Combating Shill Bidding in Real Time: Prevention, Detection and Response

Human cheating has been a barrier to establishing trust among e-commerce users, throughout the last two decades. In particular, in online auctions, since all the transactions occur among anonymous users, trust is difficult to establish and maintain. Shill bidding happens when bidders bid exclusively to inflate (in forward auctions) or deflate (in reverse auctions) prices in online auctions. At present, shill bidding is the most severe and persistent form of cheating in online auctions, but still there are only a few or no established techniques for shill defense at run-time. In this paper, I evaluate the strengths and weaknesses of existing approaches to combating shill bidding. I also propose the ShillFree1 auction system to secure and protect auction systems from shill bidders for both forward and reverse auctions. More precisely, by using a variety of bidding behavior and user history, proposed auction system prevents, monitors and detects shill activities in real time. Moreover, to detect shilling thoroughly I propose IP tracking techniques. The system also takes necessary actions against shill activities at run-time. The experimental results demonstrate that, by prevention, detection and response mechanisms, the proposed auction system keeps the auction users secured from shill bidding and therefore establishes trust among online auction users.


Introduction
Among all online crimes, auction frauds are concurrently one of the most reported, about 35.7% in 200735.7% in (IC3, 2007)), and the top five in 2011 (IC3, 2011).The Internet Crime and Complaint Center (IC3) received over 200,000 complaints of auction related frauds in 2007, and more than 40,000 in 2011 (SecurePuter, 2008;IC3 2011).IC3 classifies auction frauds into six categories: misrepresentation of products, non-delivery of products, triangulation, fee staking, selling of black-market products, multiple bidding, and shill bidding (Jenamani et al. 2007).Shill bidding refers to artificial price inflating in case of forward auctions (Trevathan & Read, 2005) and price deflating in reverse auctions in order to generate an interest for the auctioned item.A case study on shill bidding demonstrates that in 2008 auction users have lost about 250 million dollars because of shilling (Cohen P., 2009).Shill bidding is the hardest to detect among all online auction frauds.
Researchers have been working on combating shill bidding in forward auctions (Trevathan & Read, Xu et al., Patel et al., Dong et al. and Wang et al.).However, at present all existing auction houses, and most approaches proposed by researchers have no functionality that detects shill bidding in live auctions and do not take any action until a report is made by an auction user.Since the damage occurs during the auction, it is preferable to detect and stop shilling in real time, rather than detect is afterwards.If shilling is not detected in real time, by the end of the auction, the winning seller/buyer has already been cheated.
In this paper, I first evaluate existing solutions for shill detection in online auctions, then identify common patterns and approaches of shill bidders and illustrate them through real auction examples.Subsequently, I present the ShillFree1 auction system, which can protect users from shill bidders in both forward and reverse auctions.The ShillFree1 auction system is secure, trustworthy and easy to modify as new patterns of shilling are detected.To manage the users, the ShillFree1 auction system generates and maintains user profiles based on their used period and behavior in previous auctions.It also controls users' behavior during auctions through user limits and authorization of different user requests.The ShillFree1 auction system monitors the bidding process during auctions, detects shilling attempts, and responses in real time while the auction is still running.To ensure shill free auctioning, my auction system tracks and examines the behaviors and IPs of the bidders at run time.To the best of my knowledge, no existing and only very few proposed auction system detect shilling based on the behavior and signature of users.Next, I report on an experiment involving 10 concurrent auctions where the participating users have predefined roles.This experiment demonstrates that the ShillFree1 system is able to detect all four shill bidders who are shilling in seven auctions.I conclude this paper with a discussion of possible future work.

Related Works
Considering the increasing number of problems with shill bidding in online auctions, some researchers have proposed methods of combating it.Travathan and Read (2005) present an algorithm to determine the degree of shilling being performed by a designated user.The algorithm observes shilling patterns of a user over a series of auctions and provides a shill score for the user.However, the algorithm works only for a single suspected user rather than a whole auction.Travathan and Read (2007) give an improved algorithm that detects collusive shill bidding where multiple shill bidders form a group and outbid each other's' bids for shilling.The algorithm provides a collusion score based on bid sequences of alternating bid, alternating auction and hybrid strategies.However, the algorithm considers only a limited number of bid sequences where only two shill bidders are colluding, and when multiple auctions are taken in consideration.In case of different auction intervals the algorithm will not work in real time.Patel et al. (2007) introduce a shill monitoring system for agent-based online auctions.They propose using role-based access control mechanisms to control shill bidders.They design a model with a security agent that monitors auction transactions for shill bidding.The proposed auction system considers forward auctions, where they consider user feedback for role assignment while user feedback can be falsified.The shill monitoring system monitors users instead of auctions.The authors consider a few shilling patterns, whereas there are other patterns which are also used.Xu and Cheng (2007) propose an approach to detect shill bidding by verifying bidding behaviors in concurrent auctions.The authors gather bidding data from two concurrent auctions compare and develop a toolkit to detect shill suspects.The system is applicable only for two concurrent auctions with similar items.Moreover the approach is not applicable in real time.Xu et al. (2008) present a framework for Agent-based Trust Management (ATM) in online auctions.The ATM framework consists of agents for monitoring, analysis and security.A key idea is that, different agents are used to handle trust issues w.r.t.users' role assignment.The author uses a few bidding patterns and 'reputation scores' or 'feedbacks' of other users to determine shill bidding, which can be easily falsified.Moreover, some severe techniques like duplicate identity shilling and group shilling are not addressed in this paper.Xu et al. (2009) analyze some shilling patterns and propose a Dynamic Auction Model (DAM) for shill detection in real time.DAM requires an estimated sale price and a reserve price.The system is not useful for common products in online auctions such as used items, art effects and antiques, because it is difficult to estimate sale prices.Moreover, in the presence of auction snipers (Travathan et al., 2011) and other bidding agents (Jay & Jay, 2006), shill bidders no longer need to bid a high price close to the reserve price to do shill bidding, instead they can outbid general users with a small amount instantly until a certain desired price is reached.Dong et al. (2009) propose using knowledge-based Dempster-Shafer (DS) theory to secure online auctions from shilling.They introduce a two-step model, where in the first step they propose to use the previously introduced shill detection technique of concurrent auctions (Xu and Cheng, 2007).In the second step they propose to use DS theory to verify the detected results of shilling in the first step for more accuracy.Their proposed DS theory based model checker performs shill verification only when the auction ends, which is not in real time when the shilling is happening.Although the authors claim that the technique can detect shilling in real time, their proposed model checker performs a check on the bidding behaviors only when the auction ends (Dong et al., 2009).If this analysis is correct, the model is not able to perform shill verification in real time.Dong et al. (2012) study the relationship between final prices of online auctions and shill activities and propose a system to identify shill bidding based on the difference between the final auction price and the expected auction price.Their approach is restricted to auctions where the expected price can be estimated and once again this system is only applicable when an auction ends.
The approach I present in this paper is an extension of our previous work for combating shill bidding in online auction systems (Mamun & Sadaoui, 2013).Our previous work consists only of the software architectural design, no implementation and evaluation have been carried out.In this paper, I improved agents and algorithms behind the ShillFree1 auction system which features shill prevention, detection and response.I implemented the entire system with Jadex, which is an agent-based simulation platform.I also evaluate the feasibility of my approach on a large data set of users and live auctions.
Since shill bidding is a common and well-known problem for online auctions, some popular auction houses warn their users about the possibility of shilling on their websites.However, to the best of my knowledge, no auction system takes any action against shill bidding in real time.Table 1 shows the detection techniques used by some popular auction sites and the disclosed actions taken against shill bidding.

Shill Bidding
Shill bidding takes place when a seller in a forward auction wants to sell his item for more, or a buyer in a reverse auction wants to buy the item for less than the usual price (Mamun & Sadaoui, 2013).

Common Patterns of Shill Bidding
Shill bidders use different approaches to achieve their goal of shilling.By examining real auction data, we can find some common patterns of their approaches of shilling.They include: P 1 : to increase or decrease the price, a shill bidder continually bids to outbid his own bid even when he is the top bidder in the auction (Mamun & Sadaoui, 2013).P 2 : a shill bidder bids within a short interval of time to outbid his own bid or others' to give more time to the other potential bidders (Mamun & Sadaoui, 2013).P 3 : a shill bidder makes an unnecessarily large price change to increase or decrease the price rapidly (Mamun & Sadaoui, 2013).P 4 : a shill bidder bids more in the beginning of the auction to make sure that other bidders get more time to bid.P 5 : a shill bidder bids more times on average than other bidders.P 6 : a shill bidder asks another bidder to bid on the same item (Wang et al., 2007).P 7 : a shill bidder establishes a bidding ring composed of multiple sellers or buyers bidding on the buyer's or seller's item, with or without the direct involvement of the buyer or the seller (Wang et al., 2007).P 8 : a group of shill bidders may form a bidding ring composed of multiple sellers or buyers bidding on each other's items (Wang et al., 2007).P 9 : two or more shill bidders work together in the same auction to inflate or deflate the price, which is also known as collusive shill bidding (Trevathan & Read, 2007).P 10 : a shill bidder bids exclusively only on one or few users' items.P 11 : a shill bidder creates multiple identities and bids on his own item using a single computer with the same IP address (Mamun & Sadaoui, 2013).P 12 : a shill bidder bids multiple times on the same item while changing both his identity and IP address of his computer.

Concrete Examples of Shill Bidding
Here, I analyze some concrete examples of shilling from eBay, a popular online auction house where signs of shill bidding can often be seen (Cohen P. 2009, Spaced 2013).
Example 1: This forward auction shows shill bidding of pattern P 1 .In Table 2, we can see that the auction started with a bid of $50 and after three days, there was only one more bid, which increased the price by just $2.Then, user s***e bids three consecutive times within a minute and increased the price by $13.In the end, this user did not win the auctioned item, because user t***o bought it.It is likely that user t***o paid a higher price than necessary because of shill bidding.If we examine the bid history and profile of the user s***e in Table 3, we can notice some other features about shilling.User s***e has only seven feedbacks, which means he is a new user in eBay, and in the last 30 days he bid on only this item.Example 3: The auction shown in table 6 started with a price of only $1 (cf.Table 6).Then user n***a increased the price to $201, even though when there were no other bidders (pattern P 3 ).Then user i***j inflated the price to $3000 (pattern P 3 and P 6 ) and then to $3900 (pattern P 1 ).In the end, he stopped bidding and lost the auction for $50.This behavior suggests that he intentionally bid just to inflate the price to benefit the seller of this auction.Also we can see from Table 7, that user i***j has the profile of a shill bidder.He has only 12 feedbacks and has only two bids in the last 30 days, both of which are for one seller's item.Apparently, this user is only bidding on this particular auction to increase the price.

The ShillFree1 Auction System
The ShillFree1 auction system was designed to meet the main goal of combating shill bidding.To fulfill the goal I designed a three-layer architecture of the ShillFree1 auction system, which is depicted in Figure 1.The GUI layer presents information of all auctions and users.For registration and sign in, every user has to be approved by the business layer.The data layer keeps the history of users and auctions.The business layer processes the users' actions performed in the GUI, monitors, detects and takes necessary actions against shill bidding at run time.The architecture is implemented as a multi-agent system, where each agent, based on a set of beliefs, desires and intensions (Rao & Georgeff, 1995), solves a particular problem.All agents cooperate in order to achieve the ultimate goal of protecting the running auctions from shilling.The system conducts both forward and reverse auctions according to the English protocol (Wang et al., 2001).
Figure 1.Software Architecture for Online Auctions

Status Generator Agent
Researchers have proposed giving ratings and states to users based on their shilling activities (Travathan et al 2007, Patel et al. 2007).The Status Generator agent assigns a range of statuses to users based on three metrics: Used Period (UP), Used Manner (UM) and Shilling Attempts (ShilAtts).UP indicates the number of days since a user joined my auction system, UM the number of selling and buying activities of a user, and ShilAtts the number of shilling attempts made by a user in a certain period.In my system, a user is assigned one of the six statuses given in Table 8.To increase the safety of a live auction, the status of every participant is shown besides all his submitted bids.For instance, MostReliableUser is allocated to a user who is registered in the system for more than n days, and performed more than m actions, and has performed at most v number of shill attempts.UnReliableUser status is assigned to a user who is registered in the system for more than n days, or performed more than m actions, and has performed at leaset y and at most z shill attempts, where z is greater than y.We may note that the values of n, m, v, x, y and z are flexible thresholds, which can be determined by the auctioneer according to their auction policies.In my system, I consider n as 30 days, m as 10 auctions.For the number of shill attempts, I assign v, x, y and z as 3, 5, 10 and 20 respectively.For example, a user who has been registered in my auction house for 200 days, has bid in 15 auctions, and has done 4 shill attempts will get 'ReliableUser' status.In the future, if the same user has 15 shill attempts, he will get 'UnReliableUser' status.
The Status Generator also assigns selling and buying limits for users based on their statuses which are also flexible thresholds (cf.Table 8).In my system I assign l 1 , l 2 , l 3 , l 4 , l 5 , and l 6 as unlimited, $10,000, $5,000, $1,000, $500 and $100 respectively.For instance, when a NewUser joins in my system, he will get an initial limit of $1,000 for selling or buying any products.He cannot sell or buy items for more than this amount.Periodically, the limit of a user will increase or decrease according to his updated status in order to increase the trust in my auction.

Authorizer Agent
When any user tries to access any auction for bidding or requests a product for buying, he has to obtain authorization from this agent.For example, to approve a reverse, Authorizer checks whether the buyer's asking price is less than or equal to his permitted limit or not.To authorize a seller's bidding price, Authorizer first verifies that the seller's bid is less than or equal to his allowed limit or not.After that, it also inquires whether the bid is less than the asking price or not.If all these conditions are satisfied, Authorizer approves the submitted bid.
The Authorizer agent handles a large number of users' registrations, auction requests and bids to restrict suspicious user activities in my auction system.

Security Controller Agent
Security Controller performs the most important role to maintain my auction system secured.It is composed of two sub-agents: Bidding Behavior Tracker and IP Tracker.

Bidding Behavior Tracker
According to L. Rousseau (2001).Time and date information are not useful alone as they do not disclose what happened at that time.We need a pattern of timestamp instead of a clock service to monitor and detect shill bidding in live auctions.To this end, I analze bidding behaviors in different time patterns and come up with some approaches to detect shilling.The following detection mechanisms are employed by the Bidding Behavior Tracker during the auction running time to calculate a shill score, ranging from 0 to 5 (cf.Algorithm 1).
Multiple Bid Detection: a shill bidder U often uses multiple bids (OutBidOwn U ) to outbid his own bids (see pattern P 1 ).I utilize a threshold of 2 consecutive bids for a maximum multiple bids of a user: Outbidding Time Detection: to give more time to normal bidders, a shill bidder bids shortly or right after being outbid compared to a normal bidder (see Pattern P 2 ).Therefore, the average outbidding time of a user (AverOutBidTime U ) may not exceed of 5 minutes incase of shilling: Outbidding Price Detection: a shill bidder outbids any bid by increasing (forward auction) or decreasing (reverse auction) the price by more than required minimun bid in order to be the top bidder (see Pattern P 3 ) but his main goal is to not to win the auction.So, the AverBidIncrease U may exceed 10%.
AverBidIncrease U > 10% (3) Bidding Time Detection: a shill bidder usually bids more at the beginning of the auction (see pattern P 4 ).The auction interval can be divided into two halves, first 50% of the elapsed time in auction interval and second 50% of the elapsed time in auction interval.Shill bidders number of bids in the first interval (BidFreqFirHalf U ) is usually more than the second interval (BidFreqSecHalf U ): High Bidding Frequency Detection: a shill bidder also have more number of bids than other bidders (see Pattern P 5 ).Their bidding frequency (BidFreq) may exceed more than half of the total bids in the auction:

Shil Detection by Security Controller Agent
The Security Controller agent determines the shill attempts for a user according to both trackers' reports as shown in Table 9.So, if any of the sub-components provides a positive result of shilling in a running auction, Security Controller considers it as a shill attempt.To ensure trust, every live auction should be automatically monitored and examined at least three times during the auction running time (the frequency can be increased or decreased by the auctioneer).For example, in my auction house the security agent is required to compute the shill attempts for all the bidders as follows: first after 10% of the auction time has elapsed, second in the middle of the auction period, third after 90% of the auction interval has elapsed.In this way, the security agent ensures reliable results of shill detection.A user may unintentionally show one or two shill patterns.So the Bidding Behavior Tracker considers a user as a shill bidder only when the shill score is more than 2. On the other hand, there might be some cases when a user may try to manipulate my system and use only one or two patterns.In such cases, IP Tracker will give a positive result, so that the user can be detected as a shill bidder.

Auction Controller Agent
Auction Controller works as the brain of the whole system.Any task related to a user's account, an auction and database is done through Auction Controller to keep the system centralized and convenient.This agent is the medium between the three layers, so that it simultaneously handles run-time actions of the other agents.

Functionalities of Auction Controller
The Auction Controller communicates with the other agents and performs several specific tasks.

Figure 2. Functionalities of Auction Controller
When a registered user wants to sell or buy a product and submits auction or procurement data, the Auction Controller sends an authorization request to the Authorizer agent, which verifies input data and accepts or rejects the user's request.This agent also requests a status update from the Status Generator every time when Security Controller detects any shill attempts.The Security Controller computes shill attempts along with the shill scores from the Bidding Behavior and IP Trackers periodically (see Section 4.2.2).On the other hand, shilling might be suspected and reported by an auction user as well.In such situation, the Auction Controller may request the Security Controller to perform a shill check on the suspected running auction.Auction Controller also updates the User Database after any shill attempts made by any user.

Responses of Auction Controller
After every shill attempt in a running auction, the Auction Controller agent takes actions against the user and/or the auction according to the updated status of the shilling user (cf.Table 10).Action 2: Auction Controller stops the running auction permanently in case of a determined shilling activity.
Action 3: Auction Controller gives a warning to the shilling user to act more reliably in the auction.
Action 4: Auction Controller decreases the shilling user's selling and buying limit by 10% (cf.Table 10) for every shill attempts.
Action 5: Auction Controller suspends the shill bidders' account temporarily for one month or permanently.

Implementation, Experiment and Results
I have implemented the ShillFree1 Auction System (cf. Figure 3) with the agent-based simulation platform Jadex by Java and XML (Braubach et al. 2004).I have used Jadex for platform architecture, core services and message transport mechanisms based on the FIPA specifications.I have created four agents in the business layer to perform specific tasks including registration, sign-in, auctioning, bidding, shill detection and etc.Each agent has a set of beliefs and facts to realize the current environment and status of the auction system.Moreover, they have specific goals that are sets of desires by which they can make appropriate decisions.Furthermore, they use messages to communicate with each other and plans by which they perform their assigned tasks.I have programmed six Agent Definition Files (ADFs) by XML and nine Java files to incorporate the plans of the agents.For the integrated development environment I use Eclipse IDE.

Experiment Data
I build three datasets for the experiment: users' history (cf.Table 11), auction information (cf.Table 12) and auction bids (cf.Table 13).Table 11 presents some information about the 10 registered users who have been authorized to bid on items.This table includes users with different statuses, used period, auction attendance and shill attempts.Table 12 consists of 10 English auctions initiated by different sellers and having various numbers of total bids.Table 13 exposes    Auction Controller performs shill checks for all the users in all the 10 auctions.Table 14 shows the shilling activity results of bidders for three auctions (out of 10 running auctions) which contains the 10 users' 20 results (out of 50 results).
One user may do shill bidding in one auction but not in others, and some users may show shilling in several auctions.Also some legitimate users may coincidentally show some shilling resulting in a positive shill despite the fact that no intentional shilling has occurred.To determine the shilling activity and vulnerability of an auction the system computes the shill scores, number of shill attempts and average shill scores of the users.I have conducted experiments on the 10 auctions with the 10 bidding users.Figure 4 shows the final results, where user U004 shows highest shilling activity as suggested by the highest total shill score (21 in five auctions) with the highest average and number of shill attempts, whereas U009 and U010 attended most auctions but can be considered as reliable as they have no shill attempts.In 10 suspected auctions, 4 out of 10 users are detected as shill bidders.
My auction system has a policy of taking actions depending on the user status; Table 15 gives the different consequences after shill attempts made by four users in 10 running auctions.For example, U004's status and selling and buying limit has been changed and the auctions are also paused temporarily.On the other hand, UnReliableUser U005 has been suspended temporarily for one month from the auction system and also the auctions he has attended are stopped.

Conclusion and Future Work
Fraudulent activities like shill bidding are damaging the reputation of online auctions, and have already become a serious problem in e-commerce in terms of security and trust.In this paper, I presented an auction system to secure online auctions from shill bidding at run-time.My three-layer architecture is composed of a GUI layer, a business layer and a data layer.The business layer contains four different agents to ensure shill-proof mechanisms in auction systems, in this layer the 'Auction Controller' agent keeps the system centralized and protects from shill bidding based on user status, proper authorization and shill reports from the 'Security Controller'.My auction system is secure from manipulation by shill bidders.My proposed system also takes necessary actions at run-time against any users who are detected as performing shill bidding.
For future work, to determine the shilling activity more accurately, I will implement the IP Tracker sub-agent of the Security Controller agent based on the two tracking techniques IP traceback (Snoreren et al., 2002) and DHCP origin traceback (Majumdar et al. 2011).To the best of my knowledge, no existing auction systems have considered rewarding the users for good behaviors.So, another future direction of this work is to implement an automated reward system for good behaviors.
the bidders' data of 3 auctions (i.e.20 rows of input data) out of 10 auctions (a total of 50 rows of input data) that are required by the Security Controller agent (TB represents TotalBidsInAuction, BF BidFreq U , BFFH BidFreqFirHalf U , BFSH BidFreqSecHalf U , ABI AverBidIncrease U , OBO OutBidOwn U and AOBT AverOutBidTime U ).

Table 2 .
Bidding History of an Auction Displaying Pattern P 1

Table 3 .
Bidding Profile of a Suspected Shill Bidder Displaying Patterns P 6 and P 10 If we examine the bidding prices for a Sony Vaio laptop as shown in Table4, we see strong evidence of shilling.The laptop had 126 bids, which represents too many bids compared to the other products in the same category.The starting price of the laptop was $22.57.After few hours, user j ***e started bidding at $24 and kept bidding, sometimes outbiding others and usually himself until the product reached the price of $289 (Pattern P 1 & P 2 ).The history of user j***e (cf.Table5) indicates that he bid 248 times on 44 items, but 41% of his bids are particularly for this seller and more than 90% of his bids are for only four users' items (Pattern P 10 ).

Table 4 .
Bidding History of the Auction Displaying Patterns P 1 and P 2

Table 6 .
Bidding History of the Auction Displaying Pattern P 3

Table 7 .
Bidding Profile of a Suspected Shill Bidder Displaying Pattern P 6

Table 8 .
User Status and Selling/Buying Limit

TotalBidsInAuction, BidFreq U , BidFreqFirHalf U , BidFreqSecHalf U , AverBidIncrease U , OutBidOwn U , AverOutBidTime U : Integer Outputs: ShilStatus, ShilScore: Integer Sources
of bidding behavior detection is employed by my Security Controller Agent.However, shill behavior of duplicate identities and of users having no previous bidding history is always difficult to detect.This agent determines if any user is faking an IP address, or using multiple identities with the same IP address, or bidding on his own auction.If suspected, IP Tracker reports to Security Controller immediately (by returning a binary result: 1 if suspected; 0 otherwise).IP Tracker will utilize the shilling patterns P 6 , P 7 , P 8 , P 9 , P 10 , P 11 and P 12 to detect shill attempts.

Table 10 .
Actions against shilling

Result of Security Controller Updated Status of a Shilling User Actions of Auction Controller
Auction Controller pauses the running auction temporarily in case of any shilling activity.

Table 11 .
Users' HistoryDuring the auction, Auction Controller can request the Security Controller to check Shill Attempts for all bidding users.Security Controller agent determines the shilling status (whether a shill bidder or not) and score of a particular user in a particular auction.At this time, my Security Controller does not include results from the IP Tracker.

Table 15 .
Actions taken by Auction Controller after shill attempts detected User