  Frauds severely hurt many kinds of Internet businesses. Group-based fraud
detection is a popular methodology to catch fraudsters who unavoidably exhibit
synchronized behaviors. We combine both graph-based features (e.g. cluster
density) and information-theoretical features (e.g. probability for the
similarity) of fraud groups into two intuitive metrics. Based on these metrics,
we build an extensible fraud detection framework, BadLink, to support
multimodal datasets with different data types and distributions in a scalable
way. Experiments on real production workload, as well as extensive comparison
with existing solutions demonstrate the state-of-the-art performance of
BadLink, even with sophisticated camouflage traffic.
