model to detect identity theft in MSNs. We are going to conduct experiments on two real-life datasets: Foursquare and Yelp. A early experiment shows that semantic features achieve better performance than spatial features and we are conducting our main experiment to see a better performance with joint behavioral feature.