Presentation-Detecting Spammers on Social Networks

Detecting Spammers
on Social Networks
Gianluca Stringhini, Christopher
Kruegel, Giovanni Vigna University
of California, Santa Barbara 26th
ACSAC(December, 2010)
Presented By – Ashish Arora

CONTENTS
• Motivation
• Popular Social Networks
• Data Collection
• Analysis of Collected Data
• Spam Profile Detection Technique

Motivation
• To conduct a survey of famous Social Networking
Sites for Spam Detection.
• To identify patterns in spam attacks.
• To detect spammers on social network sites.
• Analyze the solution for detecting spammers.

SPAM DEFINITION
• SPAM is defined as an unsolicited , unwanted postings on
social network websites or suspicious emails sent to a
large number of users.
• WIKI Definition Social spam is unwanted spam content
appearing on social networks and any website with user-
generated content (comments, chat, etc.). It can be
manifested in many ways, including bulk
messages, profanity, insults, hate speech, malicious links,
fraudulent reviews, fake friends, and personally
identifiable information.

SPAM ON SOCIAL NETWORK
SITES
• Sites such as Facebook, MySpace, and Twitter are
consistently among the top 20 most-viewed web sites
of the Internet .
• In 2008, 83% of the users of social networks have
received at least one unwanted friend request or
message.
• A previous study showed that 45% of users on a
social networking site readily click on links posted by
their “friend” accounts, even if they do not know
that person in real life

The Popular Social Network Sites
• In this paper three popular social network
sites were taken in to consideration.
• Data is collected from Facebook, Twitter
and MySpace.

• Facebook administrators claim to have more than 400 million active
users all over the world.
• Facebook users were grouped in networks, where people coming
from a certain country, town, or school could find their neighbours
or peers.
• Default privacy setting was to allow all people in the same network
to view each other’s profiles. Facebook deprecated geographic
networks in October 2009

Presentation-Detecting Spammers on Social Networks

• It is designed as a microblogging
platform, where users send short
text messages (i.e., tweets) that
appear on their friends’ pages .
• Users are identified only by a
username and, optionally, by a
real name Tweets can be grouped
by hashtags, which are popular
words, beginning with a “#”
character.
• This allows users to efficiently
search who is posting topics of
interest at a certain time.

DATA COLLECTION
• Total 900 Profiles were created on Facebook, twitter
and MySpace. 300 Profiles were created on each site.
• A honeypot is a ”trap” set to detect, deflect, or in
some manner counteract attempts at unauthorized
use of information systems.
• Due to the similarity of these profiles to honeypots,
these accounts are called as honey-profiles.

Honey-Profile Creation
 Facebook
Joined 16 geographic networks, using a small number of
manually-created accounts
Crawled 2,000 accounts at random, logging names, ages,
and gender for each network
Randomly mixed this data (names, surnames, and ages) and
created the honey-profiles
 MySpace
 Crawled 4,000 accounts in total
 Twitter
 Only information required for signing up is a full name and
a profile name

Collection of Data
• No friend requests were sent, but all those that were
received were accepted
• Logged every email notification received from the
social networks, as well as all the requests and
messages seen on the honey-profiles
• Scripts ran continuously for 12 months for Facebook
(from June 6, 2009 to June 6, 2010), and for 11
months for MySpace and Twitter (from June 24,
2009 to June 6, 2010)

Analysis of Collected Data
NETWORK Total Friend Request Spammers
Facebook 3831 173
Twitter 397 361
MySpace 22 8
Table 1 Friend Requests received on the various social networks
NETWORK Total Friend Request Spammers
Facebook 72431 3882
Twitter 13113 11338
MySpace 25 0
Table 2 Message received on the various social networks

(a)Friend Request Received
(b) Message Received
(a) Users Starting following honey-profiles
(b) Message Received

RESULTS
Honey-profiles did not only receive friend requests and
messages from spammers, but also a surprising amount
from legitimate accounts.
In particular, many social network users aim to increase
their popularity by adding as friends people they do not
know.
On Facebook, since all honey-profiles were members of a
geographic network it may be that people looking for
local “friends” would have contacted some of our
accounts.

SPAM BOT ANALYSIS
• Displayer - Bots that only display some spam content on their own profile pages.
• Bragger - Bots that post messages to their own feed Messages vary according to the
networks
Facebook: status updates Twitter: tweets
Spam message is distributed and shown on all the victims’ feeds. Therefore, the spam
campaign reaches only victims who are directly connected with the spam bot 163 bots on
Facebook belonged to this category, as well as 341 bots on Twitter.
• Poster - Bots that send a direct message to each victim. This can be achieved in different
ways , on Facebook, for example, the message might be a post on a victim’s wall. Most
effective way of spamming.
• Whisperer - Bots that send private messages to their victims. As for “poster” bots, these
messages have to be addressed to a specific user . Difference: Victim is the only one
seeing the spam message.

SPAM BOT ANALYSIS
FACEB
OOK
MYSPAC
E
TWITT
ER
DISPLAY
ER
2 8 0
BRAGG
ER
163 0 341
POSTER 8 0 0
WHISPE
RER
0 0 20
Two kinds of bot behavior were
identified
Greedy : Include a spam content in
every message they send (416)
Stealthy: Send messages that look
legitimate, and only once in a while
inject a malicious message (98)
Most spam profiles under
observation, both on Facebook and
Twitter, sent less than 20 messages
during their life span.
Bots showed a higher activity around
midnight.

SPAM PROFILE DETECTION
 Used machine learning techniques to classify spammers and legitimate
users.
 Developed six features to detect whether a given profile belongs to a
spammer or not.
1.) FF ratio (R) - The feature compares the number of friend requests
that a user sent to the number of friends one has , unfortunately, the
number of friend requests sent is not public on Facebook and on
MySpace
On Twitter, the number of users a profile started to follow is public.
R = following / followers

2. URL ratio (U) - The feature to detect a bot is the presence of URLs
in the logged messages
U =( messages containing urls / total messages)
Only count URLs pointing to a third party site when computing this
feature.
3. Message Similarity (S)
4. Friend Choice (F) is to detect whether a profile likely used a list of
names to pick its friends or not
5. Messages Sent (M) - The number of messages sent by a profile as a
feature. Profile that send hundred of messages are less likely to be spammer.
6. Friend Number (FN) - The number of friends a profile has.
The Weka framework with a Random Forest algorithm was used for
the classifier. This algorithm gave the best accuracy and lowest false
positive ratio when we performed the cross-validation of the training
set.

SPAM DETECTION ON
FACEBOOK
• Challenges - Obtain a suitable amount of data to
analyze. Most profiles are private, and only their
friends can see their walls
• Geographic networks discontinued in October 2009.
Used data from various geographic networks, crawled
between April 28 and July 8 2009, to test our
approach.
• Modifications - R feature not applicable as number
of friend request sent out is not public.

SPAM DETECTION ON
FACEBOOK
• Trained classifier using 1,000 profiles
• 173 spam bots that contacted honey-profiles as samples for spammers.
• 827 manually checked profiles as samples for legitimate user.
• A 10-fold cross validation on this training data set yielded an estimated false
positive ratio of 2% and a false negative ratio of 1%.
From 790,951 profiles
 Detected: 130 spammers
 False positive: 7
From 100 profiles
 False negative: 0
• Low number may be due to the fact that spam bots typically do not join
geographic networks

SPAM DETECTION ON
TWITTER
• Easier to obtain data than Facebook as most profiles are
public
• 500 spam profiles picked
• 500 legitimate profiles also picked
• Modifications: - Legitimate profiles with a fairly high
number of followers (e.g., 300), but following thousands
of other profiles, have a high value of R.
• Therefore, a new feature R’ = (R value)/(the number
of followers a profile has)

SPAM DETECTION ON
TWITTER
• A 10-fold cross validation for the classifier with the updated
feature set yielded an estimated false positive ratio of 2.5% and
a false negative ratio of 3% on the training set.
• The main problem faced while building the system was the
crawling speed
• Twitter limited the machine to execute only 20,000 API calls per
hour
• From March 06, 2010 to June 06, 2010, crawled 135,834
profiles, detecting 15,932 of those as spammers.
 These profiles were sent to Twitter , only 75 out of these
were reported False positive

IDENTIFICATION OF SPAM
CAMPAIGNS
• Two bots posting messages with URLs pointing to the same site are
considered part of the same campaign . A relationship exists
between the lifetime of bots and the number of victims targeted.
• From the observations of the various campaigns, a metric was
developed to predict the success of a campaign. The campaign was
considered successful if the bots belonging to it have a long
lifetime.

CONCLUSION
• Social networking sites attracts spammers
• Ease of reaching these users
• Possibility to take advantage of the information stored in their
profiles
• Created a population of 900 honey-profiles on three major
social networks and observed the traffic they received
• Developed techniques to identify single spam bots, as well as
large-scale campaigns.
• These techniques can help social networks to improve their
security and detect malicious users.

Presentation-Detecting Spammers on Social Networks

More Related Content

What's hot (20)

Similar to Presentation-Detecting Spammers on Social Networks (20)

Presentation-Detecting Spammers on Social Networks