Malika Ben Khalifa
email: malikabenkhalifa2@gmail.com

Zied Elouedi
email: zied.elouedi@gmx.fr

Eric Lefèvre
email: eric.lefevre@univ-artois.fr

Evidential Spammers and Group Spammers Detection

Keywords: Fake reviews, Spammers, Group spammers, Uncertainty, Belief Function Theory, EK-NN, E-commerce

The online success of the brands, products or services depends upon the online reviews written by the consumers to share their experiences. These reviews deeply affect the buying decision of the new customers. For the purpose of performing their e-reputation, some companies rely on spammers to involve fraud reviews with the aim of gaining more profit. They can work individually or collaborate together to post various fake reviews trying to promote or demote target companies or product. These spammers and the group of spammers mislead the readers which make the e-commerce unsafe domain. To deal with this issue, we propose a new method having the objective to detect the spammers while taking into account both the group spammers and the individual spammers indicators. Our proposed method relies on the K-nearest neighbors algorithm under the belief function theory in order to handle the uncertainty in both the spammers and the group spammers indicators. Experiments are conducted on two labeled real datasets extracted from Yelp.com where our method achieves significant results.

Introduction

In recent years, e-commerce has become one of the most important sources that manipulate the economy of the world. Furthermore, with the COVID-19 epidemic and with the successive confinements, the online purchase has become the only solution to buy the different products due to the closure of the stores. Since the products and services are represented only by a description and photos, the customers rely mainly on both the rating score and the reviews representing the opinion of the consumers regarding the products or services. Thus, brands and companies aim to improve the quality of the reviews by posting positive fake reviews and also negative ones to destruct their competitors. Therefore, they rely on the spammers to practise these misleading activities. These spammers are considered as the most harmful generator source of fake reviews. Hence, detecting spammers becomes pivotal to save e-commerce and to ensure fair competition between brands and companies [START_REF] Elmogy | Fake Reviews Detection using Supervised Machine Learning[END_REF]. This challenging problem attracts significant researchers who have proposed different methods to spot fake reviews. These contributions can be grouped in three categories [START_REF] Heydari | Leveraging quality metrics in voting model based thread retrieval[END_REF]: review spam detection based on the reviews contents and linguistic features, spammer detection and group spammer detection. The spammer detection methods can be classified in two global categories: methods based on graph and others based on behavioral indicators. The main graph based methods were proposed in [START_REF] Fayazbakhsh | Review spam detection: A network-based approach[END_REF][START_REF] Wang | Review graph based online store review spammer detection[END_REF]. These methods do not achieve a very good performance. Moreover, another approach introduced in [START_REF] Savage | Detection of opinion spam based on anomalous rating deviation[END_REF] relies also on the rating behavior of each reviewer. One of the most preferment studies was proposed in [START_REF] Fei | Exploiting burstiness in reviews for review spammer detection[END_REF] to detect the burst pattern in reviews given to some specific products or services. This approach generates five new spammer behavior indicators to ameliorate the review spammer detection. This method achieves 83.7% of precision thanks to the spammers behaviors indicators. Since then, behavioral indicators have become an important basis for spammer detection task. In this way, Rayana and Akoglu [START_REF] Rayana | Collective opinion spam detection: Bridging review networks and metadata[END_REF] proposed a novel framework called SpEagle that relies on conjointly relational data and the spammers indicators to identify deceptive reviewers and reviews, as well as the spam target products. The SpEagle framework significantly outperforms various baselines and state-of-the-art approaches. Moreover, Fontanarava et al. [START_REF] Fontanarava | Feature Analysis for Fake Review Detection through Supervised Classification[END_REF] proposed and evaluated some new features. Furthermore, spammers work individually or more they can also collaborate together to create the group spammers in order to magnify the effect of review manipulation. The group spammers can even be more dangerous than the individual spammer thanks to their potential to deviate the overall rating and representing the majority of the reviews in a short time. Thus, recently there were increasingly research interests in group spamming detection aspects. The first study, in this aspect, was proposed by Mukherjee et al. [START_REF] Mukherjee | Detecting Group Review Spam[END_REF]. This method relies on the Frequent Itemset Mining (FIM) technique in order to generate review spammers groups. It models the reviewers as items and the products as transactions. By applying the FIM and initializing the minimum support count to 3, they can spot at least 2 reviewers, while each reviewer reviews at least 3 common products. The majority of the group spammer methods [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF][START_REF] Wang | Detecting review spammer groups via bipartite graph projection[END_REF] relies on the FIM technique and proposes different frameworks to evaluate the spamming of each candidate spammer groups. Some other recent works, in this aspect, do not rely on the FIM techniques such in [START_REF] Wang | GSLDA: LDA-based group spamming detection in product reviews[END_REF] but on the structure of the reviewer graph. This work also achieves significant results. The fake reviews detection problem can be considered as one of the uncertain challenging issues due to the ambiguity provided by the spammers and the group spammers to mislead the detection systems. Nevertheless, the previous proposed methods did not take into consideration the uncertain aspect while trying to detect the spammers or the group spammers. The negligence of this uncertainty can severely affect the detection quality. That's why, we have proposed different methods that deal with uncertainty while distinguishing between fake and genuine reviews [START_REF] Ben Khalifa | Fake reviews detection based on both the review and the reviewer features under belief function theory[END_REF][START_REF] Ben Khalifa | Spammers detection based on reviewers' behaviors under belief function theory[END_REF]. Among these methods, we have proposed a method to detect spammers, in which we use the Evidential K-Nearest Neighbors classifier (EK-NN) while taking into account the spammers' indicators [START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF]. Another one to detect group spammers basing on the group spammers' indicators and the EK-NN as well [START_REF] Ben Khalifa | Evidential Group Spammers Detection[END_REF]. These methods achieve good results. Since, we think that the reviewer can be classified as not spammer through the spammers' indicators for lack of historical information. In this case, the spammer behavior cannot be significant. However, this reviewer can belong to a suspicious group thus he can be spotted through the group spammers' indicators. Aims at this, a reviewer can be classified as not spammer since he does not belong to any group of spammers but he can be detected as spammer thanks to the spammers' indicators. Thus and with the aim of improving detection, we propose a novel approach to spot fake reviewers which takes into account both the spammers and the group spammers' indicators while managing the uncertainty. To the best of our knowledge, this method will be the first which combines both the spammers and the group spammers aspects to perform the detection. This paper is organised as follows. We present the fundamentals of the belief function framework in section 2. In section 3, we detail our proposed approach and we consecrate section 4 from the experimental study, then we end up with a conclusion and some future work.

Belief function theory

In section, we present the fundamentals of the belief function theory used in our method.

Basic concepts

The belief function theory, one of the powerful theories handling uncertainty, was introduced by Shafer [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] as a model to manage beliefs. In this theory, a given problem is represented by a finite and exhaustive set of different events called the frame of discernment Ω. 2 Ω is the power set of Ω that includes all possible hypotheses and it is defined by: 2 Ω = {A|A ⊆ Ω}. A basic belief assignment (bba) named also a belief mass represents the degree of belief given to an element A. It is defined as a function m Ω from 2 Ω to [0, 1] such that:

A⊆Ω m Ω (A) = 1. (1)
A focal element A is a set of events having a strictly positive mass value m Ω (A) > 0.

Dempster s rule of combination

Let m Ω 1 and m Ω 2 two bba's modeling two distinct sources of information defined on the same frame of discernment Ω. The Dempster combination rule is introduced in [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF], denoted by ⊕ and defined as:

m Ω 1 ⊕ m Ω 2 (C) = A∩B=C m Ω 1 (A)m Ω 2 (B) 1-A∩B=∅ m Ω 1 (A)m Ω 2 (B) if C = ∅, ∀C ⊆ Ω, 0 otherwise.
(2)

Vacuous extension

Frequently, we need to aggregate two bba s m Ω1 1 and m Ω2 2 that have different frames of discernment. Thus, we rely on the vacuous extension which extends the frames of discernment Ω 1 and Ω 2 , corresponding to the mass functions m Ω1 1 and m Ω2 2 , to the product space Ω = Ω 1 × Ω 2 . The vacuous extension operation denoted by ↑ and defined such that:

m Ω1↑Ω1×Ω2 (B) = m Ω1 (A) if B = A × Ω 2 (3)
where

A ⊆ Ω 1 , B ⊆ Ω 1 ×Ω 2 . It transforms each mass to the cylindrical extension B to Ω 1 × Ω 2 .

Decision process

The belief function framework proposes various solutions to make decision. Within the Transferable Belief Model (TBM) [START_REF] Smets | The transferable belief model for quantified belief representation[END_REF], the decision process is performed at the pignistic level where bba s are transformed into the pignistic probabilities denoted by BetP and defined as:

BetP (B) = A⊆Ω |A ∩ B| |A| m Ω (A) (1 -m Ω (∅)) ∀ B ∈ Ω (4)
3 Evidential Spammers and Group Spammers Detection (ESGSD) Method

In the following section, we elucidate a novel proposed hybrid method named Evidential Spammers and Group Spammers Detection (ESGSD) which aims to classify reviewers into spammer or genuine ones while taking into account both the group spammer and single spammer detection aspects. Our proposal is composed from three parts. In the first one, we rely on the spammers' indicators extracted from each reviewer historic and used as features in the Evidential K-Nearest Neighbors classifier (EK-NN) [START_REF] Denoeux | A K-nearest neighbor classification rule based on Dempster-Shafer theory[END_REF] to model the reviewer spamicity according the single spammer indicators, which is inspired from our contribution in [START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF]. In the second part, we propose to model the reviewer spamicity while taking into account the group spammers' indicators which are modeled basing on the candidate groups and used as features in the EK-NN classifier which takes into account the pairwise group to define the distance choosing the K-nearest neighbors [START_REF] Ben Khalifa | Evidential Group Spammers Detection[END_REF]. Once the reviewer spamicity basing on the spammer indicators and that based on the group spammers indicators are represented into two mass functions. Then, we combine them, in the third part, in order to make more suitable decision basing on the two aspects.

We detail these three parts in depth. In the following section, the reviewer is denoted by R i where i = 1, . . . , n is the id of the corresponding one.

Modeling the reviewer spamicity using the spammer detection indicators

In this part, we propose to model the reviewer spamicity through a bba when relying on the spammer's indicators extracted from each reviewer behavior based on its historical data. Then, we handle the problem as binary classification one in order to model each reviewer spamicity under the frame of discernment Ω S = {S, S} where S represents the class of the reviewer considered as spammer and S is the class of the innocent reviewers.

3.1.1

Step 1: Pre-processing phase As well known in the fake reviews fields, the attitudes and the behaviors of the reviewer are considered as the most important points in the detection process. These behaviors may be extracted from the historic data of each reviewer. In ESGSD, we propose to use the spammers' indicators as features to train our algorithm. Thus, we rely on nine significant ones used in our method in [START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF]. Four features have the values into an interval of [0,1], where those closed to the 1 indicate the high spamicity degree. These features are Content Similarity (CS), Maximum Number of Reviews (MNR), Reviewing Burstiness (BST) and Ratio of First Reviews (RFR). Moreover, we rely on also on five other binary features where the 1 value indicates the spamming and the 0 value presents the non spamming behavior. These are named: Duplicate/Near Duplicate Reviews (DUP), Extreme Rating (EXT), Rating Deviation (RD), Early Time Frame (ETF) and Rating Abuse (RA). All the definitions and the calculation details are presented in our previous work [START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF].

3.1.2

Step 2: EK-NN application After extracting the spammers indicators, we propose to use them as features to train the EK-NN [START_REF] Denoeux | A K-nearest neighbor classification rule based on Dempster-Shafer theory[END_REF] in order to model the reviewer spamicity while taking into account the uncertain aspect. We apply the EK-NN classifier in which we initialize the parameters, we measure the distance between each reviewer R and the target one R i using d(R, R i ) and select K most similar neighbors to each target reviewer. After that, we generate bbas for each reviewer and we combine them through the Dempster combination rule. Thus, the obtained bba represents the reviewer spamicity while taking into account the uncertain aspect and the spammers' indicators. It is obtained as follows:

m Ω S R = m Ω S R,R1 ⊕ m Ω S R,R2 ⊕ .... ⊕ m Ω S R,R K .
3.2 Modeling the reviewer spamicity using group spammer detection indicators

3.2.1

Step 1: Pre-processing phase Group Spammers usually attack the brands together where posting multiple reviews in order to promote or demote any target products. Thus, in order to build candidate spammers groups, we use frequent pattern mining which catch the spammers working together on multiple products. After that, we enumerate the group spammers indicators which can control the behaviors of the candidate spammers and to find out if these groups are behaving strangely. In order to construct sufficient groups for evaluation from the data, we use the Frequent Itemset Mining (FIM). Since, we aim to focus on the worst spamming activities in our dataset, we apply the Maximal Frequent Itemset Mining (MFIM) to discover groups with maximal size. The different group spammers' indicators used in this part are Time Window (TW), Group Deviation (GD), Group Content Similarity (GCS), Member Content Similarity (MCS), Early Time Frame (ETF), Ratio of Group Size (RGS), Group Size (GS) and Support Count (SC) [START_REF] Ben Khalifa | Evidential Group Spammers Detection[END_REF].

3.2.2

Step 2: EK-NN application After applying the FIM algorithm with fixed parameters, we find that the suspect clusters turn out to be very similar to each other in terms of members, examined products and similar evaluations. These small clusters can be favorable for detecting groups in novel ways. Thus, we apply the EK-NN based method to detect groups when relying on the similarities between such groups. We model our detection problem as a binary classification problem in order to assign each reviewer R to a class Ω GS = {M GS, M GS} where M GS represents the class of the members of the group spammer and M GS is the class of the reviewers who did not belong to the group spammer (innocent ones). The idea is that given a set of groups, the reviewers who belong to "similar" groups may be more likely to have the same class labels. Thus the class label of a reviewer R can be determined commonly by a set of K reviewers R i who belong to groups most "similar" to the groups R belongs to. After applying EK-NN classifier, the whole bba that models the evidence of the K-nearest Neighbors regarding the class of the reviewer is measured as such:

m Ω GS R = m Ω GS R,R1 ⊕ m Ω GS R,R2 ⊕ .... ⊕ m Ω GS R,R K .
It is considered as the mass function which represents the reviewer spamicity while relying on the group spammer indicators. The details are given in our previous work [START_REF] Ben Khalifa | Evidential Group Spammers Detection[END_REF].

Distinguishing between spammers and genuine reviewers

In this part, we aim to combine the two bbas that model the reviewer spamicity once when taking into account the individual spammer behaviors and the other while taking into account the group spammer's indicators and in order to construct a global bba representing the reviewer spamicity. For this, we must model the bbas under a global frame and transfer them to the decision frame to make the final decision. These steps are detailed above.

3.3.1

Modeling the reviewer spamicity basing on both the spammers and the group spammers aspects -Define Ω GSS as the global frame of discernment relative to the reviewer spamicity according the group spammers and the spammers indicators. It defines the cross product of the two different frames Ω GS and Ω S denoted by: Ω GSS = Ω GS × Ω S -Extend all the review trustworthiness and the reviewer spamicity bbas, respectively m Ω GS R and m Ω S R , to the global frame of discernment Ω GSS to get new bbas m Ω GS ↑Ω GSS R and m Ω S ↑Ω GSS R using the vacuous extension (Eq. 3).

-Combine different extended bbas using the Dempster rule of combination.

m

Ω GSS R = m Ω GS ↑Ω GSS R ⊕ m Ω S ↑Ω GSS R Finally, m Ω GSS R
represents the reviewer spamicity relying on both the group spammers and the spammers indicators.

3.3.2

The reviewer spamicity transfer The next step is to transfer the combined m Ω GSS R under the product space Ω GSS to the frame of discernment Θ D = {RS, RS}, where RS represents the class of the reviewers confirmed as spammers, and RS is the class of the genuine reviewers, in order to make the final decision by modeling the reviewer into a spammer or not. For that, a multivalued operation [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF], denoted τ is applied. The function τ : Ω GSS → 2 Θ D rounds up event pairs as follows:

-Masses of event couples with at least an element in {GS, S} and not in {GS, S} are transferred to Reviewer Spammer RS ⊆ Θ D as:

m τ ({RS}) = τ (SR)=RS m Ω GSS R (SR), SR ⊆ Ω GSS (5)
-Masses of event couples with at least an element in {GS, S} and not in {GS, S} are transferred to Reviewer not Spammer RS ⊆ Θ D as:

m τ ({RS}) = τ (SR)=RS m Ω GSS R (SR), SR ⊆ Ω GSS (6)
-Masses of event couples with no element in {GS, S} and not in {GS, S} are transferred to Θ D as:

m τ (Θ D ) = τ (SR)=Θ D m Ω GSS R (SR), SR i ⊆ Ω GSS (7)

Decision Making

Now that we transferred all bbas modeling both the whole reviewer spamicity to the decision fame of discernment Θ D in order to differentiate between the spammer and the genuine reviewers. Thus, we apply the pignistic probability BetP using (Eq. 4). We select the hypothesis with the greater value of BetP and we considered it as the final decision.

Experimentation and Results

Data description

We use two real labeled datasets collected from Yelp.com in order to evaluate our ESGSD method effectiveness. These datasets are considered as the most complete. They are labeled through the yelp filter which has been used in different related works [START_REF] Ben Khalifa | Spammers detection based on reviewers' behaviors under belief function theory[END_REF][START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF][START_REF] Fontanarava | Feature Analysis for Fake Review Detection through Supervised Classification[END_REF][START_REF] Mukherjee | What Yelp Fake Review Filter Might Be Doing[END_REF][START_REF] Rayana | Collective opinion spam detection: Bridging review networks and metadata[END_REF] as a fundamental truth in favor of its effective detection algorithm based on both experts judgment and several behavioral features. Table 1 represents the datasets content where the percentages indicate the filtered fake reviews (not recommended) also the spammers reviewers.

In order to evaluate the ESGSD method, we rely on 3 evaluation criteria mentioned in the following: Accuracy, precision and recall.

Experimental results

In our datasets extracted from Yelp.com, we find that the number of genuine reviews is much larger than the number of fraudulent reviews, which can lead to an over-fitting. For the purpose of avoiding this problem, we extract a balanced data (50% of spam reviews and 50% of trustful ones). After that, we divided the datasets into 70% of training set and 30% of testing set. In addition, we average 10 trials values using the 10 cross-validation technique to obtain the final estimation of evaluation criterion. In the first part, we extract the spammers indicators through the historical of each reviewer (in our two datasets) to create our features in order to apply the EK-NN algorithm, we choose k = 3. In the second part, we apply the frequent itemset mining FIM, where I is the set of all reviewer ids in our two datasets. Each transaction is the set of the reviewer ids who have reviewed a particular hotel or restaurant. Thus, each hotel or restaurant generates a transaction of reviewer ids. By mining frequent itemsets, we find groups of reviewers who have reviewed multiple restaurants or hotels together. Then, we rely on the Maximal Frequent Itemset Mining (MFIM) to spot groups with maximal size in order to focus on the worst spamming activities. In the YelpZip dataset, we found 74,364 candidate groups and 50,050 candidate groups for the YelpNYC dataset. Since, there is no methods which deal with both the spammer and the group spammers aspects. We propose to compare our ESGSD method with two methods from the group spammer detection field which is based on the FIM named: Detecting Group Review Spam (DGRS) proposed in [START_REF] Mukherjee | Detecting Group Review Spam[END_REF] and Ranking Group Spam algorithm (GSRank) introduced in [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF]. We compare also with two methods from the spammers detection field: SpEagle framework proposed by Rayana and Akoglu [START_REF] Rayana | Collective opinion spam detection: Bridging review networks and metadata[END_REF] and the method proposed by Fontanarava et al. [START_REF] Fontanarava | Feature Analysis for Fake Review Detection through Supervised Classification[END_REF] we denoted FAFR. We add to the comparison study our two previous methods: Evidential Group Spammers Detection (EGSD) introduced in [START_REF] Ben Khalifa | Evidential Group Spammers Detection[END_REF] and Evidential Spammer Detection (ESD) proposed in [START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF].

The evaluation results are elucidated in Table 2. We observe that our ESGSD method continuously outperforms almost all compared baselines in most of evaluation criteria. We obtain the best results in terms of accuracy, precision, and

YelpZip

YelpNYC Evaluation criteria Precision Recall Accuracy Precision Recall Accuracy SpEagle [START_REF] Rayana | Collective opinion spam detection: Bridging review networks and metadata[END_REF] 75.3% 65.2% 79% 73.5% 67.3% 76.9% FAFR [START_REF] Fontanarava | Feature Analysis for Fake Review Detection through Supervised Classification[END_REF] 77.6% 86.1% 80.6% 74.8% 85% 81.6% DGRS [START_REF] Mukherjee | Detecting Group Review Spam[END_REF] 70% 71% 65% 62% 61.3% 60% GSRank [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF] 76% 74% 78% 76.5% 77.2% 74% ESD [START_REF] Ben Khalifa | An Evidential Spammer Detection based on the Suspicious Behaviors' Indicators[END_REF] 85% 86% 84% 86% 83.6% 85% EGSD [START_REF] Ben Khalifa | Evidential Group Spammers Detection[END_REF] 83 a competitive ones in term of recall while using YelpZip dataset. For the Yelp-NYC database, we get the best results for all three considered criteria. We record at best an accuracy of 86.9% with the YelpZip dataset. We note an improvement which almost reaches 2% comparing with ESD method and 3% comparing with EGSD method. The precision criterion reaches at best 87%. The performance improvements recorded prove the importance of the use of both the group spammers and the spammers indicators while taking into account the uncertain aspects which allowed us to detect more particular cases.

Conclusion

In this paper, we tackle for the first time both the group spammer and the spammer review detection problem in order to perform the detection quality. This detection allows the different review systems to block suspicious reviewers in order to stop the emergence of fake reviews. Our ESGSD method succeeds in distinguishing between the spammers and the innocent even in the special cases. It proves its performance and effectiveness against various state-of-the-art approaches from the spammer and the group spammer fields. As future work, we aim to create a platform that deals with the all aspects of fake reviews detection problem to detect different types of spammers and deceptive reviews.

Table 1 .

 1 Datasets description

	Datasets	Reviews (filtered %)	Reviewers (Spammer %)	Services (Restaurant or hotel)
	YelpZip 608,598 (13.22%) 260,277 (23.91%)	5,044
	YelpNYC 359,052 (10.27%) 160,225 (17.79%)	923

Table 2 .

 2 Comparative results


Fares Grina
email: grina.fares2@gmail.com

Zied Elouedi
email: zied.elouedi@gmx.fr

Eric Lefevre
email: eric.lefevre@univ-artois.fr

A preprocessing approach for class-imbalanced data using SMOTE and belief function theory

Keywords: Imbalanced data, Supervised learning, belief function

Dealing with imbalanced datasets at the preprocessing level is an efficient strategy used by many methods to re-balance the data and improve classification performance. Specifically, SMOTE is a popular oversampling technique which modifies the training data by adding artificial minority samples. However, SMOTE may create instances in noisy and overlapping areas, far from safe regions. To tackle this issue, we propose SMOTE-BFT, in which we use the belief function theory to remove generated minority instances that are not in safe regions. After applying SMOTE, each generated minority instance is represented by an evidential membership structure, which provides detailed information about class memberships. Rules based on the belief function theory are then enforced to detect and remove generated instances that are in noisy and overlapping regions. Experiments on noisy artificial datasets show that our proposal significantly outperforms other popular oversampling methods.

Introduction

Learning from imbalanced data is one of the main challenges in machine learning. In a binary classification problem, the imbalanced data issue occurs when one class (the minority or positive class) is represented by a much smaller number of instances than the other class (the majority or negative class). This problem presents a crucial difficulty to many classifier learning algorithms that assume a fairly balanced distribution of the classes [START_REF] He | Learning from imbalanced data[END_REF]. The imbalanced data problem can be translated to numerous real-world classification problems [START_REF] Krawczyk | Learning from imbalanced data: open challenges and future directions[END_REF]. From an application point of view, the correct classification of minority instances has a greater importance than the reverse [START_REF] Chawla | Editorial: Special issue on learning from imbalanced data sets[END_REF]. For example, in a medical diagnosis problem, the cases affected by the disease are usually relatively rare as compared with the normal population. Assuming we have 1% of disease-affected cases, a classifier which scores correctly all negative samples (cases not affected) will get a classification accuracy of 99% even though all positive cases remain undetected.

Instead of accuracy, one may use the Area under the Curve (AUC-ROC) [START_REF] Bradley | The use of the area under the roc curve in the evaluation of machine learning algorithms[END_REF], which reflects how good a model is at distinguishing between the minority and majority class.

In coping with this issue, resampling methods have been proposed to rebalance the data-set by adding new samples to the minority class (Oversampling), removing samples from the majority class (Undersampling), or both (Hybrid) [START_REF] Haixiang | Learning from class-imbalanced data: Review of methods and applications[END_REF]. Traditional replication strategies (e.g. random oversampling) [START_REF] Haixiang | Learning from class-imbalanced data: Review of methods and applications[END_REF] can cause overfitting by simply adding replicated samples to the dataset. To avoid this issue, Chawla et al. [START_REF] Bowyer | SMOTE: synthetic minority over-sampling technique[END_REF] suggested the Synthetic Minority Oversampling Technique (SMOTE), which adds new synthetic minority instances by interpolating among several minority examples that are close to each other. However, SMOTE produces synthetic samples without being aware of its surroundings which may potentially amplify the noise and overlap present in the data as illustrated in Figure 1, whereas, studies have shown that generated instances in safe positions improve classifier's performance [START_REF] Bunkhumpornpat | Safe-level-smote: Safelevel-synthetic minority over-sampling technique for handling the class imbalanced problem[END_REF].

Several extensions have been proposed to deal with those problems. To name a few, BorderlineSMOTE [START_REF] Han | Borderline-SMOTE: A new over-sampling method in imbalanced data sets learning[END_REF] was introduced to strengthen the decision boundaries of classifiers, by replacing SMOTE's random selection of minority samples with a directed selection of examples that are close to the class border. ADASYN [START_REF] He | Adasyn: Adaptive synthetic sampling approach for imbalanced learning[END_REF], another oversampling method which decides the number of examples to generate based on density distribution. Other hybrid methods like SMOTE-RSB* [START_REF] Ramentol | SMOTE-RSB *: A hybrid preprocessing approach based on oversampling and undersampling for high imbalanced data-sets using SMOTE and rough sets theory[END_REF] (based on rough set theory) and SMOTE-IPF [START_REF] Sáez | SMOTE-IPF: Addressing the noisy and borderline examples problem in imbalanced classification by a resampling method with filtering[END_REF] (based on iterative partitioning filter) uses SMOTE and undersampling to clean generated minority examples and noise already present in the dataset.

In our work, we present another improvement of SMOTE based on the belief function theory. After applying SMOTE, a cleaning procedure is executed to improve SMOTE's oversampling, that is, we use the belief function theory as a way to extract information on the surroundings of each synthetic minority instance, by assigning a soft label regarding class memberships. Three rules based on belief function theory are then imposed to identify and eliminate synthetic minority instances which are not in safe regions. It is important to note that our proposal is a purely oversampling method, meaning that only generated minority instances can be removed.

The remaining of the paper is structured as follows. In Section 2, we introduce the belief function theory. Section 3 presents our proposal in details. In section 4, we define the experimental framework and we analyze the results.

Belief Function theory

Belief function theory [START_REF] Dempster | A generalization of bayesian inference[END_REF][START_REF] Shafer | A mathematical theory of evidence[END_REF][START_REF] Smets | The transferable belief model for quantified belief representation[END_REF], also known as evidence theory or the Dempster-Shafer theory is a well-founded and efficient framework for the representation and combination of a range of uncertain information. Let Ω = {w 1 , w 2 , ..., w M } be a frame of discernment representing a finite set of M events. A basic belief assignment (BBA) represents the belief committed to the elements of 2 Ω by a given source of evidence is a mapping function m : 2 Ω → [0, 1] such that:

A∈2 Ω m(A) = 1 (1)
Belief and plausibility functions are defined by Shafer [START_REF] Shafer | A mathematical theory of evidence[END_REF] as follows:

Bel(A) = B⊆A m(B) and P l(A) = B∩A =∅ m(B), ∀ A ∈ 2 Ω (2)
Bel(A) represents the precise support for A and its subsets, whereas P l(A) represents the total possible support for A and its subsets. The interval [Bel(A), P l(A)] reflects the lower and upper bounds of support to A.

To combine several BBAs, Dempster 's rule [START_REF] Dempster | A generalization of bayesian inference[END_REF] is a popular choice. Let m 1 and m 2 two BBAs defined on the same frame of discernment Ω, their combination based on Dempster 's rule gives the following BBA:

m 1 ⊕ m 2 (A) =    B∩C=A m1(B)m2(C) 1- B∩C=∅ m1(B)m2(C) f or A = ∅ and A ∈ 2 Ω . 0 f or A = ∅. (3)

Combining SMOTE and belief function theory

We focus our method on binary classification. For multi-class cases, we can apply it by decomposing the multi-class problem into two-class sub-problems [START_REF] Chen | Efficient classification of multi-label and imbalanced data using min-max modular classifiers[END_REF]. SMOTE-BFT consists of 3 main steps: First, we apply SMOTE to generate synthetic minority examples. Second, we compute for each generated instance an evidential soft label (BBA) using its nearest neighbors. Finally, 3 rules based on plausibility and belief functions are enforced in order to identify synthetic minority instances that are generated in noisy regions, overlapping regions, or majority class regions. This elimination procedure is repeated until a user-set minimum balance ratio Br min is reached. Each step will be detailed in the remaining of this section.

3.1

Step 1: Applying SMOTE Synthetic minority instances are firstly created by randomly selecting minority sample -→ a . Second, it searches for its k nearest minority neighbors -→ b . Finally, the algorithm chooses one of the neighbors and creates a synthetic point -→ s anywhere on the line joining the selected sample and its chosen neighbor:

- → s = - → a + w * ( - → b -- → a ) , w ∈ [0, 1] (4)
For this paper, we use the original version of SMOTE [START_REF] Bowyer | SMOTE: synthetic minority over-sampling technique[END_REF] to simplify the comparisons. However, one can use any other variant of SMOTE, since our proposal has a modular structure.

Step 2: Creating BBAs

To assign BBA's, we use the same evidential modeling defined by Denoeux in the Evidential KNN [START_REF] Denoeux | A k-nearest neighbor classification rule based on dempster-shafer theory[END_REF]. Let x i be a synthetic minority instance obtained at

Step 1. Each of its k neighbors (k is defined by the user) represents a piece of evidence to the evidential membership of the instance. For each neighbor x j , a mass function m j i is calculated regarding the class membership of x i as:

   m j i ({w q } |x j ) = αφ q (d ij ) m j i (Ω|x j ) = 1 -αφ q (d ij ) m j i (A|x j ) = 0 ∀A ∈ 2 Ω \ {{w q } , Ω} (5)
where d ij denotes the euclidean distance between x i and x j , w q is the class label of x j , and α is a parameter such that 0 < α < 1. A recommended value of α = 0.95 can be used to obtain good results on average, and a good choice for φ q is φ q (d) = exp(-γ q d 2 ) where γ q can be set to the inverse of the mean squared distance between training samples belonging to class w q heuristically. The BBAs for each neighbor x j are then combined using the Dempster's rule defined in eq [START_REF] Bunkhumpornpat | Safe-level-smote: Safelevel-synthetic minority over-sampling technique for handling the class imbalanced problem[END_REF]. As a result, each synthetic minority example x i has three masses namely: m i ({ω 1 }) degree of membership for the majority class, m i ({ω 2 }) for the minority class and m i (Ω) regarding both classes. Using these masses, it is now possible to compute plausibility and belief functions defined in eq (2).

Step 3: Eliminating synthetic examples

In order to perform the cleaning, we use overlap and noise rules that were introduced in [START_REF] Denoeux | A k-nearest neighbor classification rule based on dempster-shafer theory[END_REF] in addition to a misclassification rule. Each rule targets a specific type of synthetic points that are problematic to the classification task.

Overlap threshold rule: This situation typically arises when the synthetic minority sample is situated in a region where there is strong overlap between classes. In the belief function framework, this case is characterized by a BBA that is uniformly distributed between the two classes. As a result, the maximum plausibility P l max = max ω∈Ω P l i ({ω}) will have a relatively low value. Thus, imposing a threshold to the maximum plausibility will reject synthetic instances in strong overlap regions. The sample will be rejected if:

P l max < β P l , β P l ∈ [0, 1] (6)
where β P l a threshold that is set by the user. The higher this parameter is, the more synthetic instances are removed.

Noise threshold rule: This situation represents synthetic points which are suspected of belonging to a class which is not represented in the training set. In the belief function framework, most of the mass values will be concentrated on the whole frame of discernment Ω. As a consequence, the maximum credibility Bel max = max ω∈Ω Bel i ({ω}) will take on a small value. As the distance between the synthetic point and its closest neighbors goes to infinity, Bel max goes to zero. Thus, the generated sample will be rejected if:

Bel max < β Bel , β Bel ∈ [0, 1] (7)
where β Bel a threshold which is reasonably fixed to the minimum value of Bel max across original minority samples.

Misclassifcation rule: This situation represents synthetic samples which are more likely to be misclassified after oversampling, meaning that they are located in the majority class region. Using BBAs, one way to make a decision about what class a sample belongs to is the maximum plausibility. In our situation, we want generated examples to be belonging to the minority class. Let w 1 be the majority class and w 2 be the minority one. The synthetic minority x i example will be rejected if:

P l i ({ω 1 }) > P l i ({ω 2 }) (8)
The cleaning phase is iterated over synthetic examples until the data reach a minimum balance ratio Br min set by the user.

Experimental study

In this section, we discuss the evaluation of our proposal in details. Section 4.1 presents the experimental setup. Section 4.2 shows the results and analysis.

Experimental setup

To evaluate our contribution, we use synthetic imbalanced datasets with noisy and borderline examples selected from the KEEL repository [START_REF] Napiera La | Learning from imbalanced data in presence of noisy and borderline examples[END_REF]. All datasets are binary classification problems with combinations of two imbalance ratios (IR), 5 levels of disturbance ratios DR (reflects the amout of overlap) and three types of non-linear shapes of minority examples: Clover, which shapes a flower with five elliptic petals, paw, which shapes three elliptic subareas of minority examples, and subclus, which has 3 rectangles of minority instances.

Results are averaged through a ten-fold stratified cross validation to avoid inconsistencies. To compare different oversamplers, we use CART for classification and the AUC-ROC as an evaluation measure. Statistical comparisons are also performed using the Wilcoxon's signed ranks test [START_REF] Demšar | Statistical comparisons of classifiers over multiple data sets[END_REF] to compare the results.

We compare our proposal, SMOTE-BFT, with popular oversampling techniques: the original SMOTE [START_REF] Bowyer | SMOTE: synthetic minority over-sampling technique[END_REF], Borderline-SMOTE [START_REF] Han | Borderline-SMOTE: A new over-sampling method in imbalanced data sets learning[END_REF] and ADASYN [START_REF] He | Adasyn: Adaptive synthetic sampling approach for imbalanced learning[END_REF]. In addition to the evaluation against no oversampling performed. For the experiments, we consider the following parameters for SMOTE-BFT: number of nearest neighbors for SMOTE and the creation of BBAs fixed to 5, minimum plausibility threshold β P l is set to 0.7, and minimum imbalance ratio Br min is fixed to 0.8.

Results analysis

Table 1 presents AUC obtained by CART on each dataset after oversampling. The best scores are marked in bold. We can observe that oversampling techniques improve the performance of the CART classifier in almost all cases.

The proposed SMOTE-BFT achieves the best AUC scores in 13 out of 30 datasets and obtains close to the best scores in the other cases. Even though CART performance worsens with higher DR, we can notice that our method performed relatively better especially when the dataset presents high percentage of DR. This shows that our method successfully identified and eliminated the noise and overlap generated by SMOTE.

In order to compare AUC results, statistical analysis was performed using the Wilcoxon's signed ranks test, which is a non-parametric pairwise test used to identify significant differences in performance of two methods [START_REF] Demšar | Statistical comparisons of classifiers over multiple data sets[END_REF]. In our study, we use this test to compare the performance obtained by SMOTE-BFT against other oversamplers. R+ represents the sum of ranks in favor of SMOTE-BFT, R-, the sum of ranks in favor of the other compared methods, and p-values are obtained for each comparison. As seen in Table 2, all p-values for Wilcoxon's test are lower than 0.05, which shows that SMOTE-BFT outperforms all compared methods at a significance level of α = 0.05.

Conclusions

In this paper, we have proposed a new extension to SMOTE aiming at improving the quality of oversampling. Rules have been developed using the belief function theory to remove synthetic minority examples which are added in noisy, overlapping or majority class regions. Results from the experimental analysis show that SMOTE-BFT obtains significantly better results than compared methods, specifically on datasets with high disturbance ratios. Future work can include developing heuristic methods in order to automatically determine parameters such as the plausibility threshold β P l and the minimum balance ratio Br min .

Fig. 1 .

 1 Fig. 1. SMOTE limitations (noise generation and introduction of more overlapping)

Table 1 .

 1 AUC results of CART on synthetic datasets oversampled by different methods.

	Datasets	NONE SMOTE BorderSM ADASYN SMOTE-BFT
	paw (S=600,IR=5,DR=0%)	0.962	0.964	0.952	0.972	0.97
	paw (S=600,IR=5,DR=30%)	0.79	0.817	0.844	0.844	0.835
	paw (S=600,IR=5,DR=50%)	0.747	0.77	0.796	0.794	0.798
	paw (S=600,IR=5,DR=60%)	0.679	0.731	0.714	0.742	0.766
	paw (S=600,IR=5,DR=70%)	0.69	0.721	0.771	0.754	0.778
	paw (S=800,IR=7,DR=0%)	0.94	0.952	0.957	0.948	0.943
	paw (S=800,IR=7,DR=30%)	0.805	0.819	0.836	0.830	0.837
	paw (S=800,IR=7,DR=50%)	0.749	0.778	0.752	0.757	0.795
	paw (S=800,IR=7,DR=60%)	0.693	0.762	0.733	0.731	0.739
	paw (S=800,IR=7,DR=70%)	0.634	0.721	0.767	0.718	0.745
	clover (S=600,IR=5,DR=0%)	0.859	0.909	0.889	0.91	0.862
	clover (S=600,IR=5,DR=30%)	0.755	0.814	0.824	0.817	0.823
	clover (S=600,IR=5,DR=50%)	0.69	0.744	0.738	0.787	0.79
	clover (S=600,IR=5,DR=60%)	0.696	0.728	0.705	0.744	0.744
	clover (S=600,IR=5,DR=70%)	0.646	0.739	0.72	0.734	0.753
	clover (S=800,IR=7,DR=0%)	0.845	0.905	0.869	0.923	0.92
	clover (S=800,IR=7,DR=30%)	0.766	0.836	0.825	0.835	0.832
	clover (S=800,IR=7,DR=50%)	0.704	0.749	0.757	0.765	0.763
	clover (S=800,IR=7,DR=60%)	0.668	0.712	0.704	0.743	0.737
	clover (S=800,IR=7,DR=70%)	0.659	0.727	0.725	0.724	0.747
	subcl (S=600,IR=5,DR=0%)	0.976	0.942	0.955	0.952	0.954
	subcl (S=600,IR=5,DR=30%)	0.822	0.811	0.82	0.801	0.826
	subcl (S=600,IR=5,DR=50%)	0.715	0.728	0.734	0.741	0.738
	subcl (S=600,IR=5,DR=60%)	0.671	0.728	0.736	0.729	0.731
	subcl (S=600,IR=5,DR=70%)	0.688	0.746	0.718	0.71	0.757
	subcl (S=800,IR=7,DR=0%)	0.978	0.955	0.963	0.972	0.968
	subcl (S=800,IR=7,DR=30%)	0.793	0.842	0.797	0.811	0.810
	subcl (S=800,IR=7,DR=50%)	0.702	0.753	0.756	0.722	0.739
	subcl (S=800,IR=7,DR=60%)	0.702	0.724	0.742	0.739	0.763
	subcl (S=800,IR=7,DR=70%)	0.605	0.716	0.699	0.704	0.72

Table 2 .

 2 Wilcoxon's signed rank test results comparing SMOTE-BFT (R+) with other oversampling methods (R-).

	Comparisons	R+	R-	P-value
	SMOTE-BFT vs NONE	453.0	12.0	< 0.00001
	SMOTE-BFT vs SMOTE	370.0	95	0.00467
	SMOTE-BFT vs BorderSM	368.0	97	0.00530
	SMOTE-BFT vs ADASYN	352.5	112.5	0.02307


Malika Ben Khalifa
email: malikabenkhalifa2@gmail.com

Zied Elouedi
email: zied.elouedi@gmx.fr

Eric Lefevre
email: eric.lefevre@univ-artois.fr

Eric Lefèvre

Evidential Group Spammers Detection

Keywords: Fake reviews, Group spammers, Uncertainty, Belief Function Theory, Evidential KNN, E-commerce

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Products, brands, hotels, restaurant, cities, places to visit and all services are now identified through a rating score which is generally the average score of the different reviews given by customers. Such rating score or reviews become one of the most influenced source on consumer's purchase decisions. We can assume that, online reviews nowadays control e-commerce and even international commerce. To increase their market share and to stay ahead of their competitors, companies and business try to over qualify their products by posting fake positive reviews, and even by posting fake negative reviews to damage their competitors' e-reputation. Those who post these fake reviews are called fake reviewers or review spammers, and the products being spammed are called target products. As the commercialization of these fraudulent activities, such spammers are organized to collaboratively write fake reviews in order magnify the effect of review manipulation. Such review group spammers are more frequently occurred to control the sentiment of the target products. They are even more harmful than individual review spammers' cause over their ability to deviate the overall rating in a short time interval and with different reviewers profiles to mislead spammer detection tools. The review spam detection issue attracts significant researchers during the last years. The main objective of these methods is to distinguish between fake and genuine reviews in order to protect ensure a safe environment and an equitable concurrence between companies. These research can be classified into three categories [START_REF] Heydari | Leveraging quality metrics in voting model based thread retrieval[END_REF]; review spam detection, review spammer detection and group spammer detection. Several approaches are based on the review spam text information as the semantic and linguistic aspects [START_REF] Deng | Sentiment analysis based online restaurants fake reviews hype detection[END_REF][START_REF] Ong | Linguistic characteristics of shill reviews[END_REF]. Moreover, there are different methods which try to detect spammers through graph based aspects [START_REF] Akoglu | Opinion fraud detection in online reviews by network effects[END_REF][START_REF] Fayazbakhsh | Review spam detection: A network-based approach[END_REF][START_REF] Wang | Review graph based online store review spammer detection[END_REF]. Others, detect spammers while relying on the spammers behavioral indicators [START_REF] Lim | Detecting product review spammers using rating behaviors[END_REF][START_REF] Mukherjee | Spotting opinion spammers using behavioral footprints[END_REF][START_REF] Pan | Identifying indicators of fake reviews based on spammer's behavior features[END_REF], and on the brust patterns as new indicators [START_REF] Fei | Exploiting burstiness in reviews for review spammer detection[END_REF]. These approaches give significant results in the spam reviews detection field. Recently, there were increasingly research interests in group spamming detection aspects cause of their powerful manipulation thanks to their huge reviewers' members. The first study was introduced by Mukherjee et al. [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF], in which they rely on the Frequent Itemset Mining (FIM) technique to generate candidate review spammers groups. This technique considers reviewers as items and products as transactions. Through the FIM technique and by initializing the minimum support count to 3, they can spot at least 2 reviewers, while each reviewer review at least 3 common products. Many techniques rely on these candidate groups and propose different computing frameworks to evaluate the suspicion of each candidate spammer groups. Such that, in [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF] authors proposed an iterative computing GSRank to rank candidate groups which spots the relationship among candidate groups, target products and individual reviewers. Xu et al. [START_REF] Xu | Towards collusive fraud detection in online reviews[END_REF] introduce a statistical model based on the EM algorithm to calculate the collusiveness of each group member from one FIM candidate group at least. Another proposed method in [START_REF] Wang | Detecting review spammer groups via bipartite graph projection[END_REF] relies on FIM method to capture bicliques or sub-bicliques candidates them check them to detect real collusion groups through group spam indicators. Moreover, Xu et al. [START_REF] Xu | Uncovering collusive spammers in chinese review websites[END_REF] use FIM to find groups of reviewers who have reviewed various common products. They introduce a KNN-based method and a graph based classification method to predict the fake or not fake labels for each reviewer belonging to at least one FIM candidate group. They evaluated the effectiveness of the used group spammer indicators on a large Chinese review websites. The KNN-method proves its performance in this study. Some other recent works in this aspect do not rely on the FIM techniques such in [START_REF] Wang | Graph-based review spammer group detection[END_REF], where authors propose a top-down computing framework (GGSpam) to detect review spammer groups by exploiting the topological structure of the underlying reviewer graph. We can also cite [START_REF] Wang | GSLDA: LDA-based group spamming detection in product reviews[END_REF] which propose an unsupervised approach named LDA-based group spamming detection in product reviews (GSLDA) which adapt Latent Dirichlet Allocation (LDA) in order to bound the closely related group spammers into small cluster of reviewers and extracts high suspicious reviewers groups from each LDA-clusters. These proposed methods achieve also significant results. The spam review detection issue can be considerate as one of the most uncertain challenging problem due to the ambiguity provided by the spammers and the group spammers to mislead the detection systems. Nevertheless, the previous proposed methods did not take into consideration the uncertain aspect while trying to detect group spammers. We think that ignoring such uncertainty may deeply affect the quality of detection. For these reasons, we propose a novel method aims to detect group spammers based on the FIM technique to generate candidate group and also on the different group spammer indicators, using the K-nearest neighbors' algorithm within the belief function theory. This theory has shown its robustness in this field through our previous methods which achieve significant results [START_REF] Ben Khalifa | Multiple criteria fake reviews detection using belief function theory[END_REF][START_REF] Ben Khalifa | Spammers detection based on reviewers' behaviors under belief function theory[END_REF][START_REF] Ben Khalifa | Fake reviews detection based on both the review and the reviewer features under belief function theory[END_REF]. Furthermore, the use of the Evidential K-NN has been based on its robustness in the real world classification problems under uncertainty. We seek to involve imprecision in the Group spammers behaviors indicators which are considered as the fundamental interest in our approach since they are used as features for the Evidential K-NN. In such way, our method predicts the labels spammers or not spammers reviewers (belonging or not to the FIM candidate groups). This paper is structured as follows: In the first section, we present the basic concepts of the belief function theory and the Evidential K-nearest neighbors, then we elucidate the proposed method in section 2. Section 3 is consecrated for the experimental results and we finish with a conclusion and some future work.

Belief function theory

In section, we elucidate the fundamentals of the belief function theory as well as the Evidential K-nearest neighbors classifier.

Basic concepts

The belief function theory, called also the Dempster Shafer theory, is one of the powerful theories that handles uncertainty in different tasks. It was introduced by Shafer [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] as a model to manage beliefs. In this theory, a given problem is represented by a finite and exhaustive set of different events called the frame of discernment Ω. 2 Ω is the power set of Ω that includes all possible hypotheses and it is defined by: 2 Ω = {A : A ⊆ Ω}. A basic belief assignment (bba) named also a belief mass represents the degree of belief given to an element A. It is defined as a function m Ω from 2 Ω to [0, 1] such that:

A⊆Ω m Ω (A) = 1. (1)
A focal element A is a set of hypotheses with positive mass value m Ω (A) > 0.

Several types of bba 's have been proposed [START_REF] Smets | The canonical decomposition of a weighted belief[END_REF] in order to model special situations of uncertainty. Here, we present some special cases of bba's:

-The certain bba represents the state of total certainty and it is defined as follows: m Ω ({ω i }) = 1 and ω i ∈ Ω.

-The categorical bba has a unique focal element A different from the frame of discernment defined by: m Ω (A) = 1, ∀A ⊂ Ω and m Ω (B) = 0, ∀B ⊆ Ω B = A. -Simple support function: In this case, the bba focal elements are {A, Ω}. A simple support function is defined as the following equation:

m Ω (X) =      w if X= Ω 1 -w if X = A for some A ⊂ Ω 0 otherwise ( 2
)
where A is the focus and w ∈ [0,1].

Belief function

The belief function, denoted bel, includes all the basic belief masses given to the subsets of A. It quantifies the total belief committed to an event A by assigning to every subset A of Ω the sum of belief masses committed to every subset of A. bel is represented as follows:

bel(A) = ∅ =B⊆Ω m Ω (B) (3) bel(∅) = 0 (4) Combination Rules
Several combination rules have been proposed in the framework of belief functions to aggregate a set of bba's provided by pieces for evidence from different experts. Let m Ω 1 and m Ω 2 two bba's modeling two distinct sources of information defined on the same frame of discernment Ω. In what follows, we elucidate the combination rules related to our approach.

1. Conjunctive rule: It was introduces in [START_REF] Smets | The transferable belief model for quantified belief representation[END_REF], denoted by ∩ and defined as:

m Ω 1 ∩ m Ω 2 (A) = B∩C=A m Ω 1 (B)m Ω 2 (C) (5)
2. Dempster's rule of combination: This combination rule is a normalized version of the conjunctive rule [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF]. It is denoted by ⊕ and defined as:

m Ω 1 ⊕ m Ω 2 (A) = m Ω 1 ∩ m Ω 2 (A) 1-m Ω 1 ∩ m Ω 2 (∅) if A = ∅, ∀A ⊆ Ω, 0 otherwise. (6)

Decision process

The belief function framework provides numerous solutions to make decision. Within the Transferable Belief Model (TBM) [START_REF] Smets | The transferable belief model for quantified belief representation[END_REF], the decision process is performed at the pignistic level where bba s are transformed into the pignistic probabilities denoted by BetP and defined as:

BetP (B) = A⊆Ω |A ∩ B| |A| m Ω (A) (1 -m Ω (∅)) ∀ B ∈ Ω (7)

Evidential K-Nearest neighbors

The Evidential K-Nearest Neighbors (EKNN) [START_REF] Denoeux | A K-nearest neighbor classification rule based on Dempster-Shafer theory[END_REF] is one of the best known classification methods based in the belief function framework. It performs the classification over the basic crisp KNN method thanks to its ability to offer a credal classification of the different objects. This credal partition provides a richer information content of the classifier's output.

Notations -Ω = {C 1 , C 2 , ..., C N }:
The frame of discernment containing the N possible classes of the problem.

-X i = {X 1 , X 2 , ..., X m }: The object X i belonging to the set of m distinct instances in the problem. -A new instance X to be classified. -N K (X): The set of the K-Nearest Neighbors of X.

EKNN method

The main objective of the EKNN is to classify a new object X based on the information given by the training set. A new instance X to be classified must be allocated to one class of the N K (X) founded on the selected neighbors. Nevertheless, the knowledge that a neighbor X i belongs to class C q may be deemed d(X, X i ) as a piece of evidence that raises the belief that the object X to be classified belongs to the class C q . For this reason, the EKNN technique deals with this fact and treats each neighbor as a piece of evidence that support some hypotheses about the class of the pattern X to be classified. In fact, the more the distance between X and X i is reduces, the more the evidence is strong. This evidence can be illustrated by a simple support function with a bba such that:

m X,Xi ({C q }) = α 0 exp -(γ 2 q d(X,Xi) 2 ) (8) m X,Xi (Ω) = 1 -α 0 exp -(γ 2 q d(X,Xi) 2 ) (9)
Where:

α 0 is a constant that has been fixed in 0.95. d(X, X i ) represents the Euclidean distance between the instance to be classified and the other instances in the training set. γ q assigned to each class C q has been defined as a positive parameter. It represents the inverse of the mean distance between all the training instances belonging to the class C q .

After the generation of the different bba s by the K-nearest neighbors, they can be combined through the Dempster combination rule as follows:

m X = m X,X1 ⊕ ... ⊕ m X,X K (10)
where {1, ..., K} is the set including the indexes of the K-Nearest Neighbors.

Proposed Method

The idea behind our method is to take into account the uncertain aspect in order to improve detecting the group spammer reviewers. For that, we propose a novel approach based on FIM techniques to generate candidate groups, different group spammers indicators and we rely on the Evidential K-nearest neighbors which is famous classifier under the belief function framework. In the remainder of this section, we will elucidate the different steps of our proposed approach; in the first step we will construct the different group spammers from data and we model the group spammers indicators which will be used as features in our method. In the second step, we detail the applying of the EKNN in which we present the initialization and learning phase. Finally, we distinguish between the group spammers and the innocent reviewers through the classification phase.

Step1: Pre-processing phase

Spammers who get paid to post fake reviews can not just writing one review for a single product because they would not make enough money that way. Rather, they post various reviews for many products. That's why, we use Frequent pattern mining, that can find them working together on multiple products, to construct candidate spammer groups. Then, we elucidate the different group spammers indicators [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF] which can control the candidate spammers behaviors and to find out whether these groups behave strangely.

1-Construction of spammer groups from data

To create a dataset that holds sufficient colluders for evaluation, the first task is to search for the places where colluders would probably be found. A good way to achieve this is to use frequent itemset mining (FIM). In such context, reviewer IDs are regarded as items, each transaction is the set of reviewer IDs who have reviewed a particular product. Through FIM, groups of reviewers who have reviewed multiple common products can be found. Here we use maximal frequent itemset mining (MFIM) to discover groups with maximal size since we focus on the worst spamming activities in our dataset.

2-Group spammer indicators

In our method, we rely on these different group spammers indicators:

-Time Window (TW): Reviewers in a spammer group usually work together in order to post fake reviews for a target product in a short time interval. -Group Deviation (GD): Members of group spammers are generally give either very high (5*) or very low (1*) ratings to the products. The same products typically are also reviewed by other genuine reviewers. Group spammers generally deviate in their ratings by a significant amount from the mean review ratings score. Therefore, the bigger the deviation, the worse the group is. -Group Content Similarity (GCS): Members of group spammers usually copy reviews among themselves. Therefore, the products or the services which are victims of such group spamming can have many reviews with similar content. -Member Content Similarity (MCS): The members of a group may not know one another. Each of them just copy or modify his/her own previous reviews.

If multiple members of the group do this, the group is more likely to be a spammer group. -Early Time Frame (ETF): One damaging group spam activity is to strike right after a product is launched or is made available for reviewing. The purpose is to make a big impact and to take control of the sentiment on the product. -Ratio of Group Size (RGS): The ratio of the group size and the total number of reviewers for the product is also a good indicator of spamming. In one extreme (the worst case), the group members are the only reviewers of the product, which is very damaging. -Group Size (GS): The group size itself also tells something quite interesting.

If a group is large, then the probability of members happening to be in the group by chance is small. Furthermore, the larger the group, the more devastating is its effect. -Support Count (SC): Support count is the number of products for which the group has worked on together. If a group has a very high support count, it is clearly alarming.

Step2: Evidential KNN application

After applying the FIM algorithm with fixed parameter settings, we note that the suspicious groups are found to be highly similar with each other in term of members, reviewed product also similar ratings. This is because of the dense reviewer product bipartite graph that can decomposed into many small pieces of fully connected sub-graphs (groups). This may have many overlapped nodes (members and products) and such small sub-graphs may dilute the effectiveness of some indicators. However, being used properly, these tiny groups may be favorable to detect colluders in a novel way. That's why, we propose to rely on the Evidential KNN-based method to detect colluders by utilizing the similarities between such groups. Let {g j } j = 1..m a set of groups and {R i } i = 1..n be a set of reviewers with each associated with an vector a i of attributes which are the different group spammer indicators mentioned above. Note that each reviewer may belong to multiple groups.

By modeling the colluder detection problem as a binary classification problem our goal is to assign each reviewer R i with a class label Ω = {S, S} where S represents the class of the spammers reviewers and S contains the class of the not spammers (innocent) reviewers.

The idea is that given a set of groups, the reviewers who belong to "similar" groups may be more likely to have the same class labels. Thus the class label of a reviewer R i can be determined commonly by a set of k reviewers who belong to groups most "similar" to the groups R i belongs to.

1-Initialization and learning phase

When applying the Evidential K-NN classifier, we start by initializing the parameters α 0 et γ 0 to be used in the learning phase. The α 0 is fixed to 0.95, as mentionned in the EKNN algorithm [START_REF] Denoeux | A K-nearest neighbor classification rule based on Dempster-Shafer theory[END_REF]. To ensure the γ Ii computation performance, first of all we must find reviewers belonging to different groups are having separately exclusive group spammers indicators. We measure the pairwise similarity of two groups which consists of three measurements as follows: Common Member Ratio It measures the Jaccard similarity of the sets of members of two groups:

S cm = |M i ∩ M j | |M i ∪ M j | (11)
Where M i and M j are the member sets of groups g i and g j .

Common Product Ratio

It is computed as the sum of the number of products (hotel/ restaurant) of the same brand reviewed by each group, divided by the sum of the number of products reviewed by each group:

S cp = max b∈B (P b,i ) + (P b,j ) P i + P j ( 12
)
where B is the set of common brands reviewed by both groups g i and g j . P b,i (respectively P b,j ) is the set of the products with brand b reviewed by group g i (respectively g j ), and P i (respectively P j ) is the set of the products reviewed by group g i (respectively g j ).

Common Rating Deviation It computes the deviation between the average ratings given to the products of common restaurant/hotel reviewed by two groups:

S crd = 1 1 + 1 |B| b∈B (r b,i -rb,j ) 2 (13)
where rb,i (respectively rb,j ) is the average rating given to the products with brand b by group g i (respectively g j ). Accordingly, the pairwise similarity of two groups is defined as the weighted average of the above components:

Sg i,j = w k S k w k S k (14)
where S k ∈ {S cp , S crd , S cm } and w k is a non negative weight for S k where k w k = 1. After defining the pairwise similarity of two groups, the pairwise similarity of two reviewers is computed by taking the average over the pairwise similarity of each pair of their respective groups:

d(R i , R j ) = k∈Gi l∈Gj Sg k,l |G i ||G j | (15)
where G i and G j are the set of groups that have reviewer R i and R j respectively. Then, we must select a set of reviewers and for each reviewer R j in the database, we measure its distance with the target reviewer R i . Given a target reviewer, we have to select its K-most similar neighbors, by choosing only the K reviewers having the smallest distances values that is calculated through the pairwise similarity of two reviewers calculated above.

2-Classification phase

In this part, we aim to classify the target reviewer R i into spammer or not where our frame of discernment Ω = {S, S}.

The bba's generation

Each reviewer R I provides a piece of evidence that represents our belief about the class that he belongs. However, this information does not offer certain knowledge about the class. In the belief function framework, this case is represented by simple support functions, where only a part of belief is assigned to ω i ∈ Ω and the rest is committed to Ω. Consequently, we obtain bba as follows:

m Ri,Rj ({ω i }) = α Ri (16) m Ri,Rj (Ω) = 1 -α Ri (17)
Where R i is the target reviewer and R j is its similar reviewer that j = {1..K}, α Ri = α 0 exp (-γ Ii d(Ri,Rj )) , α 0 and γ Ii are two parameters and d(R i , R j ) is the distance between the two reviewers R i and R j measured above.

In our situation, each neighbor of the target reviewer has two possible hypotheses. It can be near to a spammer reviewer in which his the committed belief is assigned to the spammer class S and the rest is given Ω. On the contrary, it can be similar to an innocent reviewer where the committed belief is allocated to the not spammer class S and the rest to the whole frame Ω. We treat the K-most similar reviewers independently where each one is represented by a bba. Hence, K various bba's can be created for each reviewer.

The bba's combination

After the bba's generation for each reviewer R i , we detail how to aggregate these bba's in order to get the final belief concerning the reviewer classification. We combine these bba's through the Dempster combination rule to obtain the whole bba that represent the evidence of the K-nearest Neighbors regarding the class of the reviewer. Hence, this global mass function m is calculated as such:

m Ri = m Ri,R1 ⊕ m Ri,R2 ⊕ .... ⊕ m Ri,R K (18)

Decision making

In order to determine the membership of the reviewer R i to one of the classes of Ω, we apply the pignistic probability BetP . Therefore, the classification decision is made either the reviewer is a spammer or innocent. For this, we select the class that has the grater value of BetP as the final classification.

Experimentation and Results

The evaluation in the fake reviews detection problem was always a challenging issue due to the unavailability of the true real world growth data and variability of the features also the classification methods used by the different related works which can lead to unsafe comparison in this field.

Data description

In order to test our method performance, we use two datasets collected from yelp.com. These datasets represent the more complete, largest, the more diversified and general purpose labeled datasets that are available today for the spam review detection field. They are labeled through the classification based on the yelp filter which has been used in various previous works [START_REF] Ben Khalifa | Fake reviews detection based on both the review and the reviewer features under belief function theory[END_REF][START_REF] Fontanarava | Feature Analysis for Fake Review Detection through Supervised Classification[END_REF][START_REF] Mukherjee | What Yelp Fake Review Filter Might Be Doing[END_REF][START_REF] Rayana | Collective opinion spam detection: Bridging review networks and metadata[END_REF][START_REF] Wang | GSLDA: LDA-based group spamming detection in product reviews[END_REF] as ground truth in favor of its efficient detection algorithm based on experts judgment and on various behavioral features. Table 1 introduces the datasets content where the percentages indicate the filtered fake reviews (not recommended) also the spammers reviewers. The YelpNYC dataset contains reviews of restaurants located in New York City; the Zip dataset is bigger than the YelpNYC datasets, since it includes businesses in different regions of the U.S., such that New Jersey, New York, Vermont and Connecticut. The strong points of these datasets are:

-The high number of reviews per user, which facilities to modeling of the behavioral features of each reviewer. -The divers kinds of entities reviewed, i.e., hotels and restaurants -Above all, the datasets hold just basic information, such as the content, label, rating, and date of each review, connected to the reviewer who generated them. Thanks to the over-specific information, we can generalize the proposed method to different review sites.

Evaluation Criteria

We rely on the three following criteria to evaluate our method performance: Accuracy, precision and recall, they can be defined as Eqs.19, 20, 21 respectively where T P , T N , F P , F N denote True Positive, True Negative, False Positive and False Negative respectively.

Accuracy = (T P + T N ) (T P + T N + F P + F N ) (19)
P recision = T P (T P + F P ) ( 20)

Recall = T P (T P + F N ) (21)

Experimental results

First of all, we apply the frequent itemset mining FIM, where I is the set of all reviewer ids in our two datasets. Each transaction is the set of the reviewer ids who have reviewed a particular hotel or restaurant. Thus, each hotel or restaurant generates a transaction of reviewer ids. By mining frequent itemsets, we find groups of reviewers who have reviewed multiple restaurants or hotels together. Then, we rely on the Maximal Frequent Itemset Mining (MFIM) to spot groups with maximal size in order to focus on the worst spamming activities. In the YelpZip dataset we found 74,364 candidate groups and 50,050 candidate groups for the YelpNYC dataset. We use k = 3 for our proposed approach.

Trying to ensure a safe comparison, we compare our method named Evidential Group Spammers Detection (EGSD) with two previous works in which authors rely on the FIM technique to generate the candidate groups and almost the same features used in our work. The first method introduced in [13] Detecting Group Review Spam (DGRS) used the FIM to generate candidate groups then computed the different indicators value and use the SVM rank algorithm to rank them, the other method proposed in [START_REF] Mukherjee | Spotting fake reviewer groups in consumer reviews[END_REF] we focus on the Ranking Group Spam algorithm (GSRank) which rely on an iterative algorithm to effectively Our method achieves the best performance detection according to accuracy, precision and recall over-passing the compared methods. We record at best an accuracy improvement over 10% in both YelpZip and YelpNYC data-sets compared to DGRS and over 7% compared to GSRank.

Conclusion

In this work, we tackle the group spammer review detection problem which become a real issue to the online rating systems and we propose a novel approach that aims to distinguish between the spammer and the innocent reviewers while taking into account the uncertainty in the different suspicious behavioral group spammer indicators. Experimental study on a real-world datasets against several state-of-the-art approaches verifies the effectiveness and efficiency of our method. Our proposed approach can be useful for different reviews sites in various fields. As future work, we aim to introduce other features to further improve the detection.

Table 1 .

 1 Datasets description

	Datasets	Reviews (filtered %)	Reviewers (Spammer %)	Services (Restaurant or hotel)
	YelpZip 608,598 (13.22%) 260,277 (23.91%)	5,044
	YelpNYC 359,052 (10.27%) 160,225 (17.79%)	923

Table 2 .

 2 Comparative results 62% 76.5% 83.55% 61.3% 77.2% 85% rank the group spammers. The results are reported in the table 2.

	Evaluation Criteria Accuracy	Precision	Recall
	Methods	DGRS GSRank EGSD DGRS GSRank EGSD DGRS GSRank EGSD
	YelpZip	65% 78%	85% 70% 76%	83.5% 71% 74%	86%
	YelpNYC	60% 74%	84.3%