Large-Scale Shill Bidder Detection in E-commerce

Electronic commerce (e-commerce) usage has increased sharply as e-commerce platforms have become interwoven into people's everyday lives as places to buy and sell products. The e-commerce worldwide sales to consumers is expected to pass the eight trillion dollars mark in 2026, almost quadrupling itself compared to 2014 [5, 9]. E-commerce platforms, such as Amazon,¹ Alibaba,² eBay,³ Etsy,⁴ and OnlineAuction,⁵ already have hundreds of millions of active users [7, 11, 39]. In many e-commerce platforms, users can use the platforms to sell and buy various products from each other, from simple everyday products, such as a cup holder which costs only a few dollars, to more exotic products, such as a fighter jet which costs several million dollars [32]. Furthermore, more than 25 million individuals use e-commerce platforms as their primary or secondary source of income [4].

In many e-commerce platforms, after a user purchases a product, he or she can rate the product and write a review regarding the product's features, such as the product's quality [33]. Furthermore, many e-commerce platforms employ reputation systems, in which the buyer can leave feedback regarding the seller of the product [37]. The accumulated feedback on each seller, which in many cases is viewable to other users of the website, can assist other users in building trust towards the seller [37]. According to Lucking-Reile et al. [30] the feedback these sellers receive can have a measurable effect on their auction prices, where negative feedback has a much greater effect than positive feedback ratings. Moreover, in cases where sellers receive too much negative feedback from other users, the website operator can decide to revoke the seller's selling privileges. For example, Facebook banned and reduced the number of ads for businesses who received too much negative feedback from buyers [3].

As in many other online platforms, such as search engines, online social networks, and online gaming platforms, the platform's users can utilize dishonest techniques to manipulate the platform's statistics in order to create profits [24]. Moreover, in many online platforms, the platform's users can purchase this type of service from third-party providers, which in most cases violates the platforms terms of service. For example, the market of buying fake followers and fake retweets in Twitter is already a multimillion-dollar business [34]. The equivalent to Twitter's fake followers in e-commerce are fake reviews. The fake review industry is flourishing; there are many paid reviewers and even people who receive free products in exchange for a positive review [2, 42]. In e-commerce platforms dishonest users (referred to as shill bidders) can increase their product's price in auctions by bidding on products with the intent to artificially increase the product's price or desirability [19, 41]. Additionally, shill bidders are also users who buy products in order to artificially improve a seller's feedback or the product's search standing [19]. Shill bidding is forbidden in many e-commerce platforms, such as eBay [19], flippa [1], etc. Moreover, shill bidding in online auctions is illegal in some countries, such as the United States, and can be considered as wire fraud, a felony which can lead to a maximum penalty of up to four years in prison and a million dollars in fines [10].

In this paper we study the shill bidder ecosystem. The main contributions of this study are threefold. First, we offer generic algorithms for identifying shill bidders in e-commerce platforms. Moreover, we evaluate these algorithms on one the biggest e-commerce datasets in the world (referred to as the e-commerce dataset), which includes several billion buying transactions and several billion feedback interactions between the platform's users. Second, we analyze the activities of over 187,244 identified shill bidders to better understand their characteristics. Lastly, we investigate the ecosystem of shill bidders and offer methods on how this ecosystem's properties can be utilized to better identify shill bidders. To the best of our knowledge, this study which aims to identify shill bidders is the largest of its kind to date.

The remainder of the paper is structured as follows: In Section 2 we give a brief overview of previous relevant studies related to e-commerce security and shill bidders. In this section, we also introduce several studies which used similar data mining algorithms as this study in other online platforms, such as Facebook and Twitter. Next, in Section 3 we present the methods and algorithms we developed for identifying shill bidders. Afterwards, in Section 4 we describe the e-commerce dataset. Additionally, in Section 4, we present the performed empirical evaluation process and the results of the shill bidder identification algorithms on the e-commerce dataset. Then, in Section 5, we present the performed empirical study of the shill bidders’ characteristics. Furthermore, in this section we also present our analysis of the shill bidders’ ecosystem. Lastly, in Section 6, we present our conclusions and also offer future research directions.

In the past decade, alongside the rise in Internet availability, there was also a constant growth in popularity and volume of e-commerce [23]. However, the extreme popularity and the high anonymity of e-commerce attracted many fraudsters. According to Aite report [6], the 2021 online revenue loss estimation due to fraud estimated at 443 billion USD.

Over the years, many research devoted efforts have to study e-commerce platform's security and trust  [43]; however, only a tiny portion of this work centered on detecting shill bidders. Chakraborty et al. [15] defined shill bidding as the illicit participation of sellers in auctions designed to increase the price at which a product sells. There are many types of shill bidding, and we are going to present two notable types as examples: The first type is competitive shilling, which is the most straightforward kind of shill. Kauffman et al. [26] explain that it is used to make bidders pay more for a product. The seller or his or her accomplices enter bids to make legitimate bidders pay more. The second type is reserve price shilling. Kauffman et al. [26] note that this is a shilling used to avoid paying auction house fees such as insertion fees or secret reserve fees. In addition, there are questionable techniques that stand on a thin line between tips or tricks and shill bidding. For example, Roth and Ockenfels [38] describe last-minute bidding (“sniping”), which is basically placing your bid exactly before the auction ends in order to pay a lower price and snatch the product. There is controversy about sniping and it is considered legal [29, 40]. Moreover, Roth and Ockenfels [38] note that late bidding may be used by a dishonest seller who attempts to raise the price by using shill bidders.

The classical approach for tackling the shill-bidding problem is to use detection and prediction techniques. In 2005, Chau and Faloutsos [17] proposed a feature based method for fraudster detection in online auctions. The features were extracted from a dataset of 115 users from eBay. Next, they inserted the feature sets into a C5.0 decision-tree-based classification algorithm. In their best combination of features, they were able to detect malicious users with a precision of 82%, a True Positive (TP) rate of 83%, and a False Positive (FP) rate of 11%.

In 2007, Pandit [35] developed a model representing users and transactions as a Markov Random Field. The model uses a Belief Propagation mechanism in order to detect fraudulent users. The detected fraudsters with a precision of 0.9 for the synthetic dataset; however, they were unable to present algorithm evaluation results on real-world datasets because they could not label them. In 2008, Beyene et al. [12] presented a model representing eBay transactions and feedback in a graph. In their study, they explained the difference between the eBays graph and a standard social network graph. First of all, they found that a rich club phenomenon [44] did not exist in the eBay feedback graph. Second, they showed that preferential attachment holds only partially. In addition, they discovered that when a user is sufficiently trustable, the exact number of positive reviews became less critical. However, negative reviews significantly hurt the user's credibility. In 2011, Chang et al. [16] proposed a new two-stage phased model for early fraud detection in online auctions. The model's first phase constructed behavior models based on users’ transaction histories. In the first phase, extracted features representing significant behavioral differences between legitimate users and fraudsters. The second phase was fraud detection, where the data of a suspicious account was inserted into the detection model to test if the seller is legitimate. They performed an Instance-Based Learning (IBL) algorithm. They were able to get an average recall rate of classifying accounts of over 93%.

In 2016 Majadi et al. [31] analyzed previous studies on shill bidders and found that the most common features used in past literature were: first bidding, last bidding, bid increment, outbid time, bid frequency, affinity to the sellers, and winning ratio.

In 2017 Kaghazgaran et al. [25] analyzed fake-review properties. They found that fake reviewers give longer reviews and they tend to write their reviews in bursts.

In 2018, Ganguly et al. [21] proposed an SVM-based method for shill bidder detection. They evaluated their method on a dataset that contained information on 149 auctions and 1024 bidders who bid on PDAs on eBay. In order to label the dataset, they used hierarchical clustering and manually labeled clusters that looked suspicious. Their classifier achieved an AUC of 0.86 using 10-fold cross validation.

In this study, we focus on developing generic classifiers that can identify shill bidders in various e-commerce platforms. To cope with the challenge of identifying shill bidders in e-commerce platforms, we follow the standard methodology of using supervised learning algorithms to predict the likelihood of a user being a shill bidder. User features employed in this study to identify shill bidders are common to many e-commerce platforms.

In this study, we utilize the provided shill bidders list to empirically analyze the characteristics of shill bidders and study the shill bidder ecosystem, i.e., the interactions of shill bidders with each other.

To analyze the shill bidders’ characteristics using the e-commerce dataset, we calculated the average and median values for all the numeric features we defined in Section 3.1 for the users in the provided shill bidders list. Additionally, to better understand which features assist the supervised learning algorithms to distinguish between shill bidders and benign, we used the balanced training set (see Section 4.2) to calculate the features importance using Weka's Information Gain features’ selection algorithm. The results of the shill bidders’ characteristics analysis are presented in Tables 3 and 4.

From the shill bidders characteristics analysis results presented in Table 4, it can be observed that shill bidders behaved differently from the random seller-users in the following manner: First, on average, shill bidders are active for more days and perform far more selling and buying transactions than random sellers. These results may indicate that shill bidder users are, in general, active users, which perform many buying and selling transactions. Second, on average, shill bidders sell more products to unique buyers and buy more products from unique sellers than random seller-users. However, the shill bidders’ buying and selling minimum price was, on average much less than the buying and selling minimum price of random-seller users. We believe that these results are due to the shill bidders’ attempts to maximize their profits and minimize their losses when buying or selling feedback. Third, on average, shill bidders received more negative feedback than random seller-users. We assume that these results indicate that in the end, many shill bidders utilize their obtained positive feedback to mislead other users in the platform, which in return gives the shill bidders negative feedback. Lastly, on average, shill bidders gave more negative feedback than random seller-users. We believe that this result may indicate that shill bidders are also being utilized to perform sybil attacks [28]. We hope to prove these assumptions in a future study. Additionally, we discovered that the shill bidders had 798 unique State feature values, while the randomly selected seller-users had 1,435 unique State feature values. Furthermore, the most common State feature value among the shill bidders was the “default” value which appeared in the details of 134,979 shill bidders, while the “default” state value appeared only in the details of 46,805 randomly selected seller-users.

From the features’ Information Gain scores results, which are presented in Table 3, it can be observed that the Min-Sell-Price, Sell-Trans-Num, and Total-Sell-Quantity features received the highest Information Gain scores. We believe that these features received the highest scores due to the shill bidders behavioral patterns. In many cases, shill bidders attempted to decrease their losses by selling cheap products using many transactions to collect a great deal of positive feedback and spend as little money as possible.

To study the shill bidder ecosystem, we analyzed the feedback graph created by the shill bidders. The shill bidder feedback graph can assist us in understanding the “big picture” beyond the shill bidders and their interactions and even assist us in understanding the shill bidders’ working methods. We defined the feedback graph as following: Given a list $\hat{V} \subseteq V$ of e-commerce users, we can define $\hat{V}$’s feedback graph to be a weighted directed graph, where each directed weighted link is defined to be the amount of feedback user $u \in \hat{V}$ gave user $v \in \hat{V}$. Formally, the feedback graph is defined to be $ H_{\hat{V}} := < \hat{V},E_{\hat{V}}> $, where each link $e_{\hat{V}} \in E_{\hat{V}}$ in the graph defined as

Additionally, we used the igraph implementation of the Bron-Kerbosch algorithm [14] to find the maximal cliques in the graph⁸ and calculate their distribution. By identifying cliques, we can identify a group of shill bidders who worked together. Lastly, we used a random sample to select a list with an equal number of seller-users, and we compared the properties of the feedback graph created by the randomly sampled seller-users of those the feedback graph created by the shill bidders.

From the ecosystem analysis results, it can be observed that the shill bidder feedback graph is a relatively dense graph that spawns 1,805,199 directed links between 156,769 shill bidders, with an average of 1.31 feedback occurrences per link (see Table 5). Additionally, 79.09% of the shill bidders are located in a single component. Furthermore, according to the maximal clique detection results, it can be noticed that in contrast to the random user feedback graph, the shill bidder feedback graph consists of many cliques (see Table 6). These results may indicate that many shill bidders work together and assist each other to receive positive feedback. Another alternative explanation is that shill bidders open several accounts and use them to boost their reputation or sell feedback to other users.

According to the presented method, various user features are first extracted from user transactions (buying and selling) and feedback activities (giving and receiving). Second, supervised learning algorithms are utilized for training a model for classifying users into shill bidders and legitimate accounts. We evaluated the algorithms using a real large-scale anonymized e-commerce dataset. This dataset includes over several billion buying and selling occurrences performed by several hundred million users, as well as several billions of feedback occurrences they gave or received through the end of 2012. The dataset also includes a list of 187,224 users, which were marked as shill bidders in e-commerce platform systems and were used as ground truth for training and testing our algorithms. Evaluation results of the presented method showed the area under the ROC curve (AUC) of up to 0.912 and precision at 1,000 of 0.999 when the ratio between the shill bidders and the benign users was 1 to 10 (see Section 4.3).

By analyzing the e-commerce dataset, we also empirically studied the characteristics of shill bidders and the shill bidder ecosystem. As a result of this analysis, we discovered that, on average, shill bidders were more active, performed more selling and buying of transactions, and gave and received more feedback compared to randomly selected seller-users (see Table 4). Moreover, we also discovered that shill bidders gave more negative feedback compared to randomly selected seller-users. These results may indicate that shill bidders can also be used to perform sybil attacks [28]. These sybil attacks can be against targeted platform users, such as shill bidders competitors, and aim to damage the targeted users’ reputations by giving them unjust negative feedback. Additionally, we discovered that the shill bidder feedback graph, which was constructed from all the feedback links between each two shill bidders (see Section 5), is a relatively dense graph with 1,805,199 links among 156,769 shill bidders (see Table 5). Furthermore, in the shill bidders feedback graph we identified 66,892 cliques with at least 3 shill bidders, and 23 cliques with at least 7 shill bidders (see Table 6). These results indicate that many shill users collaborate to increase their overall reputations. Moreover, these results may indicate the existence of e-commerce bots that perform automatic buying and selling transactions. These bots also submit feedback to each other and other users.

We believe that these observations regarding the shill bidder ecosystem can assist in improving the detection of shill bidders in the following manner. First, we can utilize the shill bidder graph structure results and improve our shill bidder identification classifiers by extracting additional graph structure-based features, such as the number of cliques a user is a member of and the number of shill bidders the user is connected to. Second, we can use the fact that many shill bidders are connected to each other (see Table 5) and set our shill bidder identification classifier to identify shill bidders among users who are connected to several shill bidders, instead of applying the classifier on random sets of users chosen out of several hundred million e-commerce platform users. We believe that this technique of focusing the shill bidder identification classifier on these connected users can identify shill bidders with even higher precision. Lastly, we can utilize the results that indicate the shill bidders tend to formulate relatively large cliques (see Table 6) and use various clique identification algorithms to identify large cliques in the feedback graph created from all the e-commerce users’ feedback interactions. We believe that large cliques in this feedback graph have a high likelihood of containing shill bidders. We hope to verify these three assumptions in our future research.

The study presented here offers many additional future research directions to pursue. One possible research direction is to use Natural Language Processing algorithms to analyze the users’ content data, such as the feedback comments and the products information page. An additional possible research direction is to utilize various clustering algorithms to identify shill bidders. Another possible research direction is to construct classifiers, which utilize similar features to those presented in Section 3.1, to identify other types of malicious users, such as fraudsters who sell fictional products.