Researchers Developing Anti-Fraud Tool

PITTSBURGH -- Carnegie Mellon University researchers are relying on an old adage to develop anti-fraud software for Internet auction sites: It's not what you know, it's who you know.

At sites like eBay, users warn each other if they have a bad experience with a seller by rating their transactions. But the CMU researchers said savvy fraudsters get around that by conducting transactions with friends or even themselves, using alternate user names to give themselves high satisfaction ratings _ so unsuspecting customers will still try to buy from them.

Computer science Professor Christos Faloutsos, bottom, points out graphs from anti-fraud software developed for Internet auction sites like eBay with two members of his team, Duen Horng "Polo" Chau, left, and Shashank Pandit, at Carnegie Mellon University in Pittsburgh, Friday, Dec. 8, 2006. (AP Photo/Keith Srakocic) (Keith Srakocic - AP) QUIZ How much digital information did the world generate last year? A. 90 billion megabytes B. 200 million gigabytes C. 3,000 terabytes D. 161 exabytes • Test Your Knowledge -- More Questions Partnership Resources for anyone who runs a small business or wants to start one. • Starting a Business • Small Business on the Net • Home-Based Businesses » FULL COVERAGE Save & Share Article What's This? Digg Google del.icio.us Yahoo! Reddit Facebook

The CMU software looks for patterns of users who have repeated dealings with one another, and alerts other users that there is a higher probability of having a fraudulent transaction with them.

"There's a lot of commonsense solutions out there, like being more careful about how you screen the sellers," said Duen Horng "Polo" Chau, the research associate who developed the software with computer science professor Christos Faloutsos and two other students. "But because I'm an engineering student, I wanted to come up with a systematic approach" to identify those likely to commit fraud.

The researchers analyzed about 1 million transactions involving 66,000 eBay users to develop graphs _ known in statistical circles as bipartite cores _ that identify users interacting with unusual frequency. They plan to publish a paper on their findings early next year and, perhaps, market their software to eBay or otherwise make it available to people who shop online.

Catherine England, an eBay spokeswoman, said the company was not aware of the research and would not comment on it. But England said protecting the company's more than 200 million users from fraud was a top priority.

Online auction fraud _ when a seller doesn't deliver goods or sells a defective product _ accounted for 12 percent of the 431,000 computer fraud complaints received last year by Consumer Sentinel, the Federal Trade Commission's consumer fraud and identity theft database. Auction fraud was the most commonly reported computer-related fraud in the database.

And the scams run the gamut.

Last year, a federal grand jury indicted an Ohio man on charges he sold hundreds of thousands of dollars of stolen Lego merchandise on the Internet. Earlier this year, a New Mexico woman was sentenced to nine years in federal prison for selling forged hunting licenses on eBay, over the phone and by e-mail, and then not delivering trips paid for by out-of-state hunters.

Earlier this month, a man who failed to deliver tickets to the 2005 Ohio State-Michigan football game to 250 online auction customers was sentenced to 34 months in federal prison.

Johannes Ullrich, an Internet fraud expert with the SANS Institute in Bethesda, Md., said the CMU research "sounds like a credible way to detect fraud."

"Essentially, what they're trying to do is find these extended circles of friends who make positive recommendations to each other," said Ullrich, the chief technology officer of SANS' Internet Storm Center, which tracks viruses and other Internet problems.

But Ullrich said the CMU researchers must find a way to screen out false positives. He said a small group of users _ such as baseball card collectors _ might repeatedly buy from one another and could be flagged as high-risk.

Faloutsos said the researchers have thought of that in developing the software called NetProbe _ short for Network Detection via Propagation of Beliefs.

"We're not just looking at your neighbors (on the auction site)," Faloutsos said. "We're looking at the neighbors of your neighbors, and the neighbors of your neighbors' neighbors."