  In this work, we aim at building a bridge from poor behavioral data to an
effective, quick-response, and robust behavior model for online identity theft
detection. We concentrate on this issue in online social networks (OSNs) where
users usually have composite behavioral records, consisting of
multi-dimensional low-quality data, e.g., offline check-ins and online user
generated content (UGC). As an insightful result, we find that there is a
complementary effect among different dimensions of records for modeling users'
behavioral patterns. To deeply exploit such a complementary effect, we propose
a joint model to capture both online and offline features of a user's composite
behavior. We evaluate the proposed joint model by comparing with some typical
models on two real-world datasets: Foursquare and Yelp. In the widely-used
setting of theft simulation (simulating thefts via behavioral replacement), the
experimental results show that our model outperforms the existing ones, with
the AUC values $0.956$ in Foursquare and $0.947$ in Yelp, respectively.
Particularly, the recall (True Positive Rate) can reach up to $65.3\%$ in
Foursquare and $72.2\%$ in Yelp with the corresponding disturbance rate (False
Positive Rate) below $1\%$. It is worth mentioning that these performances can
be achieved by examining only one composite behavior (visiting a place and
posting a tip online simultaneously) per authentication, which guarantees the
low response latency of our method. This study would give the cybersecurity
community new insights into whether and how a real-time online identity
authentication can be improved via modeling users' composite behavioral
patterns.
