Collusion Detection

Recent research (Kauffman and Wood 2003; Shah, Joshi et al. 2003; Rubin, Christodorescu et al. 2005) considers the issue of anomalous behaviour in Internet auctions. Specifically, competitive shilling, collusion between Internet auction users to drive up the price in an auction, may be used by auction sellers to ensure that a legitimate bidder pays a higher price for the item than in the case where no shilling occurs. Trying to detect or predict such opportunistic behaviour is beyond the scope of most Internet auction research, mainly because, according to the National Consumer League, shilling is the hardest type to detect of the various types of fraud to occur in this domain (Fraud.org 2006).

Shilling occurs when a seller bids in his own auction via aliases or friends. This form of collusion becomes even more difficult to detect in Internet auctions, where alias identities are easily obtained and any user with multiple accounts (and IP addresses) can shill without assistance of friends. Internet auction providers typically employ undisclosed proprietary methods for shill prevention, however, shilling may still occur to some extent.

This section addresses the need for a collusion detection method to be designed to identify anomalous auction-duration behaviour and to be incorporated in decision-making for reputation management. We first discuss the results of the very limited current research in the area of Internet auction shilling. We then propose the design of a collusion detection method, which is modelled using SECURE event structures to capture auction-duration events.

3.5.2.1 Recent Research into Collusion Detection in Internet Auctions

In Shah et al. (Shah, Joshi et al. 2003), it was discovered that attributes of bidding behaviour, mined from eBay’s public auction records, could be codified such that different types of bidders could be classified according to bidding strategy. This result is particularly relevant to the detection of fraud such as shilling because the following characteristics of a shill bidder can be identified from auction system data: first, there is a strong association between a seller and a bidder, or a ring of bidders, i.e., the shill(s) appears very frequently in auctions hosted by the seller; next, the shill wins auctions infrequently, if at all; third, the bids placed by a shill are significantly higher than the current asking price; finally, a shill will eschew sniping and late bidding to permit legitimate buyers enough time to respond to his bid increment, as well as to avoid winning the auction.

Research by Kauffman and Wood (Kauffman and Wood 2003) also addresses the characteristics of a shill bidder. They show how to detect such opportunistic behaviour by first examining what a market would look like if shilling behaviour existed and then to test for that behaviour. The identified behaviour is similar to that pinpointed by Shah et al., i.e., the characteristics of ‘questionable bids’ are: first, a shill bidder bids in a colluding seller’s auction regardless of other auctions of similar items; next, a shill bidder concentrates on fewer sellers than other bidders; third, shill bids are usually placed early in the auction and are incremented in large increments, i.e., an average of 62% per increment rather than the non-shill average of 38%; finally, and most importantly, shill bidders try not to win the auction in which they are bidding, i.e., average win rates of shills is 23%, versus non-shills, 35%. These results, based on the analysis of over 10,000 eBay coin auctions, allow the prediction of the presence of shilling in an auction based on the assessment of past behaviour of auction participants. Finally, Rubin et al. (Rubin, Christodorescu et al. 2005) designed and developed a behaviour-based reputation system to help buyers identify sellers whose auctions seem price-inflated. The design is based on models that characterize sellers according to statistical metrics related to price inflation and with anomaly detection techniques to identify suspicious sellers. The characteristics of a suspicious seller in this model is one who lists many auctions which have many bids, do not start auctions with a

relatively low starting bid, and has a group of bidders who repeatedly participate in his auctions and lose. The reputation system outputs to the user a set of values representing the confidence with which the system can say that the auctions of a particular seller are price-inflated. This system was evaluated on over 600 high-volume sellers who listed over 37,500 auctions on eBay. The system automatically detected a small set of sellers whose auctions contained potential shill bidders. We note that this system does not output the cause of inflation, whether legitimate or fraudulent.

In each of these cases, similar types of behaviour attributes are used to characterise questionable bidders, leading us to propose the design of a collusion detection method based on amalgamation of the behaviour attributes identified in this work, as discussed in the following section.

3.5.2.2 Design of the Collusion Detection Method

Based on the results of the research into the area of anomalous behaviour in Internet auctions, we put forward a simple design for the detection of colluding sellers and shills that focuses on the key characteristics of a questionable bid: that shills experience less-than-average win rates for the auctions in which they participate, shills tend to make large bid increments, shills tend to bid early and not late, and that a shill typically interacts with fewer sellers than legitimate bidders. The detection process is done on the buyer side, i.e., when a bid request is put to SECURE for decision-making.

First, in line with the SECURE event-based trust model described earlier, we identify the possible auction-duration events that will allow the profiling of a user-pair, i.e., seller-bidder, behaviour. We base the events for this design on an amalgamation of the attributes of anomalous bidding behaviour put forward by Shah et al., Kauffman and Wood, and Rubin et al., i.e., bidder-seller relationship, bid amount, bid timing, and loss rate. An event structure that captures these attributes as observable events is illustrated in Figure 35.

bids in a seller’s auction # large increment other increment # early bid other bid # loses # wins

does not bid in a seller’s auction

{b}

{b, i} {b, `i} {b, e} {b, `e} {b, l} {b, `l}

{b, i, e} {b, `i, e} {b, i, `e} {b, `i, `e} {b, i, l} {b, `i, l} {b, i, `l} {b, `i, `l} {b, e, l} {b, e, `l} {b, `e, l} {b, `e, `l}

{b, i, e, l} {b, i, e, `l} {b, i, `e, l} {b, i, `e, `l} {b, `i, e, l} {b, `i, e, `l} {b, `i, `e, l} {b, `i, `e, `l}

{`b} # {Ø} Figure 36: BS ES

C modelling auction-duration event configurations

The event configurations possible for ESBS , i.e.,

BS

ES

C , are illustrated in Figure 36 wherein event names are abbreviated. As illustrated, many event configurations are observable by the auction system about a bidder-seller relationship. At the bottom level of

BS

ES

C , no observations about a bidder-seller relationship are observed. At the second level of

BS

ES

C are the outcomes {b} and {`b}, representing observations of whether or not a bidder bids in a seller’s auction. At the next level, when a bidder bids in a seller’s auction, it is possible to observe whether the bid was a large or small increment, whether the bid was made early or late in the auction, and whether the bidder won the auction or not. The fourth level of

BS

ES

C shows configurations representing outcomes in which combinations of three behavioural events are observed, i.e., that a bidder bid in a seller’s auction and whether or not that bid was a large increment; or that a bidder bid in a seller’s auction and whether or not that bid was made early in the auction. At the top-most level of

BS

ES

C , configurations express outcomes in which all possible behaviour events are observed.

In order to determine which event configurations are most relevant to the decision-making process, Table 4 lists the attributes necessary for detecting colluding behaviour, gives the event configurations needed to describe each attribute, and classifies both normal and anomalous behaviour in bidder-seller relationships based on the results of the research described in section 3.6.2.1. From this table, we find

that the following event configurations can be used to indicate the likelihood of normal or colluding seller-bidder behaviour: {b}, {b, i}, {b, e}, and {b, l}, giving information to assess bidder-seller interaction dynamics in the form of relationship attributes: P, the likelihood of a bidder-seller relationship being strong; B, the likelihood of a bidder’s increments being large; T, the likelihood of a bidder’s bids being made early in an auction; and Λ, the likelihood of a bidder losing in a seller’s auction. Therefore, even though it is possible to observe more complex configurations, our detection method is satisfied by this set of configurations. Moreover, as illustrated in

BS

ES

C , the observation of outcomes at levels 4 and 5 captures combinations of behaviour events that detract from the flexibility needed to assess relationship attributes individually.

Table 4: Event configurations necessary for detecting colluding behaviour Attribute Event configuration per

attribute

Normal behaviour Anomalous behaviour Bidder-Seller

Relationship,

Ρ

Bidder appears (bids) in seller’s auction, {b} Bidder does not appear in seller’s auction, {`b} observations of {b} low Ρ = = observations of {b} high Ρ = = Bid Amount, Β

Bidder bids large increment in seller’s auction, {b, i} Bidder bids ‘normal’ increment in seller’s auction, {b, `i} observations of {b, i} low Β = = observations of {b, i} high Β = = Bid Timing, Τ

Bidder bids before a specified point in time in a seller’s auction, {b, e} Bidder bids after a specified point in time in a seller’s auction, {b, `e}

observations of {b, e} low Τ = = observations of {b, e} high Τ = = Loss Rate, Λ

Bidder bids in seller’s auction and loses, {b, l} Bidder bids in seller’s auction and wins, {b, `l}

observations of {b, l} low Λ = = observations of {b, l} high Λ = =

Because our collusion detection method is based on the SECURE trust model, a (s, i, c)-triple captures evidence which supports, contradicts, or is inconclusive about the configuration describing each bidder-seller relationship attribute, Ρ, Β, Τ, and Λ. This evidence results from auction system observations about auction-duration events.

Finally, Ρ, Β, Τ, and Λ are each given a weight, with weight total to be 100%, so that each parameter can contribute to the total expected probability of collusion in a flexible way. For example, each attribute may be equally important when determining overall likelihood of collusion between a seller,

Λ + Τ + Β + Ρ =

Φ_qb .25 .25 .25 .25 . Clearly, these weights can be adjusted in favour of some attributes over others. Moreover, as other anomalous behavioural attributes arise in research in this domain, they may easily be added to our model.

The final combined (s, i, c)-triple of evidence about Φqb is then used to derive an expected probability

of the occurrence of collusion in a given auction. This probability is derived by

(

)

c i s s R _qb + + = Φ .