Spambot detection in online social networks is a long-lasting challenge involving the study and design of detection techniques capable of efficiently identifying ever-evolving spammers. Recently, a new wave of social spambots has emerged, with advanced human-like characteristics that allow them to go undetected even by current state-of-the-art algorithms. In this paper, we show that efficient spambots detection can be achieved via an in-depth analysis of their collective behaviors exploiting the digital DNA technique for modeling the behaviors of social network users. Inspired by its biological counterpart, in the digital DNA representation the behavioral lifetime of a digital account is encoded in a sequence of characters. Then, we define a similarity measure for such digital DNA sequences. We build upon digital DNA and the similarity between groups of users to characterize both genuine accounts and spambots. Leveraging such a characterization, we design the Social Fingerprinting technique, which is able to discriminate among spambots and genuine accounts in both a supervised and an unsupervised fashion. We also evaluate the effectiveness of Social Fingerprinting and we compare it with three state-of-the-art detection showing the superiority of our solution. Finally, among the peculiarities of our approach is the possibility to apply off-the-shelf DNA analysis techniques to study online users behaviors and to efficiently rely on a limited number of lightweight account characteristics.
SynchroTrap @cite_50 aims at detecting loosely synchronized behaviors for a broad range of social network applications. Time is an important dimension for SynchroTrap (thus marking a difference with the approach proposed here), since the methodology forms clusters on the basis of equal actions performed by online accounts within the same time interval.
@cite_50
2125490153 2012845506 919122619 2098897082
The success of online social networks has attracted a constant interest in attacking and exploiting them. Attackers usually control malicious accounts, including both fake and compromised real user accounts, to launch attack campaigns such as social spam, malware distribution, and online rating distortion. To defend against these attacks, we design and implement a malicious account detection system called SynchroTrap. We observe that malicious accounts usually perform loosely synchronized actions in a variety of social network context. Our system clusters user accounts according to the similarity of their actions and uncovers large groups of malicious accounts that act similarly at around the same time for a sustained period of time. We implement SynchroTrap as an incremental processing system on Hadoop and Giraph so that it can process the massive user activity data in a large online social network efficiently. We have deployed our system in five applications at Facebook and Instagram. SynchroTrap was able to unveil more than two million malicious accounts and 1156 large attack campaigns within one month. With increasing prevalence of mobile wireless devices with WiFi and Bluetooth capability, new applications that can make use of limited contact opportunities when the devices are physically close are emerging. Proximity-based social networking, and location specific dissemination of advertisements and events, are some such applications. Discovering such services is a challenging problem due to energy budget limitations, user mobility, and nonuniformity and the time-varying nature of energy budgets across users. It is important to rapidly discover such mobile services to make use of limited contact opportunities. To support such applications, we seek to design a localized discovery scheme that can minimize the expected contact latency between mobile phones with limited energy budgets. All the existing neighbor discovery schemes assume lack of any time synchronization. However, in practice sufficiently accurate time synchronization can be achieved with existing time synchronization techniques. We propose Recursive Binary Time Partitioning (RBTP), a scheme that determines how the devices should wake up and sleep to achieve minimal contact latency with other nearby devices. RBTP achieves provable performance bound and outperforms state-of-the-art asynchronous protocols for smartphones. When compared with the optimum scheme, the contact latency is shown to be within a factor of (9 8) in the expected case and 2 in the worst case. Given the retweeting activity for the posts of several Twitter users, how can we distinguish organic activity from spammy retweets by paid followers to boost a post’s appearance of popularity? More generally, given groups of observations, can we spot strange groups? Our main intuition is that organic behavior has more variability, while fraudulent behavior, like retweets by botnet members, is more synchronized. We refer to the detection of such synchronized observations as the Synchonization Fraud problem, and we study a specific instance of it, Retweet Fraud Detection, manifested in Twitter. Here, we propose: (A) ND-Sync, an efficient method for detecting group fraud, and (B) a set of carefully designed features for characterizing retweet threads. ND-Sync is effective in spotting retweet fraudsters, robust to different types of abnormal activity, and adaptable as it can easily incorporate additional features. Our method achieves a 97 accuracy on a real dataset of 12 million retweets crawled from Twitter. Synchronization is considered a particularly difficult task in wireless sensor networks due to its decentralized structure. Interestingly, synchrony has often been observed in networks of biological agents (e.g., synchronously flashing fireflies, or spiking of neurons). In this paper, we propose a bio-inspired network synchronization protocol for large scale sensor networks that emulates the simple strategies adopted by the biological agents. The strategy synchronizes pulsing devices that are led to emit their pulses periodically and simultaneously. The convergence to synchrony of our strategy follows from the theory of Mirollo and Strogatz, 1990, while the scalability is evident from the many examples existing in the natural world. When the nodes are within a single broadcast range, our key observation is that the dependence of the synchronization time on the number of nodes N is subject to a phase transition: for values of N beyond a specific threshold, the synchronization is nearly immediate; while for smaller N, the synchronization time decreases smoothly with respect to N. Interestingly, a tradeoff is observed between the total energy consumption and the time necessary to reach synchrony. We obtain an optimum operating point at the local minimum of the energy consumption curve that is associated to the phase transition phenomenon mentioned before. The proposed synchronization protocol is directly applied to the cooperative reach-back communications problem. The main advantages of the proposed method are its scalability and low complexity.