Anomaly, Text, Web and Graph Mining

Introduction

Modern data warehouses contain far more than rows of neatly structured transactions. Organisations collect server logs, customer reviews, social-media posts, clickstreams, device telemetry, hyperlinks, identity relationships and communication networks. These data sources contain valuable signals, but they also contain noise, ambiguity, rare events and complex dependencies. Data mining methods must therefore extend beyond conventional classification, clustering and association analysis.

This chapter examines four closely related areas: anomaly mining, text mining, web mining and graph mining. They are particularly important in fraud detection, cybersecurity, recommender systems, digital marketing, search, social-network analysis and platform governance. Although these areas use different data representations, they share a central objective: discovering meaningful patterns in data whose structure is often incomplete, dynamic or difficult to observe directly.

Anomaly mining identifies observations that deviate substantially from expected behaviour. Text mining converts unstructured language into analyzable representations and supports tasks such as sentiment analysis and document classification. Web mining applies mining techniques to web content, hyperlinks and user activity. Graph mining represents entities and relationships explicitly, enabling analysis of connectivity, communities, influence and suspicious structures.

A responsible mining system must distinguish an unusual observation from a genuinely harmful event. Rarity alone is not proof of fraud, maliciousness or poor quality. Context, domain knowledge, data quality, temporal behaviour and the costs of false decisions must all be considered.

Learning Objectives

After studying this chapter, students should be able to:

1. Define anomalies, outliers and rare events and distinguish point, contextual and collective anomalies.

2. Compare statistical, distance-based, density-based and model-based anomaly-detection approaches.

3. Represent text using preprocessing, term-frequency methods, TF–IDF and embeddings.

4. Explain sentiment analysis, including its assumptions and limitations.

5. Distinguish web content mining, web structure mining and web usage mining.

6. Explain link analysis and graph-mining concepts such as centrality, communities and motifs.

7. Design an integrated mining workflow for fraud or cybersecurity applications.

8. Evaluate models using appropriate metrics, validation procedures and ethical safeguards.

1. Anomaly Mining

1.1 Meaning and types of anomalies

An anomaly, also called an outlier, is an observation or pattern that differs materially from a reference model of normal behaviour. The reference model may be learned from historical data, specified by experts or constructed from a combination of both.

Three common types are:

• Point anomaly: A single observation is unusual relative to the rest of the data. For example, a payment of $25,000 may be exceptional in an account whose usual payments are below $500.
• Contextual anomaly: An observation is unusual only in a particular context. A temperature of 30°C may be normal in summer but anomalous for a winter reading at a given location. Context may include time, geography, device type or customer segment.
• Collective anomaly: A group of observations is abnormal even though individual observations may appear normal. A sequence of small login attempts from many locations may indicate credential stuffing.

Anomalies may result from fraud, cyberattack, equipment failure, measurement error, data integration problems or legitimate but rare behaviour. Consequently, anomaly detection is generally a prioritisation mechanism for investigation rather than an automatic accusation system.

1.2 Statistical approaches

A simple statistical method assumes that a numerical variable follows a known or approximately known distribution. For a variable X with mean μ and standard deviation σ, a standardised score is

z = (x − μ) / σ.

Here, x is an observed value. The score is dimensionless and indicates how many standard deviations x lies from the mean. This interpretation is most reliable when observations are independent and the distribution is approximately normal. In a normal distribution, values beyond roughly ±3 standard deviations are uncommon, but this is a rule of thumb, not a universal fraud threshold.

For skewed variables such as transaction amounts, the mean and standard deviation can be distorted by extreme observations. Robust alternatives include the median and the interquartile range (IQR). The IQR is Q3 − Q1, where Q1 and Q3 are the first and third quartiles. A common box-plot rule flags values below Q1 − 1.5(IQR) or above Q3 + 1.5(IQR). This rule is useful for exploratory analysis, but it does not establish that a flagged record is erroneous or malicious.

For multivariate data, an observation may be normal on every individual variable but unusual in combination. The Mahalanobis distance is

D² = (x − μ)ᵀΣ⁻¹(x − μ),

where x is the observation vector, μ is the mean vector, Σ is the covariance matrix and Σ⁻¹ is the inverse covariance matrix. The method assumes that the covariance matrix can be estimated reliably and that a multivariate elliptical distribution is a reasonable approximation. It is sensitive to outliers in the estimation sample and can become unstable when variables are highly correlated or the number of variables is large relative to the sample size.

1.3 Distance, density and isolation methods

Distance-based methods compare an observation with nearby observations. A record whose k-nearest-neighbour distance is large may be anomalous. Variables must be scaled appropriately; otherwise, a feature with large numerical units dominates the distance. Distance methods can perform poorly in high-dimensional spaces because distances become less discriminative and neighbourhoods become sparse.

Density-based methods compare the local density around a record with the density around its neighbours. Local Outlier Factor (LOF), for example, assigns a higher outlier score when an observation lies in a region substantially less dense than nearby regions. This is useful when normal data contain clusters of different densities, although the choice of neighbourhood size affects results.

Isolation-based methods, such as Isolation Forest, repeatedly partition the data using randomly selected features and split values. Anomalies tend to be isolated in fewer partitions because they occupy sparse regions. The method is computationally practical for many tabular datasets, but its output is still a score requiring threshold selection and domain interpretation.

One-class classification methods learn a boundary around normal examples. One-Class Support Vector Machines and related methods can be useful when reliable examples of abnormal behaviour are scarce. Their performance depends strongly on feature engineering, kernel or model parameters and the assumption that the training data are predominantly normal.

1.4 Supervised, unsupervised and semi-supervised detection

In supervised anomaly classification, labelled examples of both normal and abnormal events are available. A classifier can then optimise a predictive objective. This approach may achieve high accuracy when labels are reliable, but fraud labels are often delayed, incomplete and biased toward detected cases.

Unsupervised detection seeks unusual structure without labelled anomalies. It is valuable for discovering previously unknown attack types but may produce many false positives. Semi-supervised or one-class learning uses mainly normal data and is common in intrusion detection and equipment monitoring.

The distinction between a score and a decision is important. A model may produce an anomaly score s(x), but an operational system requires a threshold, review policy or ranking procedure. Threshold selection should reflect investigation capacity and the relative costs of false positives and false negatives. If only the top 0.5% of events can be investigated, ranking quality may matter more than overall accuracy.

1.5 Evaluation of anomaly detectors

Accuracy is usually misleading when anomalies are rare. If 99.5% of events are normal, a model that labels every event normal achieves 99.5% accuracy while detecting nothing. More informative measures include precision, recall and F1 score:

• Precision = TP / (TP + FP)
• Recall = TP / (TP + FN)
• F1 = 2PR / (P + R)

TP, FP and FN denote true positives, false positives and false negatives; P and R denote precision and recall. Precision measures the proportion of alerts that are confirmed anomalies, while recall measures the proportion of known anomalies detected. F1 is the harmonic mean of precision and recall and is useful when both matter, though it ignores true negatives and may not reflect financial costs.

Precision–recall curves are often more informative than receiver operating characteristic curves for highly imbalanced data. Evaluation should use time-based validation when future events are predicted from past events. Randomly mixing records can cause leakage, especially when repeated users, devices or cases appear in both training and test sets.

2. Text Mining and Representation

2.1 The nature of text data

Text is semi-structured, high-dimensional and dependent on language and context. The same word can have different meanings, spelling varies, and meaning may depend on word order, negation, sarcasm or domain terminology. Text mining therefore begins with a representation that converts language into measurable features.

A typical preprocessing pipeline may include document collection, encoding correction, tokenisation, normalisation, handling of punctuation and numbers, stop-word decisions, stemming or lemmatisation, and removal of duplicated or automatically generated content. These operations should be task-dependent. Removing terms such as “not” can damage sentiment analysis, while aggressive stemming can merge words that have different technical meanings.

2.2 Bag-of-words and n-grams

The bag-of-words model represents a document by word counts while ignoring word order. Let tf(t,d) denote the number of occurrences of term t in document d. A document-term matrix contains one row per document and one column per term. It is simple, transparent and effective for many classification tasks, but it produces sparse, high-dimensional representations and cannot directly capture long-range meaning.

N-grams preserve limited order. A bigram contains two consecutive tokens, such as “credit card”; a trigram contains three. N-grams improve recognition of phrases and negation but increase the number of features. Feature selection, minimum-frequency thresholds and regularisation are commonly used to control dimensionality.

2.3 TF–IDF representation

Term frequency–inverse document frequency gives greater weight to terms that are frequent in a document but uncommon across the collection. One common form is

TF–IDF(t,d) = tf(t,d) × log(N / df(t)),

where N is the number of documents and df(t) is the number of documents containing term t. Variants use logarithmic term frequency, smoothing and document-length normalisation. The formula assumes that terms appearing in many documents carry less discriminating information. TF–IDF is not a probability and its exact numerical value depends on the chosen variant.

For example, suppose a collection contains 1,000 documents. A term occurs 4 times in document d and appears in 10 documents overall. Using raw term frequency, its unsmoothed weight is

4 × log(1000/10) = 4 log(100).

The numerical result depends on the logarithm base; with the natural logarithm it is approximately 18.42. The example illustrates the weighting principle rather than a universal scale.

2.4 Embeddings and language models

Dense word embeddings represent words as vectors learned from distributional context. Words appearing in similar contexts tend to have similar vectors. Document embeddings can be produced by averaging word vectors, using neural encoders or applying transformer-based language models.

Embeddings capture semantic similarity more effectively than bag-of-words representations, but they can encode social stereotypes and historical bias in their training data. Similarity in vector space does not guarantee factual correctness. In applied systems, embeddings should be evaluated on domain-specific data, monitored for drift and protected against leakage of sensitive text.

For many bachelor-level applications, a strong baseline is a TF–IDF representation combined with logistic regression or a linear support vector machine. More complex language models should be justified by measurable improvement, computational resources and governance requirements rather than adopted automatically.

3. Sentiment Analysis

Sentiment analysis identifies opinions, attitudes or emotional polarity in text. A basic task classifies documents as positive, negative or neutral. More advanced tasks identify sentiment toward particular entities or aspects, such as “battery life” and “camera” in a product review.

Lexicon-based methods use dictionaries in which words are associated with sentiment scores or categories. They are interpretable and require limited training data, but they struggle with negation, irony, domain-specific language and context. Supervised methods learn from labelled examples. Their performance depends on label consistency and whether training text resembles deployment text.

Aspect-based sentiment analysis typically involves at least two tasks: extracting an aspect and assigning sentiment toward it. The sentence “The delivery was fast, but customer support was unhelpful” contains different sentiments for different aspects. A document-level positive label would conceal this distinction.

Evaluation should report class-specific precision, recall and F1, particularly when neutral or minority categories are important. Human annotation guidelines should define how to treat sarcasm, mixed sentiment, quotations and ambiguous statements. Sentiment outputs should not be interpreted as objective measurements of truth or customer intent. They are model-based estimates influenced by language, sampling and annotation choices.

4. Web Mining

Web mining is commonly divided into content mining, structure mining and usage mining.

4.1 Web content mining

Web content mining extracts patterns from page text, metadata, images, videos, product information and user-generated content. Applications include topic classification, duplicate-page detection, review analysis, search indexing and extraction of prices or events.

Web content is difficult to mine because pages contain templates, advertisements, navigation elements, dynamically loaded content and inconsistent markup. A robust pipeline identifies the relevant content, removes boilerplate, records source and time, and preserves provenance. Crawling must respect website terms, access controls and robots exclusion conventions where applicable.

4.2 Web structure mining and link analysis

The web can be represented as a directed graph in which pages are nodes and hyperlinks are directed edges. Link analysis uses this graph to estimate importance, authority, influence or relationship.

PageRank models a random surfer who follows links with probability d and teleports to a random page with probability 1 − d. In vector form, a common formulation is

r = dAr + (1 − d)v,

where r is the vector of page scores, A is a column-stochastic transition matrix, d is the damping factor between 0 and 1, and v is a probability vector whose entries sum to 1. The matrix must account for dangling pages, often by replacing their outgoing distribution with a chosen teleportation distribution. PageRank is an iterative model of link-based importance, not a direct measure of content quality or trustworthiness.

In a small network, a page linked by several authoritative pages may receive a high score, while a page with many incoming links from low-quality sources may not. Link farms and coordinated manipulation demonstrate why graph structure must be combined with content and behavioural evidence.

4.3 Web usage mining

Web usage mining analyses interaction records such as page views, searches, clicks, sessions, purchases and dwell time. A warehouse may contain event time, user or pseudonymous identifier, session identifier, page or resource, referrer, device and outcome.

The process commonly includes cleaning bot traffic, identifying sessions, constructing sequences, discovering frequent navigation paths and modelling conversion or abandonment. Markov models, sequence mining, clustering and predictive classification may be used. Sessionisation is not trivial: a fixed inactivity interval can split one visit or merge separate visits, and privacy controls may prevent reliable identity linkage.

Usage mining supports website redesign, recommendation, fraud detection and capacity planning. It can also create surveillance risks when behavioural data are linked across services without meaningful consent.

5. Graph Mining

5.1 Graph representation

A graph G = (V,E) consists of vertices V and edges E. Vertices may represent accounts, customers, devices, products, pages or locations. Edges may represent payments, messages, logins, co-purchases, hyperlinks or shared attributes. Graphs may be directed or undirected, weighted or unweighted, static or temporal, and homogeneous or heterogeneous.

A transaction graph might contain an edge from a payer to a recipient, while a cybersecurity graph might connect users to devices, devices to IP addresses and IP addresses to domains. The choice of nodes and edges determines what patterns can be discovered. A graph is not merely a visualisation; it is a modelling decision.

5.2 Centrality and connectivity

Degree centrality counts the number of incident edges. In directed graphs, in-degree and out-degree may have different meanings. Betweenness centrality measures how often a node lies on shortest paths between other nodes and can identify brokers or bridges. Closeness centrality reflects distance to other nodes, although it is less suitable for disconnected graphs.

Eigenvector-based centrality assigns greater importance to nodes connected to important nodes. PageRank is a related directed and damped formulation. Centrality should be interpreted in context: a high-degree customer may be a legitimate business hub, while a high-betweenness account may be a payment intermediary or a suspicious mule account.

5.3 Communities, motifs and subgraphs

Community detection seeks groups with more internal connections than expected under a chosen model. Communities may reveal customer segments, collaboration groups, bot networks or coordinated fraud rings. Results are not unique: different algorithms and resolution parameters can produce different partitions.

A motif is a small recurring connectivity pattern. In fraud analysis, a pattern in which many accounts send funds to one account and then rapidly transfer them onward may be more informative than any individual transaction. Subgraph matching can search for known suspicious structures, but exact matching may be computationally expensive and vulnerable to minor variations.

Temporal graphs add time to nodes or edges. A sequence of account creation, device sharing, rapid transfers and cash-out activity may provide stronger evidence than a static graph. Temporal ordering is essential because a relationship that appears suspicious retrospectively may not have been available to an investigator at the decision time.

5.4 Graph-based anomaly detection

Graph anomalies include unusual nodes, unusual edges and unusual subgraphs. Examples include a device associated with an unexpectedly large number of accounts, an account that suddenly changes counterparties, or a tightly coordinated group that appears only briefly.

Methods range from rule-based graph features to community detection, random walks, graph embeddings and graph neural networks. Graph neural networks can aggregate information from neighbouring nodes, but they require careful treatment of temporal leakage, changing graph structure, class imbalance and explainability. A model that uses future edges to predict a past event produces an invalid evaluation.

6. Integrated Applications in Fraud and Cybersecurity

Effective systems often combine heterogeneous evidence. A fraud model may use transaction amount and time, text from merchant descriptions, web-session behaviour, device relationships and a transaction graph. A cybersecurity system may combine login anomalies, IP reputation, endpoint telemetry, domain text and communication graphs.

A practical architecture contains:

1. Data ingestion: Capture structured records, text, logs and graph events with timestamps and provenance.

2. Data quality and governance: Resolve identities carefully, handle missing values, detect duplication and document permitted uses.

3. Feature and representation construction: Produce robust numerical, textual, temporal and graph features.

4. Detection and ranking: Generate anomaly scores or risk rankings using one or more models.

5. Investigation workflow: Provide explanations, related events and analyst feedback.

6. Decision and response: Apply proportionate controls, such as step-up authentication or manual review.

7. Monitoring: Track drift, alert volume, performance, fairness and operational outcomes.

Human feedback should not be treated as perfectly objective ground truth. Analysts may focus on high-risk cases, and confirmed labels may reflect earlier model decisions. Retraining must therefore account for selection bias and delayed outcomes.

7. Illustrative Case: Detecting a Coordinated Payment-Fraud Ring

Background

This fictional case illustrates an integrated mining system for a digital payment platform. The platform processes card-not-present transactions and has observed increasing chargebacks.

Problem

Individual fraudulent transactions are often small and resemble legitimate purchases. Several newly created accounts share devices, IP addresses and beneficiary accounts. A transaction-only model misses the broader structure.

Analysis

The platform builds a heterogeneous graph with account, device, IP, merchant and beneficiary nodes. Edges represent logins, transactions, shared devices and shared network addresses. It also analyses transaction descriptions and web-session sequences.

An unsupervised detector flags accounts whose transaction timing and amounts differ from their historical behaviour. Text processing identifies repeated promotional phrases across supposedly independent merchant pages. Community detection reveals a group of accounts connected through two devices and a common beneficiary. Temporal analysis shows that accounts were created within a short period, made low-value test payments and then initiated larger transfers.

No single signal proves fraud. Shared public Wi-Fi may explain common IP addresses, and a legitimate payment processor may connect many merchants. The investigation therefore compares the graph pattern with business context and obtains additional evidence from chargeback outcomes.

Approach and solution

The platform combines: a calibrated supervised classifier for known fraud, an anomaly score for novel behaviour, graph features such as shared-device counts, text similarity between merchant descriptions and a rules engine for rapid operational controls. Accounts are ranked for review rather than automatically terminated solely because they are connected.

High-risk cases receive step-up verification and temporary transaction limits. Analysts view the evidence path: account → device → account → beneficiary, together with transaction times and model explanations. Confirmed cases are added to a controlled label store, while rejected alerts are recorded for monitoring false-positive patterns.

Outcome

The integrated approach identifies coordinated rings earlier than the transaction-only baseline and reduces unnecessary intervention on legitimate high-volume merchants. The platform continues to monitor performance because fraudsters may change devices, wording and transaction timing.

Learning points

1. Rare events may be collective and relational rather than individual.

2. Combining text, behaviour and graph structure can expose complementary evidence.

3. Entity resolution errors can create false relationships.

4. Analyst review and proportional controls are essential when labels are uncertain.

5. Temporal validation is necessary to avoid using information unavailable at decision time.

8. Limitations, Ethics and Governance

Anomaly systems can disproportionately flag new customers, minority language users, travellers or businesses with unusual but legitimate patterns. Proxy variables may reproduce protected characteristics even when those attributes are excluded. Fairness assessment should examine error rates and intervention rates across relevant groups where legally and ethically appropriate.

Privacy principles include purpose limitation, data minimisation, access control, retention limits and secure processing. Text and graph data can reveal sensitive relationships, beliefs, health information or political activity. Pseudonymisation reduces direct identification but does not guarantee anonymity, especially in highly connected graphs.

Explainability is particularly important when an alert affects account access, employment, insurance or financial services. Explanations should identify influential evidence without revealing security controls in a way that enables evasion. Governance should define ownership, escalation, auditability, model-change approval and appeal procedures.

Data protection and financial-crime regulations vary by jurisdiction. Organisations must consult applicable law regarding automated decision-making, consumer rights, monitoring, cross-border data transfer and retention. Technical performance never substitutes for legal compliance or responsible institutional judgment.

9. Best Practices and Contemporary Developments

Strong practice includes establishing a meaningful baseline, separating training from future data, validating entity resolution, scaling numerical features, preserving timestamps, testing robustness to missing data and monitoring concept drift. Models should be compared with simple rules and transparent baselines. Alert thresholds should be connected to investigation capacity and harm costs.

Contemporary developments include self-supervised language representation, multimodal mining, temporal graph neural networks, privacy-preserving analytics and human-in-the-loop detection. These technologies offer potential benefits but introduce new risks: large models may hallucinate explanations, embeddings may leak sensitive information, and graph models may amplify historical relationships. Adoption should be based on controlled evaluation, security review and measurable operational value.

Chapter Summary

Anomaly mining identifies observations or patterns that depart from expected behaviour. Point, contextual and collective anomalies require different forms of context. Statistical, distance-based, density-based, isolation and one-class methods provide alternative approaches, while precision, recall and time-aware validation are more informative than accuracy in imbalanced settings.

Text mining transforms language into features through preprocessing, bag-of-words, n-grams, TF–IDF and embeddings. Sentiment analysis estimates polarity or aspect-specific opinion but is affected by domain, context, sarcasm, annotation and bias. Web mining encompasses content mining, structure mining and usage mining. Link analysis represents pages or entities as graphs, while PageRank illustrates how directed connectivity can estimate importance.

Graph mining models entities and relationships to discover central nodes, communities, motifs, temporal patterns and graph anomalies. In fraud and cybersecurity, combining transaction, text, behavioural and graph evidence can reveal coordinated activity that isolated models miss. However, entity-resolution errors, drift, imbalance, privacy concerns, unfair impacts and explainability requirements must be addressed. Responsible systems use strong validation, human review, proportional intervention, governance and continuous monitoring.

Key Terms

Anomaly: An observation or pattern that differs materially from expected behaviour.

Point anomaly: An individual observation that is unusual relative to the dataset.

Contextual anomaly: An observation that is unusual under a particular context.

Collective anomaly: A group or sequence that is abnormal as a pattern.

Mahalanobis distance: A covariance-adjusted multivariate distance from a mean vector.

Local Outlier Factor: A density-based score comparing local density with neighbouring densities.

Isolation Forest: An ensemble method that isolates observations through random partitioning.

Precision: The proportion of predicted positive cases that are truly positive.

Recall: The proportion of actual positive cases that are detected.

TF–IDF: A term-weighting method combining within-document frequency and inverse document frequency.

N-gram: A contiguous sequence of n tokens.

Embedding: A vector representation intended to capture semantic or structural relationships.

Sentiment analysis: The computational estimation of opinions, attitudes or emotional polarity in text.

Web content mining: Mining text, media and metadata from web resources.

Web structure mining: Analysis of relationships represented by hyperlinks or other web connections.

Web usage mining: Analysis of user interactions, sessions and navigation behaviour.

Graph: A structure consisting of vertices and edges representing entities and relationships.

Centrality: A family of measures describing the structural importance of nodes.

Community detection: Identification of densely connected or internally cohesive groups.

Graph anomaly: An unusual node, edge, temporal event or subgraph in a network.

Review Questions

Short Answer Questions

1. Distinguish a point anomaly from a contextual anomaly and give one example of each.

2. Why can accuracy be misleading when evaluating fraud-detection systems?

3. What is the purpose of inverse document frequency in TF–IDF?

4. Name and distinguish the three major categories of web mining.

5. What is a collective anomaly in a transaction or cybersecurity graph?

Long Answer Questions

1. Compare statistical, density-based, isolation-based and supervised approaches to anomaly detection. Discuss their assumptions and limitations.

2. Explain how text is transformed from raw documents into features suitable for classification or sentiment analysis.

3. Describe PageRank conceptually, including the role of damping and the treatment of dangling pages.

4. Explain how centrality, community detection and temporal subgraph analysis can support fraud investigation.

5. Discuss the ethical, privacy and governance issues involved in mining text, web behaviour and relationship graphs.

Analytical / Application Questions

1. A bank receives millions of transactions, but only 0.2% are confirmed fraudulent. Design an evaluation and alert-ranking strategy that avoids relying on accuracy.

2. A platform observes many accounts sharing a device and IP address. Propose a graph-based investigation plan that distinguishes a legitimate shared network from a coordinated fraud ring.

3. Design an integrated text, web-usage and anomaly-mining pipeline for detecting malicious phishing campaigns. Identify data sources, features, validation risks and human-review controls.

Multiple Choice Questions with Answers

Question 1

Which type of anomaly is a sequence of individually normal login events that becomes suspicious as a group?

A. Point anomaly

B. Contextual anomaly

C. Collective anomaly

D. Sampling anomaly

Correct Answer: C. Collective anomaly

Question 2

In the standard z-score formula, what does σ represent?

A. The sample size

B. The standard deviation

C. The median

D. The covariance matrix

Correct Answer: B. The standard deviation

Question 3

Why is accuracy often unsuitable for evaluating rare-event fraud detection?

A. It cannot be calculated for binary labels

B. It ignores all false positives by definition

C. A model can obtain high accuracy by predicting the majority class only

D. It is always lower than recall

Correct Answer: C. A model can obtain high accuracy by predicting the majority class only

Question 4

In TF–IDF, a term appearing in many documents generally receives what effect?

A. A higher inverse-document-frequency weight

B. A lower inverse-document-frequency weight

C. A guaranteed positive sentiment score

D. Removal from every document

Correct Answer: B. A lower inverse-document-frequency weight

Question 5

Which representation preserves limited word order by using consecutive token sequences?

A. N-gram representation

B. One-hot document identifier

C. Random projection only

D. PageRank vector

Correct Answer: A. N-gram representation

Question 6

Which category of web mining analyses clicks, sessions and navigation paths?

A. Web content mining

B. Web structure mining

C. Web usage mining

D. Web compilation mining

Correct Answer: C. Web usage mining

Question 7

In PageRank, the damping factor primarily represents what?

A. The probability of following links rather than teleporting

B. The number of words on a page

C. The number of communities in a graph

D. The fraction of deleted pages

Correct Answer: A. The probability of following links rather than teleporting

Question 8

What does betweenness centrality generally measure?

A. The number of words in a node label

B. How often a node lies on shortest paths between other nodes

C. The average sentiment of neighbouring text

D. The number of disconnected components only

Correct Answer: B. How often a node lies on shortest paths between other nodes

Question 9

Which graph pattern is most naturally described as a small recurring connectivity structure?

A. Motif

B. Token

C. Quartile

D. Stop word

Correct Answer: A. Motif

Question 10

Why is time-based validation important in temporal fraud detection?

A. It guarantees that all fraud labels are correct

B. It prevents the model from using future information unavailable at decision time

C. It eliminates class imbalance

D. It makes graph construction unnecessary

Correct Answer: B. It prevents the model from using future information unavailable at decision time