# Spam Classification Based on Signed Network Analysis
## 1 Introduction  
Recently, online social networking services, such as Twitter, Facebook, and Weibo, have become the most important means of information sharing in modern society. A great deal of news is quickly spread to unspecified people through the services, and they can easily chat or share their daily lives with their friends, colleagues, and family anywhere and at any time. Social media platforms are being used for political processes and activities, and online social media advertising is now considered to be one of the most effective marketing strategies. Furthermore, additional offered functionalities, such as entertainment, shopping, banking, and games, accelerate the growth of online social networking services. According to research, Facebook has 2.60 billion monthly active users and also has 1.73 billion users that are visiting the social networking site on a daily basis [1]. As the use of online social networking services increases and their influence becomes more significant, a number of misuse and abuse cases have been continuously reported. A typical exampleis spam. For various purposes, malicious attackers try to disseminate unsolicited messages, such as indiscriminate advertisements, phishing links, and fake news, by taking advantage of online social networking services. Spam attacks hinder the development of better social networking services and degrade their reliability and credibility, causing great damage to both users and service providers: Users annoyed with spam may leave the platform, and the tremendous cost of preventing spam attacks puts enormous pressure on service providers. Numerous schemes to tackle spam attacks have been proposed so far. Initial attempts rely on content-based detection methods. They capture vocabulary or phrases appearing frequently in spam messages [2; 3; 4], and they have helped detect a significant amount of spam to this day. Detection performance can be further improved by utilizing more features, such as language, usage time, location, and even friend selection criteria [2; 3; 4; 5]. However, these methods, which mainly use the content or behavior of the message, quickly become less effective as the attacks evolve to be more complex and multifaceted. Instead, exploiting social-network-related features has recently been highlighted, since attackers cannot easily imitate social relationships. Many experimental results reveal that the network features obtained through social network analysis, such as node degree, clustering coefficient, and rank, can be used effectively as a basis for spam classification [6; 7; 8; 9; 10; 11]. In particular, PageRank [12; 13; 14] and Hyperlink-Induced Topic Search (HITS) [15] are extensively exploited here, since they are designed to reflect these social network properties well. In these methods, nodes with low PageRank or HITS scores have a high probability of being classified as spammers. Unfortunately, recent spam attacks can adroitly avoid those spam detection approaches by controlling their ranking through link farming and Spamdexing [8; 10; 16; 17]. For handling these attacks, the signs of edges could be significantly helpful, since they help us understand not only the relationship between two connected nodes, but also the reasoning of the link-forming process. Nevertheless, they are still being treated as unimportant and are not fully exploited for spam classification studies. In addition, since most current social networking services allow users to express their emotions and opinions in various ways, such as with likes/dislikes, comments, or ratings, we can obtain the sign attributes from the data without difficulty. In this paper, we present a signed-network-analysis-based spam classification method. Our key hypothesis is that the edge signs are highly likely to be determined by considering users' social relationships, so there will be a substantial difference between the edge sign patterns of spammers and those of non-spammers (i.e., normal users).