# Spam Classification Based on Signed Network Analysis
## 2 Related Work  
Most spam detection studies consider spam detection as a classification problem. They focus on identifying the appropriate data features or best combinations of them that can distinguish spam/non-spam or a spammer/non-spammer. One simple way to detect spam is to examine the text of the message: a spam message is likely to be in a format that may feel awkward to people, or its contents may be meaningless or even non-relevant to the recipients [2; 3]. A template-matching scheme is proposed to detect spam messages by comparing the sentence structure of a given message with that of ground-truth, non-spam messages [18]. Since spam messages may contain a hashtag or URL for quick spreading, checking a fraction of them has been widely used for several proposals [2; 4]. [PERSON] et al. examine the use of language in the topics and pages linked from a tweet [3], and [PERSON] analyzes trending topics on Twitter to understand spammers' strategic behavioral patterns [5]. In addition to the text itself, meta information, such as the user profile, activity logs, and timestamps, has been also used for spam filtering [2; 3; 4; 5]. SynchroTrap uses time-stamped user actions to detect malicious account groups that generate \"like spam\" on Facebook or \"follow spam\" on Instagram [19]. VOLTIME [20] utilizes an inter-arrival time distribution of patterns of how normal users write reviews. The patterns of webpage click sessions, such as traffic moderateness, target synchronicity, and temporal synchronicity, are used to detect click spam attacks [21; 22]. Most of these approaches are intuitive and simple to implement; however, they become rapidly ineffective, as attacks are evolving to be cleverer and more multifaceted. To capture sophisticated online attacks, many representation-learning-based spam detection approaches use both relational and semantic features [23; 24; 25]. Several network properties accumulated while using online social networking services have been highlighted as alternative features for spam classification. Due to the fact that attackers cannot easily imitate social relationships, spam detection approaches based on social network analysis are considered to be more robust than the previously described schemes. One simple yet effective realization method is to use node ranking: The rankings of nodes are determined based on combinations of several network properties, and spammers and non-spammers are classified according to these rankings. PageRank [12; 13; 14] and HITS [15] are extensively exploited here, since they are designed to reflect these social network properties well. Unfortunately, spammers can adroitly avoid such spam detection approaches through various forms of attack, such as link farming and Spamdexing [8; 10; 16; 17]. To address this problem, CatchSync [16] uses the observation that anomalies in online social networks tend to follow (or make links to) users whose node degrees and HITS values are similar to each other. Similarly, recent research [26; 27] utilized spammers' synchronicity by analyzing activity burstness. SybilRank [10] utilizes the fact that Sybils (i.e., spammers) have a disproportionately small number of connections to non-Sybil users. It provides a ranking algorithm that penalizes Sybils and link-farming activities. Network Footprint Score (NFS) [17] captures social campaigners by quantifying the likelihood of spam campaign targets based on their PageRank scores. [PERSON] et al. use a graph propagation algorithm based on the answerer-channel bipartite graph to detect spam answers in Community Question Answering sites [11]. Integro [9] is an optimized random walk-based ranking algorithm for fake account detection. SybilEdge [28] uses friend request acceptance/rejection activities for the detection of new fake accounts on social networks. Triad Significance Profile (TSP)-Filtering [29] exploits the structural differences between the frequencies of certain triad motifs for spam filtering.