$30 off During Our Annual Pro Sale. View Details »

SHIELD : Protect from Abusers in LINE Timeline

SHIELD : Protect from Abusers in LINE Timeline

LINE DEVDAY 2021
PRO

November 10, 2021
Tweet

More Decks by LINE DEVDAY 2021

Other Decks in Technology

Transcript

  1. None
  2. Agenda - About SHIELD - Team Tasks - History of

    SHIELD - Team Objective - Why need to abusing detection? - Abusing cases - How to detect abusers - Architecture - Workflow - Rule based Models - ML based Models - History of infra - Detected Abusers - What SHIELD will do
  3. Agenda - About SHIELD - Team Tasks - History of

    SHIELD - Team Objective - Why need to abusing detection? - Abusing cases - How to detect abusers - Architecture - Workflow - Rule based Models - ML based Models - History of infra - Detected Abusers - What SHIELD will do
  4. About SHIELD Team Tasks - Text Filtering (NLP) - Agent

    and Admin - Abusing Detection (Anomaly Detection)
  5. About SHIELD History of SHIELD Start SHIELD Release first model

    Release story and birthday models Will release new models 2019.03 2020 2021 2019.02
  6. About SHIELD Team Objective Make Brighter Green for LINE

  7. Agenda - About SHIELD - Team Tasks - History of

    SHIELD - Team Objective - Why need to abusing detection? - Abusing cases - How to detect abusers - Architecture - Workflow - Rule based Models - ML based Models - History of infra - Detected Abusers - What SHIELD will do
  8. Why need to abusing detection? Reason - Users want to

    use more comportable. - Protect user’s emotion. - Users want to see the contents they want it.
  9. Abusing Cases Comment abusing cases - User who only counts

    meaningless numbers - User listing unknown strings - User who used it over 2,000 times in 1 hour
  10. Agenda - About SHIELD - Team Members - History of

    SHIELD - Team Objective - Why need to abusing detection? - Abusing cases - How to detect abusers - Architecture - Workflow - Rule based Models - ML based Models - History of infra - Detected Abusers - What SHIELD will do
  11. How to detect abusers ML base abusing detection ML base

    anomaly detection ML base spam detection Penalty Results Table Alert Warning Tables Data stream Infra aggregation module rule base abusing detection Log Anomaly detection Aggregation Table Data storage Real time Data processing Data analytics Anomaly Pattern Analyse Abusing Pattern Analyse Workflow
  12. How to detect abusers Workflow Rule based Models ML based

    Models Request Analyze Decision Threshold Service Penalty Tuning Discard Yes No Research Implement Verify Service Penalty Tuning Discard Yes No
  13. Alert system - The purpose of collecting and analyzing the

    anomaly cases - Warning, not penalty - Link with penalty if a certain pattern is found - Anomaly case is detected only using autoencoder - Isolation forest will also be operational in 2021 2H
  14. How to detect abusers Rule based Models - LINE Timeline

    Story - LINE Timeline for Birthday Card - LINE Timeline
  15. How to detect abusers ML based Models - DBSCAN -

    Autoencoder - density_based - Isolation Forest
  16. Density_based - Process according to the user's usage by time

    zone - Divide into cells using standard deviation. - Self development algorithm - Change to normal depending on the surrounding cells from abnormal - Use the number of users in the cell to classify normal/abnormal.
  17. Density_based

  18. Density_based - Ambiguous abusing that does not fall under the

    rules - Abusing that cannot be detected as a pattern of the rule model
  19. Density_based

  20. DBSCAN - No need to set the number of clusters

    - Can find any shape of cluster - A Density based clustering algorithm - Can identify anomalies
  21. DBSCAN - Hyper parameter : MinPts, Epsilon

  22. DBSCAN - Missing abusers in density_based model

  23. Autoencoder - Easy implement - Consist of an encoder and

    a decoder - Anomaly has a large reconstruction error. - Intuitive anomaly detection
  24. Autoencoder

  25. Autoencoder - Can not know what behavior the abusers will

    use - Can not monitor all actions of the abuser - Need to preemptive detection - Detection of changing abuser patterns
  26. Isolation Forest - Isolate quickly anomaly data - Useful for

    high dimensional data sets - Don’t use density or distance - Split data randomly based on decision tree
  27. Isolation Forest

  28. Isolation Forest - Need to preemptive detection - Detect Abusing

    pattern according to major behaviors
  29. How to detect abusers History of infra 2021 Clickhouse 2020

    Elastic Search 2019 LINE common DW
  30. How to detect abusers Characteristics LINE Common DW Store almost

    LINE log Convenient use Elastic Search Clickhouse ELK(Elastic search, Logstash, Kibana) Search engine Column based DB
  31. How to detect abusers Pros. & Cons. LINE Common DW

    Data diversity Data persistence Elastic Search Clickhouse Time delay Slow response with query Fast storage speed Fast search Difficult big data aggregation Fastest response with query Easy data aggregation Lack of references
  32. How to detect abusers Why do we use clickhouse? -

    Propose of use - LINE common data warehouse - Data analyze - Elastic search - Search - Clickhouse - Near real time data process
  33. Agenda - About SHIELD - Team Tasks - History of

    SHIELD - Team Objective - Why need to abusing detection? - Abusing cases - How to detect abusers - Architecture - Workflow - Rule based Models - ML based Models - History of infra - Detected Abusers - What SHIELD will do
  34. Detected Abusers Results of 2021 1H ML based results Rule

    based results 0 12,500 25,000 37,500 50,000 Jan. Feb. Mar. Apr. May Jun. Timeline 0 2,500 5,000 7,500 10,000 Jan. Feb. Mar. Apr. May Jun. Timeline
  35. Detected Abusers Results of 2021 1H Rule based results 0

    15 30 45 60 Jan. Feb. Mar. Apr. May Jun. Story Birthday
  36. What SHIELD will do Next Plan - Improve text filter

    performance - Make user negative behavior score Text Filter Manager for abusing and result of text filtering - Make more convenient system - Make monitoring system for abusing Abusing Detection - Add rule and ML based models - Make alert system - Make user negative behavior score
  37. Thank you