User abnormal behavior recommendation via multilayer network

With the growing popularity of online services such as online banking and online shopping, one of the essential research topics is how to build a privacy-preserving user abnormal behavior recommendation system. However, a machine-learning based system may present a dilemma. On one aspect, such system requires large volume of features to pre-train the model, but on another aspect, it is challenging to design usable features without looking to plaintext private data. In this paper, we propose an unorthodox approach involving graph analysis to resolve this dilemma and build a novel private-preserving recommendation system under a multilayer network framework. In experiments, we use a large, state-of-the-art dataset (containing more than 40,000 nodes and 43 million encrypted features) to evaluate the recommendation ability of our system on abnormal user behavior, yielding an overall precision rate of around 0.9, a recall rate of 1.0, and an F1-score of around 0.94. Also, we have also reported a linear time complexity for our system. Last, we deploy our system on the “Wenjuanxing” crowd-sourced system and “Amazon Mechanical Turk” for other users to evaluate in all aspects. The result shows that almost all feedbacks have achieved up to 85% satisfaction.

the suspicious node is not enough but creating a library of suspicious nodes to be verify for subsequent logins Response: For "If false", the program will ignore the current user. We have updated this figure in the revised paper. And if the system has found a "suspicious" node, it will raise an alert to alarm the user, as the final decision should be made by user himself. The new figure is: 4. Give the scenario of medium level noise in this method Response: Here we use "medium" as the opposite of "High". In fact, due to the fact that our proposed method (privacy-preserving) and the ML-based algorithms needs all the information to learn the user behavior, these methods have possibilities to absorb noises information as well. Hence, we have replaced term "medium" as "Not Effected".

Response:
We have added the cite paper to support the assertion in the revised version.

Reconcile with abstract
Response: Sorry to bring ambiguous here. We have used "up to 85% satisfaction" in the abstract which is same to the conclusion.

Reviewer 2:
1. Page 1, line 6-7 Change "machine learning algorithms" for "machine learning (ML) algorithms" Response: I have added the abbreviation in the revision (Page 1 line 6-7). 2. Page 1, line 7 Change "SVM" for "Support Vector Machine (SVM)" Response: I have added the abbreviation of "SVM" in the revision (Page 1 line 7). 3. Page 1, line 9 Change "machine learning algorithms" for "ML algorithms" Response: I have used the abbreviation in the revision (Page 1 line 9). 4. Page 1, line 13 Change "IP adresses" for "Internet Protocol (IP) addresses" Response: I have given the full name of IP in the revision (Page 1 line 14).

Page 1, line 15
Change "machine learning models" for "ML models" Response: I have used the abbreviation of "ML" in the revision (Page 2 line 15). 6. Page 2, line 18 Change "machine learning methods" for "ML methods" Response: I have used the abbreviation of "ML" in the revision (Page 12 line 18). 7. Page 2, line 27 Change "machine learning algorithms" for "ML algorithms" Response: I have used the abbreviation of "ML" in the revision (Page 2 line 27). 8. Page 2, line 30 "…over time1." Confirm in the Plos One standards if footnotes can be used.

Response:
We have not found the standards about the footnotes. However, this standard is used in other journals. So I do no changes and keep the original format in the revision (Page 2 line 30). 9. Page 2, line 39 Change "machine learning" for "ML" Response: I have used the abbreviation of "ML" in the revision (Page 2 line 39). 10. Page 2, line 55 "The system is available at https://github.com/StoneSongLucky/Private Preserving Outlier Behavior Detection" The link is unavailable. Response: The correct links are https://github.com/StoneSongLucky/Private_Preserving_Outlier_Behavior_Detection and https://github.com/Liu-WeiYi/Private_Preserving_Outlier_Behavior_Detection The link in the paper is right and available. 11. Page 2, line 56-62 Delete: "The remainder of the paper is organized as follows. In Section 2, we discuss recent work on user abnormal behavior recommendation. Section 3 describes the whole proposed model, and describes network construction (Section 3.3), network analysis (Section 3.4), outlier recommendation (Section 3.5) and a visualization practical system (Section 3.6). In Section 4, we present a thorough evaluation of the proposed privacy-preserving recommendation system. Finally, we conclude and describe future work in Section 5." Response: I have deleted those contents in the revision. 12. Page 3, line 65 Change "machine learning" for "ML" Response: I have used the abbreviation of "ML" to replace 'machine learning'' in the revision (Page 2 line 57).

Page 3, line 71
Change "machine learning (ML) models" for "ML models" -The abbreviation should appear the first time the word is cited in the manuscript (as per the previous changes I am suggesting). Response: I have revised those mistakes in the revision (Page 3 line 64). 14. Page 10, line 262 Change "machine learning-based algorithms" for "ML-based algorithms" Response: I have used the abbreviation of "ML" in the revision (Page 10 line 254). 15. Page 10, line 266