Structural Node Embedding in Signed Social Networks: Finding Online Misbehavior at Multiple Scales Mark Heimann1, Goran Muric´2, and Emilio Ferrara2 1 Lawrence Livermore National Laboratory, Livermore, CA, USA?? [email protected] 2 Information Sciences Institute, Marina Del Rey, CA, USA [email protected], [email protected] Abstract. Entities in networks may interact positively as well as negatively with each other, which may be modeled by a signed network containing both positive and negative edges between nodes. Understanding how entities behave and not just with whom they interact positively or negatively leads us to the new problem of structural role mining in signed networks. We solve this problem by devel- oping structural node embedding methods that build on sociological theory and technical advances developed specifically for signed networks. With our meth- ods, we can not only perform node-level role analysis, but also solve another new problem of characterizing entire signed networks to make network-level predic- tions. We motivate our work with an application to social media analysis, where we show that our methods are more insightful and effective at detecting user- level and session-level malicious online behavior from the network structure than previous approaches based on feature engineering. 1 Introduction Networks are a natural model for many forms of data, in which entities exhibit com- plex patterns of interaction. In many applications, entities may form negative as well as positive interactions with each other. For example, users on a social network may form friendships and engage in prosocial behavior with each other, but they may also form animositities and engage in antisocial behavior, such as trolling [17] or cyberaggres- sion [10]. Signed networks, in which edges between node may be positive or negative, can naturally model these interactions of varying polarity. Existing work in signed network analysis often tries to characterize with whom each node interacts. For example, the common task of edge sign prediction [1] is to deter- mine whether two nodes would have a positive or negative interaction; node embedding objectives for signed networks [22, 2] encourage each node to have similar latent fea- ture representations to other nodes with whom it interacts positively, and dissimilar representations to those with whom it interacts negatively. Instead, we focus on the orthogonal and new problem of characterizing how a node forms positive or negative relationships, namely its structural role in the signed network. Existing methods for role analysis in networks [19] are designed for unsigned networks, so we introduce ?? Work done while author was an intern at the Information Sciences Institute. structural node embedding methods that build on sociological theories and technical advances designed specifically for signed networks. Not only can we perform node-level structural role analysis, but we can also char- acterize network-level behavior. For signed networks, this is another new problem, as methods for graph comparison and classification focus on unsigned networks. To solve it, we contribute baseline statistical signatures, graph kernels, and graph features derived from our signed structural node embeddings. The latter describe a signed network’s dis- tribution of structural roles, a very natural and powerful way to characterize a network. We motivate our methodology with an application to social media analysis. Several types of social media users are revealed by their patterns of negative behavior on plat- forms designed to encourage positive interactions. For instance, trolls on social media may try to stir up controversy or causing annoyance to others [17], while cyberbul- lies leave hurtful or aggressive comments for other social media users with the intent to shame, mock, and/or intimidate [11]. Further understanding the nature of antisocial online behavior can lead to more effective preventative measures and improve the so- cial media experience. Our node-level and graph-level methods respectively allow us to characterize social behavior at the level of individual users and larger media ses- sions. While recent work derived several insights about users’ social roles from the network structure alone using hand-engineered network statistics [15], we show that our embedding-based methods can improve on network feature engineering. Our contributions are thus as follows: 1. New Node-level Problem and Methods: we propose structural node embedding methods for the new problem of structural role analysis in signed networks. We pro- pose a simple scheme to leveraging existing (unsigned) methods directly, and also new embedding methods that can learn from multi-sign higher-order interactions. 2. New Graph-level Problem and Methods: we propose techniques for the new problem of signed network classification: baselines using hand-engineered features and more expressive methods that leverage our signed structural node embeddings. 3. Controlled Synthetic Test Cases for Signed Networks: We study the behavior of our techniques in synthetic networks, where we can tailor the signed structural roles of nodes. Our methods are more discriminative than the simpler feature engineering approaches that have recently been used to characterize similar social roles. 4. Applications to Social Media Analysis: We use social media datasets with explicit user-specified edge signs and implicit signs that must be inferred, which can serve as benchmarks for our new problems. In node-level and graph-level analysis of social roles, our methods yield quantitative improvements over feature engineering. For reproducibility, our code is available at https://github.com/markheimann/ Signed-Network-Roles. 2 Related Work The majority of works in graph mining focus on unsigned graphs. We first review rele- vant literature from the unsigned graphs, noting methods designed for signed networks usually outperform unsigned methods na¨ıvely applied to signed networks [2]. With this in mind, we also review relevant literature from signed networks. 2 2.1 Unsigned Network Methods We first review node embedding methods for unsigned networks, which enables node- level graph mining; we then discuss graph-level analysis. Node Embedding. Node embedding learns features for nodes in a network via an objec- tive that encourages similar nodes to have similar features. Often, similarity is defined based on node proximity. Unsupervised methods may model higher order proximities using random walks, matrix factorization, or deep neural networks; we refer the reader to a comprehensive survey on (proximity-preserving) node embedding [6] for more de- tails. In a semi-supervised setting, graph neural networks [16] have grown in popularity. A complementary line of work embeds nodes based on their structural roles: nodes will be embedded close to other nodes with similar local structure, regardless of proximity. Such structural embedding methods are surveyed and contrasted conceptually [20] and empirically [14] to proximity-preserving embedding methods. Graph Classification. While the above methods are often used for node-level analysis, many applications also require network-level predictions. Graph classification seeks to predict the class to which an entire network belongs using supervised machine learn- ing. Three major families of techniques include kernels operating on graph similarity functions [21], unsupervised graph feature learning [8], and end-to-end feature learning with deep neural networks on graphs [5]. Given node embeddings that are comparable across networks–in particular, embeddings capturing structural roles–the gap between node-level and graph-level features can be bridged by modeling the distribution of node embeddings in a sparse graph feature vector. [8]. 2.2 Signed Network Methods Many of the works involved in analyzing signed social networks have their underpin- nings sociological theory. One of the most influential theories on signed network mining is balance theory [7], which specifies some general rules for “balanced” and “unbal- anced” configurations of edge signs. It predicts that balanced configurations are more stable and thus more likely to occur than unbalanced configurations, and generalizes intuition often captured in expressions such as “my enemy’s enemy is my friend”. One of the principal tasks in signed network mining is edge sign prediction. This may be done by directly trying to minimize imbalance in the network, construction of hand-engineered signed features for supervised prediction, or matrix factorization [1]. Recent works have extended network embedding to signed networks based on shallow architectures and random walks [23] or deep architectures [22], applying them to node- level and edge-level tasks within a single network (to the best of our knowledge, multi- network tasks on signed social networks are largely unexplored). Existing approaches do not model structural roles, but rather preserve signed proximity in the network, trying to learn similar embeddings for positively connected nodes and different embeddings for negatively connected nodes. 3 Preliminaries Let G = (V; E) be a directed graph with vertex set V (jV j = n) and edge set E ⊆ V × V . In this work, we consider signed networks: a sign function ' : E ! f1; −1g 3 dictates the sign of each edge as being positive or negative. G has single-sign subgraphs G+ induced by the positive edges of G and G− induced by the negative edges. G has an adjacency matrix A, whose nonzero entries