  Reviews spams are prevalent in e-commerce to manipulate product ranking and
customers decisions maliciously. While spams generated based on simple spamming
strategy can be detected effectively, hardened spammers can evade regular
detectors via more advanced spamming strategies. Previous work gave more
attention to evasion against text and graph-based detectors, but evasions
against behavior-based detectors are largely ignored, leading to
vulnerabilities in spam detection systems. Since real evasion data are scarce,
we first propose EMERAL (Evasion via Maximum Entropy and Rating sAmpLing) to
generate evasive spams to certain existing detectors. EMERAL can simulate
spammers with different goals and levels of knowledge about the detectors,
targeting at different stages of the life cycle of target products. We show
that in the evasion-defense dynamic, only a few evasion types are meaningful to
the spammers, and any spammer will not be able to evade too many detection
signals at the same time. We reveal that some evasions are quite insidious and
can fail all detection signals. We then propose DETER (Defense via Evasion
generaTion using EmeRal), based on model re-training on diverse evasive samples
generated by EMERAL. Experiments confirm that DETER is more accurate in
detecting both suspicious time window and individual spamming reviews. In terms
of security, DETER is versatile enough to be vaccinated against diverse and
unexpected evasions, is agnostic about evasion strategy and can be released
without privacy concern.
