Crowd Fraud Detection in Internet Advertising

Tian Tian†, Jun Zhu†, Fen Xia‡, Xin Zhuang‡, Tong Zhang‡†State Key Lab of Intelligent Technology & Systems; Tsinghua National TNLIST Lab

Department of Computer Science & Technology, Tsinghua University, Beijing 100084, China‡Baidu Inc., No.10 Shangdi Street, Haidian, Beijing 100084, China

{tiant13@mails,dcszj@mail}.tsinghua.edu.cn, {xiafen,zhuangxin,tongzhang}@baidu.com

ABSTRACTThe rise of crowdsourcing brings new types of malpracticesin Internet advertising. One can easily hire web workersthrough malicious crowdsourcing platforms to attack oth-er advertisers. Such human generated crowd frauds are hardto detect by conventional fraud detection methods. In thispaper, we carefully examine the characteristics of the groupbehaviors of crowd fraud and identify three persistent pat-terns, which are moderateness, synchronicity and dispersiv-ity. Then we propose an effective crowd fraud detectionmethod for search engine advertising based on these pattern-s, which consists of a constructing stage, a clustering stageand a filtering stage. At the constructing stage, we removeirrelevant data and reorganize the click logs into a surfer-advertiser inverted list; At the clustering stage, we define thesync-similarity between surfers’ click histories and transfor-m the coalition detection to a clustering problem, solved bya nonparametric algorithm; and finally we build a dispersityfilter to remove false alarm clusters. The nonparametric na-ture of our method ensures that we can find an unboundednumber of coalitions with nearly no human interaction. Wealso provide a parallel solution to make the method scalableto Web data and conduct extensive experiments. The em-pirical results demonstrate that our method is accurate andscalable.

Categories and Subject DescriptorsI.5.3 [Computing Methodologies]: Pattern Recogni-tion—Clustering ; K.4.4 [Computers and Society]: Elec-tronic Commerce—Payment schemes, Security

KeywordsFraud detection; Internet advertising; crowdsourcing

1. INTRODUCTIONAs a way to use the Internet to deliver promotional mar-

keting message to consumers, Internet advertising differs

Copyright is held by the International World Wide Web Conference Com-mittee (IW3C2). IW3C2 reserves the right to provide a hyperlink to theauthor’s site if the Material is used in electronic media.WWW 2015, May 18–22, 2015, Florence, Italy.ACM 978-1-4503-3469-3/15/05.http://dx.doi.org/10.1145/2736277.2741136.

from broadcast and television advertising by its ability tocarry out precision marketing. While at the same time it isexposed to greater risks of being influenced by precisely tar-geted attacks. For search engine advertising, advertisers canpresent their message to specific individual surfers selectedaccording to their search queries or browsing histories. Theseadvertisements are usually charged by the volume of click-s. However, this pay-per-click billing mechanism increasesthe risk of fraud since malicious ones can easily raise trafficson specific targets by technological means.Conventional advertising frauds, such as malwares, auto

clickers, etc, usually show specific characteristics on theirindividual behavior patterns, such as empty cookies, repet-itive clicks or hit bursts. These phenomena can be effec-tively detected by well-studied anomaly detection method-s [4, 16, 17]. Unfortunately, when new detection rules areproposed, fraudulent means evolves. Recently, crowdsourc-ing platforms that can distribute enormous tasks to a largegroup of web workers provide a more efficient way to han-dle various tasks including data collection and analysis [8,10, 21]. Meanwhile, a new type of fraud clicks in Internetadvertising has appeared on malicious crowdsourcing plat-forms1, where attackers publish micro-tasks of searching andclicking advertisements on a certain search engine, and thenweb workers accomplish these tasks and are paid per taskthrough the platform.According to the statistics, expensive adwords on

Google, such as insurance, loans, mortgage, etc, could costan advertiser more than 50 US Dollars per click [11], whilemalicious platforms only need to pay about 0.1 US Dollarsper click to the web workers. This big price gap has leadto a murky business of Internet advertising that attacker-s publish crowdsourced attacking tasks against competitorsto raise their advertising expenses. We refer to these mali-cious behaviors as crowd fraud.Since simple fraudulent means is well-studied and can

usually be filtered out by search engine’s anti-fraud mech-anisms, crowd fraud has became one of the main sourcesof customer complaints to search engines and has causedtremendous damage to the marketing environment. Thereare many differences between the human-generated crowdfraud and the fraudulent behaviors automatically generatedby machines, which pose new challenges to crowd fraud de-tection. For example, crowd fraud often arises from a vastnumber of attacking sources, but with low fraudulent trafficfrom each source. The fraudulent behaviors of web workers

1For example: http://www.adclickingjobs.com/;http://www.5iads.cn/ (in Chinese).

1100

SourceIP AdvertiserId Query Hit time

121.*.*.215 758 lose weight 90541

121.*.*.215 749 red tea 90855

112.*.*.76 740 flight ticket 91783

111.*.*.46 720 green tea 92401

222.*.*.201 749 green tea 92401

117.*.*.135 720 web design 91123

121.*.*.215

112.*.*.76

117.*.*.135

111.*.*.46

222.*.*.201

<758,90541>,<749,90855>,...

<740,91783>,...

<720,91123>,...

<720,93346>,...

<740.92401>,...

758

749

740

720

"lose weight" 90541

121.*.*.215

112.*.*.76

117.*.*.135

111.*.*.46

222.*.*.201

Surfer-advertiser bipartite graphIP

Advertiser Id

Raw Data Surfer-advertiser inverted list

Figure 1: Example of the raw data, the constructed bipartite graph and the surfer-advertiser inverted list.

are noisy and have no distinct regularity, and the fraudulenttraffic induced by each worker is often buried in his nor-mal traffic. These differences mean that the short-term orindividual behaviors of crowd fraud are almost normal. Soconventional anti-fraud systems usually fail to detect crowdfraud. Current commercial crowd fraud detection strategiesrely heavily on human interventions, such as the prior knowl-edge of suspicious queries and complicated artificial filteringrules. Such methods are labor intensive and become invalidrapidly since web workers can easily change their behaviorpatterns to avoid being detected.To address the above challenges, we explore the group

behaviors of crowd fraud. They are more persistent thanthe individual behaviors of each worker which may containsubstantial randomness. By carefully analyzing the fraudu-lent behaviors confirmed to be crowd fraud by a commer-cial detection system, we find some general characteristicsabout the feature distributions and the network structures ofcrowd fraud: (1) Moderateness: Crowd fraud often aimsat advertisers or queries that have moderate hit frequen-cies; (2) Synchronicity: Surfers involving in crowd fraudcan usually be grouped into coalitions; in each coalition theyusually attack a common set of advertisers; and most oftheir clicks toward a certain advertiser happen within acommon short time period; and (3) Dispersivity: Crowdfraud surfers may simultaneously search a series of unrelatedqueries and click advertisements from different professions.Based on the above characteristics, we investigate a novel

crowd fraud detection method for search engine advertis-ing. From the synchronicity characteristic we can see thatcrowd fraud has similar properties with coalition attack-s. The success of graph based anomaly detection methodson detecting coalitions in many scenarios [13, 15] inspiredus to develop our detection method based on the feature-enhanced graph structure of the click-through network. Ourmethod consists of three major stages: (1) Construct-ing: we first remove the logs whose queries have extremelysmall or large hit frequencies based on the moderateness con-dition, and then construct a surfer-advertiser bipartite graphas in Fig. 1. Each edge of this graph represents one uniqueclick log, and it contains features such as the hit time andsearching query. We also generate the surfer to advertiserinverted list of this bipartite graph for the use of next stage.Each entry of this inverted list represents the click history ofone unique surfer. (2) Clustering: to find surfer coalition-s which exhibit synchronicity, we define a synchronizationsimilarity between click histories and transform the coalitiondetection problem to a clustering problem. The number ofclusters is determined using a nonparametric clustering algo-

rithm, which is inspired by DP-means [12], a small-varianceasymptotic version of Dirichlet process (DP) mixtures. (3)Filtering: We will find three types of coalitions after clus-tering, namely, small irrelevant coalitions, fraudulent coali-tions, as well as some normal but large coalitions attract-ed by frequently-presented advertisements. The frequently-presented advertisements in one coalition come from similarbusiness domains such as flight tickets or hospitals. So weexamine all large coalitions and remove those with domaincentralized advertisers.Each step of our detection method is scalable with ap-

propriate approximation, and the total number of detectedfraudulent clusters is unbounded due to the nonparametricnature of our algorithm. We further implement a parallelversion of this method and conduct extensive experimentsto show its efficiency and accuracy.To the best of our knowledge, this paper is the first to

formulate the problem of crowd fraud detection in Internetadvertising and provides a solution. Our main contributionscan be summarized as follows:

1. We formally analyze the crowd fraud problem for Inter-net advertising, and identify three key characteristics,i.e., moderateness, synchronicity and dispersivity;

2. We present a solution to detect crowd fraud, in whichwe define a synchronization similarity between clickhistories and transform the coalition detection prob-lem into a clustering problem, solved by a nonpara-metric clustering algorithm that automatically decidesthe number of clusters;

3. We make the method scalable for large-scale searchengine advertising by parallelizing the nonparametricclustering algorithm. Extensive experiments are pro-vided to show its effectiveness.

The rest of the paper is organized as: Sec. 2 analyzes thecharacteristics of crowd fraud; Sec. 3 and Sec. 4 present thedetection system for search engine advertising and its par-allel implementation; Sec. 5 presents empirical results; Sec.6 discusses related work; and Sec. 7 provides concludingremarks.

2. CROWD FRAUD CHARACTERISTICSWe define crowd fraud as the phenomenon that a group of

people driven by economic benefits work together to increasefraudulent traffic on certain targets. Crowd fraud differsfrom automatically generated fraudulent behaviors in sever-al aspects: (1) The number of web workers involved in anattacking event from crowdsourcing platforms can be verylarge, while most conventional ways start from much fewer

1101

0 1 10 100 1000 100001000000%

10%

20%

30%

40%

50%

Hit frequency

NormalCrowd Fraud

(a) Traffic moderateness (b) Target synchronicity

50 100 1500

5

10

15

20

Hour

#Fra

ud C

licks

(c) Temporal synchronicity

Figure 2: Characteristics of crowd fraud: (a) The histogram of the hit frequencies of various queries forboth normal traffics and crowd fraud traffics; (b) A corner of the surfer-advertiser bipartite graph built fromcrowd fraud click relations, where different colors show different hit times and the white color means no clickoccurred; and (c) A snapshot of the fraudulent click number on one advertiser changes through time.

number of sources; (2) The total fraudulent traffic generatedby each web worker in crowd fraud is limited, while othermalpractices usually induce hit bursts; (3) Since crowd fraudclicks are generated by real humans, their behaviors have nodistinct regularity, while the auto generated traffic usuallyhas detectable repeatability; and (4) Besides the fraudulenttraffic, each web worker may also have normal click behav-iors, which is also different from automatic clicks. All thesedifferences make the set of conventional features used to de-tect automatic fraudulent behaviors invalid for crowd frauddetection, which calls for a careful investigation to identifymore distinctive and stable characteristics.This paper focuses on the crowd fraud detection problem

in search engine advertising. A main purpose of attackersis to raise fraudulent traffic on competitors to increase theirpromotional expenses. Thus the attacks usually aim at cer-tain advertisers rather than advertisements.To compare the differences between normal traffic and

crowd fraud traffic, we collect a click dataset from a ma-jor Chinese search engine company. The raw click logs onthe search engine maintain a history of all click actions thathappened within a time period. We investigated the fol-lowing attributes in the click logs. Log Id: We use logId to identify a unique click log. IP: though both cookie Idand IP address can identify different surfers, cookie changesmore frequently than IP. So we use the latter in our method,despite the network address translation. Advertiser Id: s-ince malpractices mostly aim at certain advertisers, we useadvertiser Id to identify their targets. Hit time: the timewhen the click happened. Query: the phrase that a surfersearched before his or her click action. We studied a subsetof the click logs. After carefully examining the datasets wecollected, we find similarities among the crowd fraud trafficon the moderateness, synchronicity and dispersivity charac-teristics, which provide strong hints to detect crowd fraudeffectively. Below, we describe these characteristics in detail.

2.1 ModeratenessIn a common search engine session, a surfer searches a

query and the engine returns the most relevant results aswell as advertisements in search engine results pages (SERP-s). Then the surfer may click some links or advertisementswhich satisfy their requirements or preference. Advertiserscan buy keywords from the search engine so that the sys-tem will display their message once a surfer’s search querymatches their keywords. As a result, the advertisers’ inten-

tions as well as their advertisement contents are expressedby the corresponding searching queries. We separately coun-t the hit frequencies on each unique query appeared in thecrowd fraud dataset and the full dataset, then plot the his-togram of hit frequencies in Fig. 2(a).We can see that most crowd fraud queries are clicked from

50 to 20,000 times during one week, while 50% queries of thefull dataset lay outside this range. Thus, crowd fraud trafficdiffers from normal traffic in that the hit frequencies of itstarget queries will neither be too small nor too large. It isnot too small may be because fraud practices always intendto raise click traffic, so they must click advertisements withconsiderable frequencies. It is not too large may be becausenormal traffics on frequently hit queries are very large, whilecrowd fraud traffics are usually relatively less since the hu-man click efficiency is limited. So the effects of fraudulenttraffics will be buried under the normal traffics.

2.2 SynchronicityWe characterize two types of crowd fraud’s synchronici-

ty. The first is the target synchronicity. Since crowd fraudstarts from malicious crowdsourcing platforms, their be-haviors can usually be grouped into sets. Workers on thesame platform tend to accomplish similar tasks publishedon that platform, so their target advertisers are also likelyto be similar. The click records can be viewed as a bipar-tite graph, with surfer vertices and advertiser vertices attwo sides, as in Fig. 1, where each edge represents one u-nique click log, and it contains features such as the hit timeand searching query. Then from the view of graph struc-ture, although the click relation between surfers and adver-tisers forms a very sparse bipartite graph, the links betweenthese crowd fraud workers from the same coalitions to thetasks on the same platform will be dense. To show this phe-nomenon, we select a dense corner of the bipartite graphbuilt from the crowd fraud dataset, and plot the adjacencymatrix of this subgraph in Fig. 2(b), where each cell rep-resents one click from the surfer of the column to the ad-vertiser of the row, and different colors represent differenthit times. Our experimental results on real data also verifythat these dense structures are common among fraudulenttraffics.The second is the temporal synchronicity. The different

colors of cells in Fig. 2(b) show different hit times of thecorresponding clicks. We can see that cells in the same rowusually have similar colors, which means that the hit times of

1102

Table 1: Example queries, where each row repre-sents the queries from one surfer.

Queries from normal surfers # Domains

eye cream, cleansing milk, skin care 1

electronic game, card game, game platform 1

headache, dizzy, light-headed 1

Queries from crowd fraud surfers # Domains

franchised outlet, excavator, royal jelly 3

beach BBQ, hospital, calligraphy training 3

toy bear, stainless steel, gym 3

crowd fraud clicks on a same advertiser usually concentrateon a short period. We show this phenomenon more clearlyby snapshotting the hit times of fraudulent clicks on oneadvertiser in Fig. 2(c). We can see that most clicks occurredwithin short time periods of several hours. This phenomenonalso appears on other advertisers, We think this time periodmay be related to the task’s publishing time on maliciouscrowdsourcing platforms, while their normal traffics usuallyshow periodicity.

2.3 DispersivityAs a more in-depth examination, we expand the click logs

of some frequently appeared individual surfers of both thecrowd fraud dataset and the full dataset. After compari-son, we find differences between their target business do-mains. For normal surfers, their click targets during a shortperiod usually focus on one certain business field or a fewhighly related fields, such as eye cream, cleansing milk, andskin care. However, crowd fraud surfers may click advertise-ments from many unrelated domains in a short period, suchas franchised outlet, excavator and royal jelly. We think thisis because web workers do not have real information de-mand, so if they do many tasks from different advertisers oncrowdsourcing platforms, their searching queries as well astheir target business domains show dispersivity. Some exam-ple searching queries and the number of domains are shownin Table 1.In summary, the group behaviors of crowd fraud show

strong regularities, including moderateness, synchronicityand dispersivity. These regularities differ crowd fraud trafficfrom normal traffic. Based on these observations, we developan effective crowd fraud detection system in next section.

3. CROWD FRAUD DETECTIONOur method consists of three major stages: construct-

ing, clustering and filtering, as outlined in Fig. 3.

3.1 Constructing StageThis stage removes irrelevant data and reorganizes the

logs into a surfer-advertiser inverted list.We first filter out irrelevant logs based on their

queries. According to the moderateness condition, click logswith queries whose hit frequency is extremely small or largeare barely crowd fraud. So we choose a lower threshold SL

and an upper threshold SU , and remove the logs with querieswhose hit frequency falling outside the range [SL, SU ]. Theappropriate threshold values can be found from statistics offraudulent traffic. Smaller Interval means less data left. This

Constructing

Clustering

Filtering

Input raw click logs

Remove logs with extreme queries

Build surfer-advertiser bipartite graph

Seeking for coalitions by clustering

Query dispersity filter

Recall relevant clicks

Output

Figure 3: Workflow for crowd fraud detection.

pre-filtering can significantly reduce the data volume. In ourexperiments, it removes more than 70% click logs.Then, we reorganize the remaining data as a surfer-

advertiser inverted list. As shown in Fig. 1, the click logsrepresent a surfer-advertiser bipartite graph. The structureof this bipartite graph can be stored as a surfer-advertiserinverted list, which can express the surfers’ behaviors moreexplicitly. In the sequel, we use G to denote an invertedlist; xi ∈ G is the ith entry of G, representing the clickhistory of the ith surfer; each click history xi consists of anundetermined number of click events; an event xij ∈ xi con-sists of a target advertiser Id xI

ij and a hit time xTij , meaning

that surfer i clicked an advertisement at time xTij , and this

advertisement belongs to an advertiser with Id xIij . If surfer

clicked advertisements belong to the same advertiser morethan one time, we only record one click with the earliest hittime, which is sufficient to represent the intention of all thiskind of clicks. A click history is of the form:

{{Id : 74, time : 456}, {Id : 64, time : 93}, ...}.Suppose we have N unique IPs, M unique advertisers Idsand D click logs after pre-filtering, there will be N lines inG, and each line will contains D/N events on average.

3.2 Clustering StageAfter pre-filtering the logs using the moderateness con-

dition, we proceed to consider the synchronicity condition,which states that surfers involving in crowd fraud usuallygroup into coalitions; in each coalition they usually attack acommon set of advertisers; and most of their clicks toward acertain advertiser happen within a common short time pe-riod. We formulate the coalition detection as a clusteringproblem, and solve it by a nonparametric method that canautomatically learn the unknown number of coalitions.

3.2.1 Problem FormulationBy the synchronicity property, we need to detect malicious

surfer coalitions in which all surfers have similar behaviorpatterns. We define the synchronization similarity (sync-similarity for short) between each pair of click histories andthe coalition center for every surfers coalition in order toformulize these coalitions.

1103

A 44

A

1

2

3

AAA

A

1

2

3

4

5

A

1

2

3

A

1

2

3

A

3

A

3

4

I. II.

III. IV.

5/B

NewCluster!Too far..

Figure 4: The nonparametric clustering procedure.

Definition 1. [Sync-Similarity] Given two click histo-ries xi,xj and a time window radius τ , the sync-similaritybetween them is given by

Sτ (xi,xj) =∑

xis∈xixjt∈xj

1(xIis = xI

jt, |xTis − xT

jt| < τ), (1)

where 1(·) is the indicator function.

Numerically, the sync-similarity equals to the number of tar-gets shared by two click histories. Here a common target notonly requires a same advertiser Id appearing in both clickhistories, but also requires the hit times on this advertiserId in the two click histories fall into a same time period.

Definition 2. [Coalition Center] The center μk of coali-tion k has the same form as the click history. It consists ofmany click events, and each event μks consists of two at-tributes, i.e., μks = {μI

ks, μTks}, where the advertiser Id μI

ks

denotes a common attacking target of the coalition and theintrinsic hit time μT

ks denotes the average hit time of clickson this advertiser induced by surfers in this coalition.

For all surfers in coalition k, if the sync-similarities betweentheir click histories and the center μk are larger than a sim-ilarity threshold T , their behaviors will be regarded as syn-chronized. Suppose there are K malicious coalitions, zi de-notes the coalition to which the ith surfer belongs, thesecoalitions should satisfy the following condition:

Condition 1. [Synchronicity Condition]

Sτ (xi,μk) > T, ∀k, i, s.t. zi = k, (2)

where T is a similarity threshold.

Now our problem is to find coalitions that satisfy E-q. (2), as well as to find their centers. If we consider surfer-s who reside outside all coalitions as coalitions with onlyone surfer in it, the original detection problem will becamea clustering problem. Each point for clustering representsthe click history of one surfer; each cluster represents onecoalition; and the cluster center represents the coalition cen-ter. For convenient calculation, we assume that all coalitionstarget on exact w advertisers. This assumption may lead toomit some coalitions which target on less than w advertis-ers, the reduction of flexibility brought by this assumptioncan be compensated by a propagation step in the final stage.

3.2.2 Clustering AlgorithmThere are two main differences between our problem and

an ordinary clustering problem. Firstly, the number of clus-ters is very hard to decide in advance, and it increases aboutlinearly as the number of surfers increases. This is becausemost surfers behave normally, and then each of them belongsto one new cluster. Secondly, for each surfer in a cluster, thesync-similarity between it and the cluster center should belarger than a radius threshold. So we can not use classicclustering algorithms (e.g., K-means) directly. Inspired byDP-means [9, 12, 23], which is a small variance asymptoticsof Dirichlet process mixtures [2], we present a nonparametricmethod, which solves the following problem:

maxC,{lc}kc=1

k∑

c=1

∑

i∈lc

Sτ (xi,μc)− λwk, (3)

where C = {μc} denotes all cluster centers, lc = {i|zi = c}denotes all indexes of the surfers in cluster c, λw = (1− ρ)wis a similarity threshold, and ρ ∈ [0, 1] is a relaxing factor.Problem (3) admits two properties: (1) The final cluster

number is potentially unbounded and automatically deter-mined by the data, and (2) The sync-similarity between eachpoint to its most similar cluster center must be larger thanρw. To see the first property, since the cluster number k isalso a variable in this objective, we need to learn the clusternumber in real time. So the cluster number will increaseswhen data grows, which is potentially unbounded. To seethe second property, once the similarity between a point xi

to its most similar center μc is smaller than ρw, we cancreate a new cluster whose center is composed by w eventsin xi, then the similarity between xi and this new clustercenter will be w, and the total change on the objective isw − Sτ (xi,μc)− λw = ρw − Sτ (xi,μc) > 0.

These two properties provide us an iterative way to finda local optimum of problem (3). The final algorithm is simi-lar as K-means’ two-step update. For each iteration, we firstassign each point into its nearest cluster, then update thecluster centers based on the assignments. The main differ-ence between our algorithm and K-means is the assignmentstep. When a new point xi comes, we find its most similarcluster center. If the similarity between xi and this center issmaller than ρw, we generate a new cluster whose center iscomposed by w events in xi. Then we assign xi to this newcluster. Fig. 4 illustrates this procedure. When converge, wemaintain the remaining clusters whose size larger than athreshold n for the use of the next stage.The algorithm is outlined in Alg. 1, which consists of a

UpdateCenter subroutine that solves the subproblem

maxμc

∑

i∈lc

Sτ (xi,μc). (4)

Though the problem can be solved by enumerating all thepossible combinations of w events, the time complexity isO(mw), where m is the average number of unique eventsin points of this cluster, which is very large. Here we intro-duce an greedy algorithm, which is approximate but efficien-t. We sort all advertisers by their occurrence frequencies inall surfers’ click histories in this coalition, then use the topw advertisers as the cluster center. The intrinsic hit timesare the averages of click times on these advertisers.As we shall see in experiments, the algorithm with greedy

approximation still converges well and finds good solution-

1104

Algorithm 1: Serial solution for coalition detection

Input: ρ, w, τInput: surfer-advertiser inverted list Gk = 0, C = ∅

while not converged dofor xi ∈ G do

c = argmaxc∈{1,··· ,k} Sτ (xi, μc)

if Sτ (xi, μc) < ρw thenμ′ = {Select w events in xi}C = C ∪ {μ′}, k = k + 1zi = k

else zi = cfor c ∈ {1, · · · , k} do μc =UpdateCenter(c)

Output: Accepted cluster centers C

Procedure UpdateCenter(c)

n = t = ∅

for xi ∈ G and zi = c dofor j ∈ {1, · · · , |xi|} do

r = xIij

if nr /∈ n thenUpdate n and r

nr = nr + 1tr = tr + xT

ij

for nr ∈ n do tr = tr/nr y = {the indexes of largest welements in n}Output: {events formed by y and times in t}

s. By this approximation, the time complexity of Update-Center is reduced to O(m log(m)), and it can be furtherreduced to O(m log(w)). If m ≈ D/k, the overall time com-plexity for one iteration of Alg. 1 is O((k + log(w))D). Asanalyzed above, most items belong to a cluster with size 1, sok ≈ N . This causes the algorithm still very time consum-ing. We will describe an approximate and parallel algorithmthat we use in practice in the next section.

3.3 Filtering StageUsually we can find many large coalitions after cluster-

ing, which may contain false alarms. For example, for hotbusinesses such as games or healthcare, normal surfers withsimilar information demands may also click a lot of commonadvertisers that provide similar services. Since the numberof these kinds of surfers can be large, it is possible to appeargroups of normal surfers which exhibit both the target syn-chronicity and the temporal synchronicity. This will causefalse alarm detections. In order to distinguish these falsealarms from real fraud coalitions, we build a query dispersi-ty filter for clusters based on the dispersivity condition.From our observations, although normal coalitions may

exhibit synchronicity, their targets usually focus on one busi-ness domain or a few highly related domains, which invalidthe dispersivity condition. To evaluate how dispersive a clus-ter is, we define the domain coherence coefficient (DCC) ofa set of advertisers.

Definition 3. [Domain Coherence Coefficient] Givena set of advertisers A. Let A′ be its largest subset in whichall advertisers belong to a same business domain. The do-

Algorithm 2: Query dispersity filter

Input: Q, λ, wInput: candidate cluster centers CF = ∅;for μi ∈ C do

di = maxqj∈Q |μIi ∩ qj |;

if di ≤ λw thenF = F ∪ {μi};

Output: fraudulent cluster centers F

main coherence coefficient of this set is

Rdcc(A) =|A′||A| . (5)

Collecting domain information for all advertisers to cal-culate each cluster’s DCC relies on a lot of external in-terventions. In our method, we choose a more straight-forward way. We first build a query-advertiser inverted listQ from raw click logs. Each entry qi ∈ Q correspond-s to a unique query, and the elements qij ∈ qi representadvertisers that have displayed together with query qi. S-ince these advertisers are related to a common query, theirbusiness domains should be related. For cluster i, we useμI

i = {μIis|μis ∈ μi} to represent all advertisers targeted

by surfers in this cluster, then if we find an entry qj thatsatisfies |μI

i ∩ qj | = pij , we can say at least pij advertisersin μi are related. So by the definition of DCC, we can finda relation that

Rdcc(μIi ) ≥ max

qj∈Q|μI

i ∩ qj ||μI

i |, (6)

where |μIi | always equal to w in our setting. Since larger

Rdcc means less dispersity, we can choose a threshold λ forRdcc and remove clusters that invalid the dispersivity con-dition. Alg. 2 outlines the query dispersity filter.After filtering, the remaining clusters represent the detect-

ed fraudulent coalitions. As a final step, we recall click logsthat relate to them. For each coalition, the clicks happenedbetween its surfers and the advertisers within its coalitioncenter are recalled as crowd fraud clicks. Here we can al-so use our fraudulent centers as seeds of a bipartite graphpropagation algorithm [14], then iteratively expand the setof suspicious surfers and the set of suspicious advertisers, aswell as their intrinsic hit times. The propagation can com-pensate the reduction of flexibility brought by the assump-tion that every coalition center consists of w events, and ithelps to increase the recall rate of the method.

4. PARALLELIZATIONThe real world click logs can be very large, easily render-

ing a serial algorithm as above inapplicable. So we develop aparallel implementation to make it practical in real scenar-ios. The constructing stage and filtering stage are easy toparallelize under a distributed computing framework, suchas MapReduce [6]. Our discussion will focus on the difficultnonparametric clustering step. We also provide some imple-mentation details of our system.

4.1 Parallel Nonparametric ClusteringThe nonparametric nature of our clustering algorithm

causes difficulties in its parallelization. The main difficulty

1105

...

Discovered Clusters

Data Assignm

ents

Newlygeneratedclusters

3

Assign Assign Assign

2

Assign Assign

Validate

4

1 2

Newlygeneratedclusters

7

Assign Assign Assign

6

Assign Assign

Validate

8

5 6

Figure 5: Parallel diagram for the assignment step.

lies in the assignment step, in which newly generated cluster-s are immediately used by other data points. So we cannotsimply divide the assignment tasks to different computing n-odes. Here, we use the optimistic concurrency control (OCC)technique [18] to make parallelization possible.Fig. 4 shows a diagram of parallel assignment step. Using

the OOC technique, we divide the assignment step into Tepoches and equally partition the whole inverted list G intoT parts denoted by B(t), t ∈ {1, · · · , T}.Each epoch only processes one data portion. The new-

ly generated clusters in an epoch are recorded for furtheruse, but not used immediately. That is, each data point pro-cessed in this epoch only needs to be compared with clustersgenerated by the end of the last epoch. Since these cluster-s’ information is known before the start of this epoch, theassignment tasks in one epoch can be distributed withoutcommunication. After each epoch, the new clusters generat-ed by different nodes may overlap as they are not comparedwith each other. So a serial validation step is needed be-tween each two epoches. During validation, running on amaster node, every pair of the newly generated clusters arecompared; and if their similarity is larger than the similaritythreshold, we merge them as well as their associated datapoints. Pan, et al. [18] has proved this OOC algorithm forDP-means is equivalent to the serial algorithm. Their proofis also suitable for our algorithm.For our problem, the total number of clusters approxi-

mately equals to the number of surfers. So both comparinga point with all cluster centers and delivering cluster cen-ter files from slave nodes to master nodes are very expen-sive. However, since most clusters are induced by normalsurfers, they only contain one surfer per cluster and will beremoved after clustering. So if the data points are random-ly arranged, we can remove smaller clusters and maintainno more than K clusters after each epoch to speed up clus-tering. This reduction approximation may lead to removesome small fraudulent coalitions, but the algorithm can bespeed up significantly. With OCC parallelization and reduc-tion approximation, our final parallel solution for coalitiondetection is described in Alg. 3.

Algorithm 3: Parallel solution for coalition detection

Input: T, ρ, w,K, τInput: B(t), t ∈ {1 · · ·T}C = ∅

while not converged dok = |C|,Z = ∅;for epoch t = 1 to T do

C′ = ∅

for xi ∈ B(t) do in parallelc = argmaxc∈{1,··· ,k} Sτ (xi, μc)

if Sτ (xi, μc) < ρw thenμ′ = {Select w events in xi}C′ = C′ ∪ {μ′}zi =Ref(xi) //Ref() is the referencefunction to the coalition center;

else zi = c

Validate(C′, ρw)C ={K largest clusters in C ∪ C′}

for c ∈ {1, · · · , |C|} do in parallelμc =UpdateCenter(c)

Output: Accepted cluster centers C

Procedure Validate(C, λ)

for μi ∈ C doc = argmaxc∈{1,··· ,|C||c�=i} Sτ (μi,μc)

if Sτ (μi,μc) > λ thenRef(μi)=cμi = ∅

Remark 1. Intuitively, the majority of people behave nor-mally, so almost all clusters in our problem are small clusterswith only one data point in it, and the mistake induced bythe reduction approximation will not be very high. In fac-t, under a relatively ideal setting that each point comes froman i.i.d. distribution, the false negative rate can be estimated

as niT(1− TK

N)(e− 1)−

niT , where ni is the size of a suspicious

large cluster i with more than one point in it. We defer thederivation details to Appendix. This result shows that alarger N leads to a larger false negative rate. Since the func-tion xa−x is monotonically decreasing when x > 0, a largecluster is less likely to be removed. Moreover, the larger Kwill lead to a smaller false negative rate, and if K = N/T(i.e., no reduction), the false negative rate is 0.

4.2 Implementation DetailsBoth the clustering and filtering stages involve a lot of

calculations on sync-similarity. To make this computationefficient, we sort every click history when constructing thesurfer-advertiser inverted list. The events in a click historyare ordered by their target advertiser Ids. When clusters arenewly generated or updated, we maintain their orders. Sowhen comparing two click histories, we can array in orderall events belonging to them within linear time, and computetheir sync-similarity by counting the number of adjacent andsimilar event pairs. The time complexity for this calculationis O(d1 + d2), where d1 and d2 are the sizes of two clickhistories.

1106

0 100 250 500 750 10000

200

400

600

800

1000

# Malicious coalitions

# co

aliti

ons

reca

lled

OptimalWithValidationWithout Validation

(a) Recall

100 250 500 750 10000

10

20

30

40

50

# Malicious coalitions

Tim

es p

er it

erat

ion

(min

)

With ValidationWithout Validation

(b) Running speed

Figure 6: Performance on synthetic data: (a) the relation between the number of generated coalitions andthe number of discovered coalitions; (b) the per iteration running time for the two clustering settings.

The validation procedure of OCC compares every pair ofthe newly generated clusters. This is a very time consum-ing bottleneck of the clustering algorithm. Meanwhile, weempirically found that only very few clusters can be mergedduring validation. So we can skip the validating procedure tofurther speed up the algorithm. Through evaluation in thenext section, we can see this trick brings significant speedup and still holds an acceptable accuracy.

5. EXPERIMENTSTo verify the effectiveness of our crowd fraud detection

system, we conduct a series of experiments on both syntheticand real click data and carefully evaluate its sensitivity, con-vergence, scalability and accuracy. Most of our algorithmsare written in C++ ran under the streaming mode of a mod-ified Hadoop [1] system. All the experiments are conductedon a Hadoop cluster with more than 4,000 nodes, and we use1,000 mappers and 400 reducers. Raw click logs are storedon the HDFS.

5.1 Synthetic DataMalpractices for Internet advertising is often hard to dis-

tinguish. To judge whether a single click log is malicious ornot, an evaluator often needs to expand a lot of logs thatcorrespond to the source IP or target advertiser Id of thislog. Even an experienced researcher can only label about50 logs per hour, so it is too labor intensive to label all thelogs in a real large dataset. Thus, it is hard to evaluate theperformance of our system, especially its recall rate.In concern about this issue, we first provide results on

synthetic data, where the truth is known, to check the san-ity of our algorithms as well as evaluate the recall. Here,we generate several datasets, each of which consists of t-wo parts: normal part and fraudulent part. For the normalpart, we simulate 1 million surfers and 100 thousand ad-vertisers. Each normal surfer randomly clicks 10 advertiser-s, and the hit times for these events are uniformly sampledfrom [1, 240], which represents a time period of 240 hours. S-ince advertiser Ids and hit times are randomly sampled, it isunlikely to appear coalitions within this part of click logs. Asfor the fraudulent part, we generate L coalitions, each ofwhich consists of 200 surfers and 5 advertisers and assignseach advertiser a random intrinsic hit time. Each surfer ina coalition clicks all the advertisers in that coalition, and

the clicks target on each advertiser happen within a 6 hourstime period centered at the advertiser’s intrinsic hit time.In the experiment, we set L at 100, 250, 500, 750 and 1,000,leading to 5 different datasets.The synthetic experiments only use the clustering stage

of the system to evaluate recall rate, and due to the da-ta generating mechanism, the coalition detection precisionon this synthetic dataset should be near 100%. So we donot test the result precision on this dataset, and the e-valuation on the system’s precision is left to the real da-ta experiments. As stated in Sec. 4.2, the validation pro-cedure is the computational bottleneck, and only very fewclusters can be merged in this procedure. So we test t-wo types of clustering methods, one with the validationprocedure and one without it. The parameters are set as:T = 4, n = 50, w = 5, τ = 8, K = 10, 000, that is, eachiteration is divided into 4 epoch, the minimum number ofsurfers in one malicious coalition is 50, the minimum numberof advertisers is 5, the time window radius is 8 hours, and theupper bound for the number of clusters maintained duringlearning is 10,000. Other small clusters are discarded on thefly. The discovered cluster numbers and the per-iterationrunning times for the 5 synthetic datasets with differen-t numbers of fraudulent coalitions are shown in Fig. 6(a)and Fig. 6(b).Sensitivity Fig. 6(a) shows the relation between the true

number of coalitions and the number of coalitions discoveredby the algorithm, where the diagonal line shows the optimalperformance (i.e., the number of discovered coalitions equalsto the true number of coalitions). We can see the numberof discovered coalitions for both settings with/without thevalidation procedure increase about linearly when the num-ber of true coalitions increase. The algorithm with validationachieves a recall rate of nearly 100% on average. This resultshows the ability of our algorithm on detecting unknowncrowd frauds. The recall rates of the algorithm without val-idation are relatively lower, e.g., it is about 82% on thedataset with 100 coalitions and 65% on the dataset with1,000 coalitions. Since the occurrences of coalitions in realclick logs are much rarer than the occurrences we definedin the synthetic datasets, the performance of the algorithmwithout validation is also acceptable.Efficiency Fig. 6(b) shows the per iteration running time

for the two types of clustering algorithms. We can see the

1107

0 10 20 30 40 500

2000

4000

6000

8000

# Iterations

# M

alic

ious

IPs

(a) Convergence

0 17 33 50 67 83 1000

15

30

45

60

70

Percentage of data processed (%)

Tim

e (m

in)

(b) Scalability

Figure 7: Performance on real click data: (a) shows the number of malicious IPs we found during iterat-ing. (b) shows the the overall running time after each epoch.

average running time for the algorithm with validation isabout 3 times larger than that of the algorithm withoutvalidation. Considering the overhead time cost induced bythe MapReduce implementation, the efficiency gap broughtby the different algorithm strategies could be much larger. Sowhen testing on the real click dataset, we use the clusteringalgorithm without validation for the clustering stage.

5.2 Real World DataWe applied our method to advertisement click logs of a

major Chinese commercial search engine. We use the datasetin Sec. 2, which consists of around 400 million logs, and eachlog is composed by log Id, source IP, target advertiser Id, hittime and searching query.At the constructing stage, we set SL = 50 and SU =

10, 000 to remove queries whose hit frequencies are extreme-ly small or large, these parameters are decided by the s-tatistics of traffic moderateness on the collected crowd frauddataset, such as in Fig. 2(a). Then we generate a surfer-advertiser inverted list for further use. At the clusteringstage, we set parameters as n = 3, w = 8, ρ = 0.8, τ = 9,that is, each malicious coalition needs to contain at least3 surfers and 8 advertisers, and each surfer needs to clickat least 80% of these advertisers during a time period ofradius 9 hours. These parameters are selected to maxi-mize the recall rate of coalitions on the given crowd frauddataset. In the experiment, we run 50 iterations at the clus-tering stage. Each iteration is divided into 6 epoches andall validation procedures are skipped. As for the reductionapproximation, we maintain 10,000 largest clusters at mostduring clustering, other small clusters are discarded in realtime. So T = 6, K = 10, 000. These parameters are decid-ed by our computing resources, which make sure that theprogram stops running within a reasonable time period. Forthe filtering stage, we choose domain coherence coefficientthreshold λ = 3

8. For the ease of evaluating, the results are

not expanded by propagation.The experimental results are shown as following.Convergence Fig. 7(a) shows the number of malicious IP-

s we found after each iteration. Since the numbers of targetadvertisers in each coalition are the same, this curve actu-ally reflects the objective value of the problem. We can seethis curve converges after about 30 iterations, which showsthe convergence of our clustering algorithm.

New discoveredCrowd FraudSimple Fraud

12.4 K

4.8 K1.0K

18.0 K

6.7 K4.6 K

Figure 8: Diagram for the results on real data.

Scalability To show the running time of our system scalesup linearly when data size scales up, we record the overallrunning time after each epoch among 50 iterations. Fig. 7(b)shows the average running times. We can see that the run-ning time increases about linearly when the percentage ofprocessed data increases. This result shows our detectionsystem is scalable when data grows.Accuracy To evaluate the accuracy of detected frauds, we

compare our results with a rule-based system, which can dis-tinguish simple automatically generated fraud and the crowdfraud in the full traffics. After the clustering stage, we found231 malicious coalitions; after filtering stage, 210 coalition-s are removed by query dispersity filter. The remaining 21coalitions contain 29.3 thousand click logs in total. Throughour observation, 20 of them satisfy the dispersivity condi-tion, which correspond to 98.7% of click logs. The test resultsof these click logs are shown in Fig. 8.24700 logs meet the results of the baseline system, which

account for 83% of our results. 18000 of them are confirmedto be simple fraudulent clicks, they are caused automatical-ly by malwares or spywares; 6700 of them are confirmed tobe more hidden fraudulent clicks, they are very likely to becaused by crowd fraud behaviors. The rest 4600 logs are notfound by the baseline methods. Since manual evaluating isvery expensive, we randomly sampled 200 clicks among themto judge whether they are fraudulent clicks. The final man-ual evaluating result, provided by several domain experts,confirms that the accuracy on this subset is about 90%.

1108

During manual evaluating, we find that all bad cases ofprevious trial are induced by one false alarm coalition. Sowe use a tighter query dispersity filter with λ = 1

8, then

all result coalitions satisfy the dispersivity condition. Theevaluation of this result is also shown in Fig. 8. It showsthat the overall accuracy of this trial is even higher thanthat of the last one.

6. RELATED WORKCrowdsourcing is rising field that includes a series of prob-

lem solving strategies, business models or activities [7, 8,20]. Online working platforms, such as Amazon MechanicalTurk (MTurk) 2, provide a new way to distribute enormoustasks to a crowd of workers, and each worker only needsto finish a small part of the entire task, resulting in fasterand cheaper solutions. This mode is particularly suitablefor large but repetitive tasks like labeling, evaluating, etc.However, the popularisation of crowdsourcing also gives riseto new types of security problems on the web. Crowdturf-ing [22] is the way to hire web workers through maliciouscrowdsourcing platforms to initiate fake campaigns. Thisphenomenon has brought serious problems to social network-s and electronic commerce. In this paper, we focus on thefraudulent click problem for Internet advertising which alsostarts from malicious crowdsourcing platforms.Anomaly Detection [4] is a well studied topic in various

application domains. It aims to find patterns in data whichdo not conform to the expected behavior. Many methodshave been developed for different applications such as frauddetection for credit cards, insurance, health care, intrusiondetection for cyber-security, etc. Fraud detection for Inter-net advertising is an important application of anomaly de-tection. Rule-based methods such as detecting empty cook-ie and hit inflations [17] are useful to find simple attack-s. Graph-based detection methods are also tried, e.g., peopleuse co-clustering or prorogation methods [13] to find suspi-cious dense connections between surfers and targets. As forother related areas, CopyCatch [3] is a successful approachwhich focuses on detecting fake likes on Facebook. Theyprovided a way to find coalitions who demonstrate steplockbehavior. In our work, we build a detection system aimedat crowd fraud detection for Internet advertising which isunbounded and scalable.Clustering is one fundamental problem in data mining. It

groups a set of objects so that objects in the same group aremore similar to each other than to those in other groups. K-means is one of the most popular clustering methods, butit needs to pre-specify the number of clusters. Many non-parametric methods has been studied to overcome this limi-tation, such as Dirichlet process mixtures (DPM) [2], whichis the nonparametric version of the Gaussian mixture modeland can learn the cluster number. Mean-shift clustering is anapproach which merges clusters on the fly [5], with wide usein computer vision. DP means [12] is another nonparametricclustering method derived by a small variance asymptoticsof DPM. It reserves the nonparametric essence and dramat-ically increases running speed compared to DPM. Similarsmall variance techniques have been extended to many oth-er nonparametric Bayesian models [19, 23]. Inspired by DP-means, our work converts crowd fraud detection to cluster-

2http://www.mturk.com/.

ing by defining the sync-similarity, and proposes a fast andparallel algorithm for real Internet advertising.

7. CONCLUSIONSWe formalize the crowd fraud detection problem in Inter-

net advertising, and carefully analyze the behaviors of crowdfraud to identify three important characteristics, includingmoderateness, synchronicity and dispersivity. Based on thefindings, we further develop an effective detection system,which consists of three major steps, data constructing, clus-tering and filtering. One key step is convert the originalcoalition detection problem to a clustering problem. Ournonparametric clustering method ensures to learn the un-known number of coalitions, which is important for real-world applications. Finally, we build a parallel detectionsystem for search engine advertising, and conduct extensiveexperiments to evaluate its performance on both syntheticand real click data. Results show that our system can findfraudulent clicks with a high accuracy, and it can be scaledup to large datasets.In the future, we would like to do more analytical work

on crowd fraud, and test the performance of our system ondatasets of shorter time period. We’d also like to extendcurrent algorithms to other fraud detection problems suchas click fraud or social network spams.

AcknowledgmentsThe work was supported by the National Basic ResearchProgram (973 Program) of China (No. 2013CB329403), Na-tional Natural Science Foundation of China (Nos. 61322308,61332007), and the Tsinghua National Laboratory for Infor-mation Science and Technology Big Data Initiative.

APPENDIXA. FALSE-NEGATIVE RATE ANALYSISLet s be the number of large clusters with size larg-

er than 1, d be the number of small clusters with onlyone point in each cluster, and ni be the size of the ithcluster. Assume that the N data points are i.i.d. sam-pled from a multinomial distribution with s + d param-eters ε1, ε2, · · · , εs, ε0, · · · , ε0, where εi = ni

Ndenotes the

probability that a point is sampled from cluster i, and∑si=1 εi + dε0=1. Since the number of clusters is large, each

εi is small.After the tth epoch, we maintain only K largest clusters

and remove about NT

−K small clusters, so the probability

that a small cluster will be removed is 1 − TKN

. For the ithcluster, the probability that its current size equals to one isNTεi(1−εi)

tNT

−1 ≈ NTεi exp (−tN

Tεi) =

niT

exp (−tniT), where

we use the fact that the binomial distribution converges to-wards the Poisson distribution as the number of trials goesto infinity while the product Nεi remains fixed. Thus theprobability that this cluster will be removed after this epochis (1 − TK

N)ni

Texp (−tni

T). Considering all T epoches, the

probability that the ith cluster will be removed is (1 −TKN

)niT

∑Tt=1 exp (−tni

T) ≤ (1 − TK

N)ni

T(e− 1)(−

niT

). There-fore, the false negative rate is the one as we sated in theRemark 1.

1109

B. REFERENCES[1] Apache hadoop. http://hadoop.apache.org/.

[2] C. E. Antoniak. Mixtures of Dirichlet processes withapplications to Bayesian nonparametric problems. TheAnnals of Statistics, pages 1152–1174, 1974.

[3] A. Beutel, W. Xu, V. Guruswami, C. Palow, andC. Faloutsos. CopyCatch: stopping group attacks byspotting lockstep behavior in social networks. InWWW, 2013.

[4] V. Chandola, A. Banerjee, and V. Kumar. Anomalydetection: A survey. ACM Computing Surveys(CSUR), 41(3):15, 2009.

[5] Y. Cheng. Mean shift, mode seeking, and clustering.IEEE Trans. on PAMI, 17(8):790–799, 1995.

[6] J. Dean and S. Ghemawat. MapReduce: simplifieddata processing on large clusters. Communications ofthe ACM, 51(1):107–113, 2008.

[7] A. Doan, R. Ramakrishnan, and A. Y. Halevy.Crowdsourcing systems on the world-wide web.Communications of the ACM, 54(4):86–96, 2011.

[8] J. Howe. The rise of crowdsourcing. Wired magazine,14(6):1–4, 2006.

[9] K. Jiang, B. Kulis, and M. I. Jordan. Small-varianceasymptotics for exponential family Dirichlet processmixture models. In NIPS, 2012.

[10] E. Kamar, S. Hacker, and E. Horvitz. Combininghuman and machine intelligence in large-scalecrowdsourcing. In AAMAS, 2012.

[11] L. Kim. The most expensive keywords in Googleadwords.http://www.wordstream.com/blog/ws/2011/07/18/

most-expensive-google-adwords-keywords, 2011.

[12] B. Kulis and M. I. Jordan. Revisiting k-means: Newalgorithms via Bayesian nonparametrics. In ICML,2012.

[13] X. Li, Y. Liu, M. Zhang, and S. Ma. Fraudulentsupport telephone number identification based onco-occurrence information on the web. In AAAI, 2014.

[14] X. Li, M. Zhang, Y. Liu, S. Ma, Y. Jin, and L. Ru.Search engine click spam detection based on bipartitegraph propagation. In WSDM, 2014.

[15] A. Metwally, D. Agrawal, and A. El Abbadi.Detectives: detecting coalition hit inflation attacks inadvertising networks streams. In WWW, 2007.

[16] A. Metwally, D. A. A. El Abbadi, and Q. Zheng. Hideand seek: Detecting hit inflation fraud in streams ofweb advertising networks. Technical Report,University of California at Santa Barbara, 2006.

[17] R. Oentaryo, E.-P. Lim, M. Finegold, D. Lo, F. Zhu,C. Phua, E.-Y. Cheu, G.-E. Yap, K. Sim, M. N.Nguyen, et al. Detecting click fraud in onlineadvertising: a data mining approach. JMLR,15(1):99–140, 2014.

[18] X. Pan, J. E. Gonzalez, S. Jegelka, T. Broderick, andM. Jordan. Optimistic concurrency control fordistributed unsupervised learning. In NIPS, 2013.

[19] A. Roychowdhury, K. Jiang, and B. Kulis.Small-variance asymptotics for hidden Markov models.In NIPS, 2013.

[20] R. Snow, B. O’Connor, D. Jurafsky, and A. Y. Ng.Cheap and fast—but is it good?: evaluatingnon-expert annotations for natural language tasks. InEMNLP, 2008.

[21] Y. Tian and J. Zhu. Learning from crowds in thepresence of schools of thought. In SIGKDD, 2012.

[22] G. Wang, C. Wilson, X. Zhao, Y. Zhu, M. Mohanlal,H. Zheng, and B. Y. Zhao. Serf and turf: crowdturfingfor fun and profit. In WWW, 2012.

[23] Y. Wang and J. Zhu. Small-variance asymptotics forDirichlet process mixtures of SVMs. In AAAI, 2014.

1110