Hunting Review Bombs with BRIDGE - A Bipartite Graph Neural Network Approach to Abuse Detection

Cybersecurity increasingly requires advanced methods to identify and counter threats arising from resource misuse. A key challenge is abuse detection, which focuses on distinguishing between benign and malicious interactions that could lead to exploitation. Bipartite graphs provide a versatile framework for modeling such problems, particularly when interactions occur between distinct entity types, broadly categorized as users and resources. In these heterogeneous representations, nodes correspond to users and resources, while edges depict interactions that could signal potential malicious behavior. One relevant abuse detection application for this representation framework is the problem of review bombing, a form of online abuse where users leave abnormally low ratings on products for reasons unrelated to their quality - e.g., Amazon reviews are vulnerable to review bombing. This phenomenon, often driven by political or cultural motivations, distorts product perceptions and marketplaces. Traditional approaches, such as NLP-based methods focusing on the content of reviews, struggle to capture the relational and temporal patterns inherent in review bombing behavior. In this paper we propose BRIDGE - Bipartite Review bombIng Detection using Graph nEural Networks (GNNs), an approach to review bombing detection based on temporal GNNs. By modeling review data as a bipartite graph, BRIDGE analyzes temporal relationships between users and products while incorporating sentiment extracted from review text analysis. BRIDGE leverages the dynamic and relational properties of bipartite graphs to effectively identify abusive behavior, building on previous work on spatiotemporal GNNs for abuse detection. The central complexity we tackle is the large-scale, highly imbalanced topology of the bipartite representations, which consists of hundreds of thousands of users and only tens of products. Empirical results on the analysis of a real, large scale review bombing dataset from the popular gaming platform STEAM show that BRIDGE realizes high detection performance of publicly exposed review bombing cases (AUROC values above 96%), outperforming more traditional approaches based on temporal GNNs by as much as 30 %.