Detection of socialbot networks based on population characteristics

doi:10.7523/j.issn.2095-6134.2014.05.016

Abstract

Abstract:

An adversary can infiltrate online social networks (OSNs) on a large scale by deploying socialbot network, which is an army of socialbot accounts. This will endanger the information security of online social network and users. To solve the problem, we propose a detection method based on the population characteristics. We extract the following population characteristics: centralized created time, similar screen names, and coincident active time. On the basis of the extracted charateristics and by using date mining method, the method is proposed to detect socialbots networks. The method is used in a data set of 480 000 users of sina microblog and detects many socialbots networks which include 6 899 socialbots accounts. The low false negative rate and false positive rate indicate that the method is feasible and effective.

Key words: socialbots accounts, socialbot networks, online social networks, data mining

CLC Number:

TP393

NI Ping, ZHANG Yuqing, WEN Guanxing, LIU Qixu, FAN Dan. Detection of socialbot networks based on population characteristics[J]. Journal of University of Chinese Academy of Sciences, 2014, 31(5): 691-700.

References

[1] Yan X, Chang Y P. A review on the research of microblog[J]. Journal of Intelligence, 2011, 30(9):61-65, 70 (in Chinese). 闫幸, 常亚平. 微博研究综述[J]. 情报杂志, 2011, 30(9): 61-65, 70.

[2] Stringhini G, Kruegel C, Vigna G. Detecting spammers on social networks[C]//Proceedings of the 26th Annual Computer Security Applications Conference. Texas, USA, 2010: 1-9.

[3] Boshmaf Y, Ildar M, Konstantin B, et al. The socialbot network: when bots socialize for fame and money[C]//Proceedings of the 27th Annual Computer Security Applications Conference. Orlando, Florida, USA, 2011: 93-102.

[4] Jagatic T N, Johnson N A, Jakobsson M, et al. Social phishing[J]. Communications of the ACM, 2007, 50(10): 94-100.

[5] Boshmaf Y, Ildar M, Konstantin B, et al. Design and analysis of a social botnet[J]. Computer Networks, 2012, 57(2013): 556-578.

[6] Stein T, Chen E, Mangla K. Facebook immune system[C]//Proceedings of the 4th Workshop on Social Network Systems, SNS'11, ACM. New York, USA, 2011: 8:1-8:8.

[7] Wang T Z, Wang H M, Liu B, et al. Some critical problems of botnets[J]. Chinese Journal of Computers, 2012, 35(6):1 192-1 208 (in Chinese). 王天佐, 王怀民, 刘波, 等.僵尸网络中的关键问题[J].计算机学报, 2012, 35(6):1 192-1 208.

[8] Fang B X, Cui X, Wang W. Survey of botnets[J]. Journal of Computer Research and Development, 2011, 48(8):1 315-1 331(in Chinese). 方滨兴, 崔翔, 王威.僵尸网络综述[J].计算机研究与发展, 2011, 48(8):1 315-1 331.

[9] Boshmaf Y, Ildar M, Konstantin B, et al. Key challenges in defending against malicious socialbots[C]//Proceedings of the 5th USENIX Conference on Large-scale Exploits and Emergent Threats. Berkeley, CA, USA, 2012.

[10] Wagner C, Mitter S, Krner C, et al. When social bots attack: modeling susceptibility of users in online social networks[C]//Proceedings of the WWW'12 Workshops: Making Sense of Microposts (# MSM2012). Lyon, France, 2012.

[11] Yang C, Harkreader R C, Gu G. Die free or live hard? empirical evaluation and new design for fighting evolving twitter spammers[C]//Proceeding of the 14th International Conference on Recent Advances in Intrusion Detection. Menlo Park, CA, USA, 2011: 318-337.

[12] Lee K, Caverlee J, Webb S. Uncovering social spammers: social honeypots+ machine learning[C]//Proceedings of the 33rd International ACM SIGIR Conference on Research and Development in Information Retrieval. New York, NY, USA, 2010: 435-442.

[13] Wang A H. Don't follow me: Spam detection in twitter[C]//Proceedings of the 2010 International Conference on Security and Cryptography. Athens, Greece, 2010: 1-10.

[14] Song J, Lee S, Kim J. Spam filtering in Twitter using sender-receiver relationship[C]//Proceeding of the 14th International Conference on Recent Advances in Intrusion Detection. Menlo Park, CA, USA, 2011:301-317.

[15] Tyagi A K, Aghila G. Detection of fast flux network based social bot using analysis based techniques[C]//Proceedings of 2012 International Conference on Data Science & Engineering. Kerala, India, 2012:23-26.

[16] Yan G. Peri-Watchdog: hunting for hidden botnets in the periphery of online social networks[J]. Computer Networks, 2012, 57 (2013):540-555.

[17] Ratkiewicz J, Conover M, Meiss M, et al. Truthy: mapping the spread of astroturf in microblog streams[C]//Proceedings of the 20^th International Conference Companion on World Wide Web. Hyderabad, India, 2011:249-252.

[18] Gao H, Hu J, Wilson C, et al. Detecting and characterizing social spam campaigns[C]//Proceedings of the 10th Annual Conference on Internet Measurement. New York, USA, 2010:35-47.

[19] Han J, Kamber M. Data Mining: concepts and techniques[M]. San Francisco: Morgan Kaufamnn, 2006.

[20] Gjoka M, Kurant M, Butts C T, et al. Walking in facebook: a case study of unbiased sampling of OSNs[C]//Proceedings of the 27th IEEE International Conference on Computer Communications. San Diego, CA, USA, 2010:1-9.

[21] Jain S, Aalam M A, Doja M N. K-means clustering using WEKA interface[C]//Proceedings of the 4th National Conference on Computing For Nation Development. New Delhi, India, 2010:1-6.