An Empirical Study on
Selective Sampling in Active Learning for Splog Detection
Taichi Katayama Takehito Utsuro Yuuki Sato
University of Tsukuba
Tsukuba, 305-8573, JAPANTakayuki Yoshinaka

Yasuhide Kawada

Tomohiro Fukuhara

Tokyo Denki University
Tokyo, 101-8457, JAPAN

Navix Co., Ltd.
Tokyo, 141-0031, JAPAN

University of Tokyo, Kashiwa
277-8568, JAPANABSTRACTInternet, there are several commercial and non-commercial
services such as Technorati1 , BlogPulse2 [3], kizasi.jp3 , andThis paper studies how to reduce the amount of human su4[13]. With respect to multilingual blog serblogWatcher
pervision for identifying splogs / authentic blogs in the convices,
Globeof
Blogs5 provides a retrieval function of blog
text of continuously updating splog data sets year by year.
articles across languages. Best Blogs in Asia Directory6 also
Following the previous works on active learning, against theprovides a retrieval function for Asian language blogs. Blogtask of splog / authentic blog detection, this paper empirwise7 also analyzes multilingual blog articles.
ically examines several strategies for selective sampling in
As with most Internet-enabled applications, the ease ofactive learning by Support Vector Machines (SVMs). As acontent
creation and distribution makes the blogosphere spam
conﬁdence measure of SVMs learning, we employ the disprone[4,
1, 7, 11, 6]. Spam blogs or splogs are blogs hostingtance from the separating hyperplane to each test instance,
spam posts, created using machine generated or hijacked
which have been well studied in active learning for text clascontent for the sole purpose of hosting advertisements or
siﬁcation. Unlike those results of applying active learning
boosting the ranking of target sites. [7] reported that for
to text classiﬁcation tasks, in the task of splog / authentic
English blogs, around 88% of all pinging URLs (i.e., blog
blog detection of this paper, it is not the case that adding
homepages) are splogs, which account for about 75% of allleast conﬁdent samples peforms best.
pings [2]. Based on this estimation, as stated in [1, 10],
splogs can cause problems including the degradation of inCategories and Subject Descriptors
formation retrieval quality and the signiﬁcant waste of netH.3.0 [INFORMATION STORAGE AND RETRIEVAL]: work and storage resources. Several previous works [7, 11, 6]
reported important characteristics of splogs. [11] reported
Generalcharacteristics of ping time series, in-degree/out-degree distributions, and typical words in splogs found in TREC8
General Terms
Blog06 data collection. [7, 6] also reported the results ofReliability
analyzing splogs in the BlogPulse data set. In the context ofsemi-automatically collecting web spam pages/hosts includKeywords
ing splogs, [18] discuss how to collect spammer-targeted keywords to be used when collecting a large number of web spam
spam blog detection, SVM, active learning, selective sampages/hosts eﬃciently. [14] also analyzes (Japanese) splogs
pling
based on various characteristics of keywords contained inthem.
1. INTRODUCTION
Along with those analysis on splogs reported in previous
Weblogs or blogs are considered to be one of personal jourworks, several splog detection techniques (e.g., [12, 5, 10])
nals, market or product commentaries. While traditional
have been proposed. [5] studied features for splog detecsearch engines continue to discover and index blogs, the blotion such as words, URLs, anchor texts, links, and HTMLgosphere has produced custom blog search and analysis enmeta tags in supervised learning by SVMs. As features ofgines, systems that employ specialized information retrieval
SVMs, [10] studied temporal self similarities of splogs suchtechniques. With respect to blog analysis services on theas posting times, post contents, and aﬃliated links. [12] also
1

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.
AIRWeb ’09, April 21, 2009 Madrid, Spain.
Copyright 2009 ACM 978-1-60558-438-6 ...$5.00.

29

http://technorati.com/
http://www.blogpulse.com/
3
http://kizasi.jp/ (in Japanese)4
http://blogwatcher.pi.titech.ac.jp/ (in Japanese)5
http://www.globeofblogs.com/
6
http://www.misohoni.com/bba/7
http://www.blogwise.com/
8
http://trec.nist.gov/
2

Data Sets
Years 2007-2008
Years 2008-2009
total

Years 2007-2008
Years 2008-2009

Years 2008-2009

Table 1: Statistics of Splogs / Authentic Blogs Data Sets(a) Statistics of Total Data Sets Available# of splogs# of authentic blogs
768
3318
1445
2459
2213
5777
(b) Statistics of Virtual Data Sets for Evaluation in Section 5.2
40×18=720
40×18=720
40×18=720 (40×10=400 used, 40×18=720 (40×10=400 used,
360 for training,
360 for training,
40 for evaluation)
40 for evaluation)

total
4086
3904
7990

1440
1440 (800 used,
720 for training,
80 for evaluation)(c) Statistics of Data Sets for Active Learning in Section 5.3
4 for initial training, 1296 for
6 for initial training, 2208 for
10 for initial training, 3504
pool, 145 for evaluationpool, 245 for evaluation
for pool, 390 for evaluationing, we employ the distance from the separating hyperplane
to each test instance [16], which have been well studied in
active learning for text classiﬁcation.
Unlike those results of applying active learning to textclassiﬁcation tasks, in the task of splog / authentic blog detection of this paper, it is not the case that adding least
conﬁdent samples peforms best. In total, the strategy ofadding least conﬁdent samples performs worse than that ofadding balanced samples, and even worse than that of randomly selecting samples to be added to the training data set.
From this result, we conclude that, when reducing humansupervision in continuously updating splog data sets year by
year, it is the most important to apply the conﬁdence measure so that novel blog homepages be balancedly sampled interms of the distance from the separating hyperplane.

studied detecting link spam in splogs by comparing the language models among the blog post, the comment, and pages
linked by the comments.
However, splogs may change year by year. This is partiallybecause text content of splogs is mostly excerpted from othersources such as news articles, blog articles (posts), advertisement pages, and other web texts. Sources of splog contentssuch as those above may change day by day, and thus, splog
contents excerpted from those sources also may change. Furthermore, certain percentage of splogs may be created automatically, where their html structures are automaticallygenerated and their text contents are excerpted from othersources. Such automatic procedures may also change year
by year, and hence, it is quite reasonable to suppose thatcertain characteristics of generated splogs may change year
by year. The evaluation results in section 5.2 indirectly support the claim and can be summarized below: the performance of applying Support Vector Machines (SVMs) [17]model to splog detection trained with a Japanese splog data
set developed in the years of 2007-2008 [14] against anotherJapanese splog data set developed in the years of 2008-2009
is relatively damaged compared with that of applying another model trained with a held out data set from the years
2008-2009. Therefore, in order to catch up with such splog
changes, it is quite necessary to design a framework for continuously updating splog data sets year by year9 .
In such a framework, one of the most important issues is
how to reduce human supervision in continuously updating
splog data sets. In machine learning communities and statistical natural language processing communities, minimallysupervised approaches such as active learning [9, 16, 15] havebeen well studied. In active learning, certain conﬁdence
measures in machine learning frameworks are introduced
so as to separate highly conﬁdent samples and less conﬁdent samples. In previous works on applying active learning
frameworks to tasks such as text classiﬁcation [9, 16, 15], theleast conﬁdent samples are collected, manually annotated,
and added to the training data set. Following those studies
in the previous works on active learning, against the taskof splog / authentic blog detection, this paper empiricallyexamines several strategies for selective sampling in active
learning by SVMs. As a conﬁdence measure of SVMs learn-

2. SPLOGS / AUTHENTIC BLOGS DATASETSIn this paper, we examine splogs changes over time withtwo data sets of Japanese splog / authentic blog homepages,
where one set is developed in the years of 2007-2008 (fromSeptember 2007 to February 2008) [14], and the other set isdeveloped in the years of 2008-2009 (from December 2008
to January 2009). As shown in Table 1, in both data sets,blog homepages are collected according to certain procedures, and then, splog / authentic blog judgement is manually annotated. Here, roughly speaking, splog / authentic
blog judgement is based on the criterion below, while thedetailed discussion on this criterion is in [14]:1. If one of the followings holds for the given homepage,then it is mostly10 splog.
(a) The feature “originally written text”does not hold.
(b) The feature “originally written text” holds andat least one of the features “links to aﬃliatedsites”, “advertisement articles (posts)”, or “articles (posts) with adult content” holds.
2. Otherwise, the given homepage is an authentic blog.

9
The notion of concept drift [8] and previously studied approaches to detecting it may be closely related to this result.

10

By “mostly”, we mean that it is usually necessary to judge
by considering the contents of each blog.

30

3. FEATURES FOR SPLOG DETECTION

The reason why splog / authentic blog distributions diﬀer
between the two data sets is that candidate blog homepages
to which splog / authentic blog distinction is annotated arecollected according to diﬀerent procedures. Since it was our
ﬁrst experience of developing splog data set, for the one
developed in the years of 2007-2008, we examine characteristics of splogs in advance, and we collect candidate blog
homepages which satisfy the requirements below:

This section describes features of SVMs for splog detection. Features described next in this section are evaluatedthrough splog detection performance, and in the evaluationof section 5, only about half of them are manually selected,
since the set of those selected features perform best compared with other combinations out of all the features.

3.1 Blacklist/Whitelist URLs

i) We collect various keywords including those which aresupposed to be frequently included in splogs. And
then, for each keyword, we simply collect blog homepages which contain the keyword.

Given the training instances of splog / authentic blog
homepages, URLs of the out-links are extracted from theirhtml ﬁles. Then, the set of whitelist URLs is constructedby collecting URLs which satisfy both of the following two
requirements:ii) In our observation, the rate of splogs among the blog
homepages that contain a given keyword may be higher
on the burst date than on other dates. Based on thistendency, we collect blog homepages containing a given
keyword on the date with its most frequent occurrence.

i) The URL is not included in the html ﬁles of any of the
training instances of splog homepages.

iii) Out of the collected blog homepages for a given keyword and on the date above ii), we prefer blog homepages with more posts per day than those with fewer
posts per day.

ii) The URL is included in the html ﬁles of the training
instances of authentic blog homepages, and its totalfrequency in the whole training authentic blog homepages is more than one.

When developing the other data set in the years 20082009, on the other hand, we collect candidate blog homepages more eﬃciently. According to the analysis in [14] aswell as our further observation, splog homepages tend toshare out-links to aﬃliated sites. Based on this tendency, inthe years 2008-2009, we collect splog / authentic blog homepages which share out-links with splog homepages includedin the data set developed in the years 2007-200811 . Morespeciﬁcally, ﬁrst, URLs of the out-links are extracted fromthe html ﬁles of the splog / authentic blog homepages in thedata set developed in the years 2007-2008. Then, the setof blacklist URLs is constructed by collecting URLs which
satisfy both of the following two requirements:

From the Japanese splog data set developed in the yearsof 2007-2008 [14] (section 2), about 13,000 whitelist URLs
are collected. Next, given a whitelist URL u, the following
weight is calculated and is used as a value of the whitelist
URLs feature:logutotal frequencyof u in the wholetraining instancesof authentic blog
homepages×

total
frequencyof u inthe test
instance

The set of blacklist URLs is also constructed according
to a similar procedure (as described in section 2). About
5,000 blacklist URLs are collected, and are evaluated as afeature for splog detection. However, the blacklist URLs
feature does not contribute to improving the performance ofthe best combination of features.

i) The URL is not included in the html ﬁles of any of the
training instances of authentic blog homepages.
ii) The URL is included in the html ﬁles of the training
instances of splog homepages, and its total frequency
in the whole training splog homepages is more thanone.

3.2 Noun Phrases
As previously reported in [18, 14], splogs and authentic
blogs tend to have word distributions diﬀerent from eachother, and certain types of words may appear in splogs more
often than in authentic blogs. In this paper, we introduce
a feature for observing occurrences of noun phrases, so thatsuch a diﬀerence can be detected. First, body texts of splog /authentic blog posts are extracted, and are morphologicallyanalyzed12 , from which noun phrases are extracted.
Then, given a noun phrase w, based on the following
contingency table of co-occurrence frequencies of the wholetraining instances of splog / authentic blog homepages andw, we estimate correlation of splog / authentic blog homepages and w according to the φ2 statistic between splog
homepages and w.

About 5,000 blacklist URLs are collected, and ﬁnally, foreach blacklist URL, candidate blog homepages which include
out-link to it are collected. The data set shown in Table 1
is developed from a part of all the collected candidate blog
homepages.

11

One may argue that candidate blog homepages sharing outlinks with splogs taken from the data set of the years 20072008 could be biased toward those similar to the ones included the data set of the years 2007-2008. However, as weshow in section 5.2, the SVMs model trained with the data
set of years 2007-2008 perform worse against splogs / authentic blogs of the years 2008-2009, than against those of
the years 2007-2008. Thus, at present, we conclude that ourdata set of the years 2008-2009 is worthy of further analysis
on changes in splogs over time and being examined throughsplog detection research activities.

12

The Japanese morphological analyzer ChaSen (http://chasen-legacy.sourceforge.jp/) and the lexicon ipadic
are used.

31

Table 2: Selective Sampling Strategies in Active Learning
Samples to be Selected are with High? or Low? Conﬁdencehighlowhigh or low
balanced
randomFrom the Seperating Hyper- splog————
plance,Samples to be Selected are authentic
High-Au—
High/Low-Au—
Randomonblog
Splog side? or Authentic splog
or—
Low-Sp/Au—
Balanced-Sp/Au
Blog side?
authentic
blog

the
whole
training
instancesof
splog homepages
the
whole
training
instances ofauthentic blog
homepagesw
f req(splog, w) =a¬w
f req(splog,¬w) = bf req(authentic
blog, w) = c

f req(authentic
blog, ¬w) = d

φ2 (splog, w) =sis constructed, where from the Japanese splog data set developed in the years of 2007-2008, about 2,000 anchor text
noun phrases are collected. Next, given a splog anchor text
noun phrase out-linked to blacklist URLs w, the following
weight is calculated and is used as the value of a feature
named anchor text noun phrase out-linked to blacklist URLs
for a test instance blog homepage t:w(ad − bc)2
(a + b)(a + c)(b + d)(c + d)

φ2 (splog, w) ×w

Ancf B(w, s) × Ancf B(w, t)

log
training
splog
homepages

In a similar procedure, the set of splog anchor text nounphrases out-linked to whitelist URLs whose total frequency
throughout the whole training splog homepages
Ancf W (w, s) is more than one is constructed, where

From the Japanese splog / authentic blog data sets developed in the years of 2007-2008, about 462,894 noun phrases
are collected. Next, the following weight is calculated fromthe whole training instances of splog / authentic blog homepages and is used as a value of the splog noun phrase feature:log

Ancf B(w, s) is more than one

training splog homepagessfrom the Japanese splog data set developed in the years of
2007-2008, about 320 anchor text noun phrases are collected.
Next, given a splog anchor text noun phrase out-linked towhitelist URLs w, the following weight is calculated and isused as the value of a feature named anchor text noun phrase
out-linked to whitelist URLs for a test instance blog homepage t:

total frequency of w
in the test instance

3.3 Noun Phrases in Anchor Texts and Linked
URLs
Another type of features which are more speciﬁc than theblacklist/whitelist features and noun phrase features, but
are more eﬀective in splog detection is that of (loose) tupleof noun phrases in anchor texts and their linked URLs. In
order to introduce this feature, given a noun phrase w anda splog / authentic blog homepage s, ﬁrst we deﬁne thefrequencies Ancf B(w, s) and Ancf W (w, s) of a noun phrase
w in s:Ancf W (w, s) × Ancf W (w, t)

log
w

training
splog
homepages

3.4 Link Structure

Ancf B(w, s) =In addition to the features introduced so far, we also examine features for representing link structures such as theout-degree, the maximum number of out-links from a blog
homepage to any one URL, and the number of mutual links
to any other blog homepages. However, any of those features contribute to improving the performance of the best
combination of features.

# of times of w in s s.t.
w is included in an anchor textof an out-link to a blacklist URL or
a post of splog homepage includedin the training data set.
Ancf W (w, s) =4. ACTIVE LEARNING FOR SPLOG DETECTION# of times of w in s s.t.
w is included in an anchor textof an out-link to a whitelist URL or
a post of authentic blog homepage
included in the training data set.

4.1 Splog Detection by SVMs
As a tool for learning SVMs, we use TinySVM (http://chasen.org/~taku/software/TinySVM/). As the kernel
function, we compare the linear and the polynomial (2ndThen, the set of splog anchor text noun phrases out-linked toblacklist URLs whose total frequency throughout the whole32

(a) Splog Detection(b) Authentic Blog Detection

9of Ds07-08 (Years 2007-2008)
Figure 1: Evaluation Results of Splog / Authentic Blog Detection (Training: 18
1+ ΔT r, Evaluation: 18 of Ds08-09 (Years 2008-2009))

At each step of active learning, the current model for splog/ authentic blog detection judges with certain conﬁdence
whether each of unlabeled instances in the pool is splog /authentic blog. The results of those judgements are represented as the location of each unlabeled instance in thefeature vector space, where the space is divided into the
splog side and the authentic blog side by the separating hyperplane. The conﬁdence of the judgments by the current
model is represented the distance from the separating hyperplane. The high the conﬁdence is, the larger the distance isfrom the separating hyperplane.
In our experimental evaluation of various strategies forselective sampling, the whole strategies are shown in theiracronyms in Table 2. Here, we consider the following two
factors:

order) kernels, where the 2nd order kernels perform better
and we show results with the 2nd order kernels in this paper.

4.2 A Confidence Measure
As a conﬁdence measure of SVMs learning, we employ
the distance from the separating hyperplane to each test
instance [16]13 . More speciﬁcally, we introduce two lower
bounds LBDs and LBDab for the distance from the separating hyperplane to each test instance, where LBDs is forthe test instances judged as splogs, while LBDab is for thosejudged as authentic blogs. If a test instance x is judged asa splog, but its distance from the separating hyperplane is
not greater than LBDs , then the decision is not regarded as
conﬁdent and is rejected. In the case of x being judged as
an authentic blog, the lower bound LBDab is considered ina similar fashion.

• The conﬁdence that is assigned by the current model
to each unlabeled instance. In previous works on active learning, the least conﬁdent instances are collected
to be added to the training data set. In this paper, we
examine the following four strategies: i) the most conﬁdent instances are selected (“high” in Table 2), ii) the
least conﬁdent ones are selected (“low” in Table 2),iii) both the most conﬁdent ones as well as the least
conﬁdent ones are selected (“high or low” in Table 2),iv) instances to be selected are balanced in terms of
conﬁdence, i.e., the distance from the separating hyperplane (“balanced” in Table 2).

4.3 Selective Sampling Strategies in Active
Learning
This paper empirically examines several strategies for selective sampling in active learning by SVMs. In the experimental evaluation, we start from randomly selected 10 initialtraining instances (4 splog homepages and 6 authentic blog
homepages) and 390 instances for evaluation. As shown in
Table 1 (c), with 3504 unlabeled instances as a pool, at eachstep of active learning, 4 unlabeled instances are selected
out of the pool according to a certain strategy, manuallyannotated whether splog or authentic blog, and then added
to the training data set14 . Active learning cycles continue
until 1,000 instances are added to the training data set15 .

• Within the feature vector space divided by the separating hyperplane, unlabeled instances are selected fromthe splog side, or from the authentic blog side, or fromboth sides.

13[16] studied this measure in the context of active learning [9, 16, 15], one of major minimally supervised approaches
in machine learning communities and statistical natural language processing communities, where, in active learning
framework, the least conﬁdent samples are collected, manually annotated, and added to the training data set.
14
We ignore training instances for which values of all thefeatures are zero.
15
At present, we have not examined the issue of stopping

As shown in Table 2, any pair of those two factors is considered and experimentally evaluated. Furtheremore, we also
compare the strategy of randomly selecting unlabeled instances in the pool with the strategies we designed above.
criterion.

33

(1) Splog Detection(2) Authentic Blog Detection

Figure 2: Evaluation Results of Active Learning: Models after Adding 1,000 Training Samples
where the training data size for the former is half of that for9, ΔT r ⊆ Ds08-09” andthe latter. Those with “| ΔT r |= 18
5, ΔT r ⊆ Ds08-09” indicate the performance of“| ΔT r |= 18
those trained with the mixture of the two data sets. Considering the performance of both splog and authentic blog
detection, the best performance are obtained when the classiﬁer is trained with the mixture of the two data sets. Thisis obviously because both (a part of) training and evaluation data are from the data sets of the same period. Especially, the classiﬁer for authentic blog detection tend tojudge splogs of the years 2008-2009 as authentic blogs. Furthermore, with more training data from the years 2008-2009,
the classiﬁer performs better. This result clearly indicatesthat (at least) splogs change over time (in this case, about
one year), and their changes are somehow not very easy for
the SVM classiﬁer trained in the past to catch up with.

For each of the strategies “high”, “low”, “high or low”, and“balanced”, we compare the performance of the three alternatives in the orthogonal factor, namely, from the splog
side, from the authentic blog side, and from both sides. In
Table 2, we only list the acronyms of the best performing
strategy for each of “high”, “low”, and “high or low”.

5.

EXPERIMENTAL ANALYSIS

5.1 Evaluation Measures
Throughout this paper, the performance of splogs / authentic blogs detection are shown with plots of recall andprecision. Here, recall / precision of detecting splogs anddetecting authentic blogs are measured separately. The performance curve of splog detection is plotted by varying thelower bound LBDs in splog side of the data space, while thatof authentic blog detection is plotted by varying the lower
bound LBDab on authentic blog side of the data space.

5.3 Selective Sampling in Active Learning for
Splog Detection

5.2 Estimating Changes in Splogs over Timethrough Performance of Splog Detection

For each strategy in Table 2, Figure 2 plot the recall /precision curves after adding 1,000 instances to the training
data set. Figure 3 also plots the learning curve of the maximum precisions at the point of the recall as 30%. In thoseﬁgures, the plots with the label “| T r |= 3500” indicate thatthe whole 3504 instances in the pool.
Among those strategies in the ﬁgures, “Balanced-Sp/Au”,“Random”, and “High/Low-Au” perform comparably well.
The strategies of adding the most/least conﬁdent instances
perform worse. From this result, we conclude that, whenreducing human supervision in continuously updating splog
data sets year by year, it is the most important to apply
the conﬁdence measure so that novel blog homepages bebalancedly sampled in terms of the distance from the separating hyperplane. Also from Figure 3, both splog and authentic blog detection performance do not seem saturated
after adding 1,000 training instances.
Finally, Figure 4 plots changes in the numbers of support
vectors. In SVMs learning, it is known that only the support
vectors have eﬀect on deciding the position of the separating

In the ﬁrst experimental evaluation, we compare the twodata sets developed in the years 2007-2008 and 2008-2009
through performance of splog / authentic blog detection.
Here, we trained two classiﬁers, one with the data set developed in the years 2007-2008, while the other with the
mixture of the two data sets16 . Then, we evaluate the twoclassiﬁers against a held out data taken from the data set
developed in the years 2008-2009.
In Figure 1, the plots labeled with “ΔT r=none” and “|
9, ΔT r ⊆ Ds07-08” indicate the performance of
ΔT r | = 18
those trained with the data set from the years 2007-2008,16

The speciﬁcations of the training and evaluation data sets
are given in Table 1 (b). Out of the total splogs / authentic
blogs data sets available in Table 1 (a), the training data setsof the same size are constructed both from the years 20072008 and from the years 2008-2009. Here, note that withinboth the training and evaluation data sets, the distributionof splogs and authentic blogs is evenly 50% and 50%.

34

(1) Splog Detection(2) Authentic Blog Detection

Figure 3: Evaluation Results of Active Learning: Changes in Maximum Precisions with Recall as 30%
hyperplane, and the number of support vectors can be regarded as the complexity of the learning task. As can be seenfrom the result of Figure 4 (a), the number of support vectors
continue to increase. The strategies such as “Low-Sp/Au”
and “High-Au” with relatively low performance are with lesssupport vectors, and thus seem to fail in collecting certain
numbers of eﬀective training instances which are successfullycollected by other strategies. From the results in Figure 4(b) and (c), the rate | SV m SV all | / | SV m | starts to besaturated, while the rate | SV m SV all | / | SV all | continues to increase. This result is contrastive compared withthe one in Figure 2, where the performance after adding
1,000 training instances is relatively close to the plots of“| T r |= 3500”. This indicates that although the recall /precision of splog / authentic blog detection continue to improve relatively slowly, the number of support vectors increase much more rapidly.

6.

CONCLUSION

This paper studied how to reduce the amount of humansupervision for identifying splogs / authentic blogs in thecontext of continuously updating splog data sets year by
year. Following the previous works on active learning, against
the task of splog / authentic blog detection, this paper empirically examined several strategies for selective sampling in
active learning by Support Vector Machines (SVMs). Unlike
those results of applying active learning to text classiﬁcation
tasks, in the task of splog / authentic blog detection of thispaper, it is the most eﬀective to add samples that are balanced in terms of the distance from the separating hyperplane. Future works include, within the framework of active
learning, introducing other features such as ping time series
that are studied in the previous works [11, 7, 6]. We are also
working on updating splog / authentic blog data set throughthe manual procedure by annotators, where instances to beshown to the annotators are automatically selected considering their distance from the separating hyperplane. The
result of this work will be reported in the near future.

35

7. REFERENCES[1] Wikipedia, Spam blog.
http://en.wikipedia.org/wiki/Spam_blog.
[2] Wikipedia, Ping (blogging).
http://en.wikipedia.org/wiki/Ping_(blogging).
[3] N. Glance, M. Hurst, and T. Tomokiyo. Blogpulse:
Automated trend discovery for Weblogs. In WWW
2004 Workshop on the Weblogging Ecosystem:
Aggregation, Analysis and Dynamics, 2004.
[4] Z. Gyöngyi and H. Garcia-Molina. Web spamtaxonomy. In Proc. 1st AIRWeb, pages 39–47, 2005.
[5] P. Kolari, T. Finin, and A. Joshi. SVMs for the
Blogosphere: Blog identiﬁcation and Splog detection.
In Proc. 2006 AAAI Spring Symp. Computational
Approaches to Analyzing Weblogs, pages 92–99, 2006.
[6] P. Kolari, T. Finin, and A. Joshi. Spam in blogs andsocial media. In Tutorial at ICWSM, 2007.
[7] P. Kolari, A. Joshi, and T. Finin. Characterizing the
splogosphere. In Proc. 3rd Ann. Workshop on the
Weblogging Ecosystem: Aggregation, Analysis andDynamics, 2006.
[8] L. I. Kuncheva. Classiﬁer ensembles for detecting
concept change in streaming data: Overview andperspectives. In Proc. 2nd Workshop SUEMA 2008
(ECAI 2008), pages 5–10, 2008.
[9] D. D. Lewis and W. A. Gale. A sequential algorithm
for training text classiﬁers. In Proc. 17th SIGIR, pages
3–12, 1994.
[10] Y.-R. Lin, H. Sundaram, Y. Chi, J. Tatemura, and
B. L. Tseng. Splog detection using self-similarity
analysis on blog temporal dynamics. In Proc. 3rd
AIRWeb, pages 1–8, 2007.
[11] C. Macdonald and I. Ounis. The TREC Blogs06
collection : Creating and analysing a blog testcollection. Technical Report TR-2006-224, Universityof Glasgow, Department of Computing Science, 2006.
[12] G. Mishne, D. Carmel, and R. Lempel. Blocking blog
spam with language model disagreement. In Proc. 1st
AIRWeb, 2005.

[13] T. Nanno, T. Fujiki, Y. Suzuki, and M. Okumura.
Automatically collecting, monitoring, and mining
Japanese weblogs. In WWW Alt. ’04: Proceedings ofthe 13th international World Wide Web conference on
Alternate track papers & posters, pages 320–321. ACM
Press, 2004.
[14] Y. Sato, T. Utsuro, T. Fukuhara, Y. Kawada,
Y. Murakami, H. Nakagawa, and N. Kando. Analysing
features of Japanese splogs and characteristics of
keywords. In Proc. 4th AIRWeb, 2008.
[15] G. Schohn and D. Cohn. Less is more: Active learningwith support vector machines. In Proc. 17th ICML,
pages 839–846, 2000.
[16] S. Tong and D. Koller. Support vector machine active
learning with applications to text classiﬁcation. In
Proc. 17th ICML, pages 999–1006, 2000.
[17] V. N. Vapnik. The Nature of Statistical Learning
Theory. Springer-Verlag, 1995.
[18] Y. Wang, M. Ma, Y. Niu, and H. Chen. Spamdouble-funnel: Connecting web spammers withadvertisers,. In Proc. 16th WWW Conf., pages
291–300, 2007.

(1) Number of Support Vectors(2) | SV m

SV all | / | SV m |(3) | SV m

SV all | / | SV all |Figure 4: Changes in Number of Support Vectors (SV m: Set of Support Vectors at m-th Active
Learning Cycle, SV all: Set of Support Vectors after
adding the Whole 3504 Instances in the Pool)36