The popularity and widespread usage of online social networks (OSN) have attracted cyber criminals who have used OSNs as a platform to spread malware. Among different types of malware in OSNs, Trojan is the most popular type with hundreds of attacks on OSN users in the past few years. Trojans infecting a user's computer have the ability to steal confidential information, install ransomware and infect other computers in the network. Therefore, it is important to understand propagation dynamics of Trojans in OSNs in order to detect, contain and remove them as early as possible. In this article, we present an analytical model to study propagation characteristics of Trojans and factors that impact their propagation in an online social network. The proposed model assumes all the topological characteristics of real online social networks. Moreover, the model takes into account attacking trends of modern Trojans, the role of anti-virus (AV) products, and security practices of OSN users and AV software providers. By taking into account these factors, the proposed model can accurately and realistically estimate the infection rate caused by a Trojan malware in an OSN as well as the recovery rate of the user population.
Existing works on modelling malware propagation in online social networks include @cite_13 @cite_29 and @cite_55 . Faghani and his collaborators @cite_13 @cite_29 modeled the propagation of cross-site-scripting (XSS) worms in OSNs. @cite_55 modeled the propagation of Trojans in the social network Twitter, which is represented by directed graphs due to one-directional (follower-followee) relationships. To the best of our knowledge, the analytical model we propose in this article is the first that characterizes the propagation of Trojans in social networks represented by undirected graphs such as Facebook, LinkedIn and Orkut.
@cite_55 @cite_29 @cite_13
1995698352 2055407442 1984156542 2289705509
With their blistering expansions in recent years, popular on-line social sites such as Twitter, Facebook and Bebo, have become some of the major news sources as well as the most effective channels for viral marketing nowadays. However, alongside these promising features comes the threat of misinformation propagation which can lead to undesirable effects, such as the widespread panic in the general public due to faulty swine flu tweets on Twitter in 2009. Due to the huge magnitude of online social network (OSN) users and the highly clustered structures commonly observed in these kinds of networks, it poses a substantial challenge to efficiently contain viral spread of misinformation in large-scale social networks. In this paper, we focus on how to limit viral propagation of misinformation in OSNs. Particularly, we study a set of problems, namely the β1T -- Node Protectors, which aims to find the smallest set of highly influential nodes whose decontamination with good information helps to contain the viral spread of misinformation, initiated from the set I, to a desired ratio (1 − β) in T time steps. In this family set, we analyze and present solutions including inapproximability result, greedy algorithms that provide better lower bounds on the number of selected nodes, and a community-based heuristic method for the Node Protector problems. To verify our suggested solutions, we conduct experiments on real world traces including NetHEPT, NetHEPT_WC and Facebook networks. Empirical results indicate that our methods are among the best ones for hinting out those important nodes in comparison with other available methods. Social Networks have rapidly become one of the most used Internet based applications. The structure and ease of information dissemination provides an opportunity for adversaries to use it for their own malicious purpose. In this paper we investigate a popular social network – Twitter as a malware propagation medium. We present a basic model for Twitter-based malware propagation using epidemic theory. Our analysis shows that even with a low degree of connectivity and a low probability of clicking links, Twitter and its structure can be exploited to infect many nodes. We present analytical models and simulation results that characterize the impacts of the following factors on the propagation of cross-site scripting (XSS) worms in online social networks (OSNs): 1) user behaviors, namely, the probability of visiting a friend's profile versus a stranger's; 2) the highly clustered structure of communities; and 3) community sizes. Our analyses and simulation results show that the clustered structure of a community and users' tendency to visit their friends more often than strangers help slow down the propagation of XSS worms in OSNs. We then present a study of selective monitoring schemes that are more resource efficient than the exhaustive checking approach used by the Facebook detection system which monitors every possible read and write operation of every user in the network. The studied selective monitoring schemes take advantage of the characteristics of OSNs such as the highly clustered structure and short average distance to select only a subset of strategically placed users to monitor, thus minimizing resource usage while maximizing the monitoring coverage. We present simulation results to show the effectiveness of the studied selective monitoring schemes for XSS worm detection. Information cascades on social networks, such as retweet cascades on Twitter, have been often viewed as an epidemiological process, with the associated notion of virality to capture popular cascades that spread across the network. The notion of structural virality or average path length has been posited as a measure of global spread. In this paper, we argue that this simple epidemiological view, though analytically compelling, is not the entire story. We first show empirically that the classical SIR diffusion process on the Twitter graph, even with the best possible distribution of infectiousness parameter, cannot explain the nature of observed retweet cascades on Twitter. More specifically, rather than spreading further from the source as the SIR model would predict, many cascades that have several retweets from direct followers, die out quickly beyond that. We show that our empirical observations can be reconciled if we take interests of users and tweets into account. In particular, we consider a model where users have multi-dimensional interests, and connect to other users based on similarity in interests. Tweets are correspondingly labeled with interests, and propagate only in the subgraph of interested users via the SIR process. In this model, interests can be either narrow or broad, with the narrowest interest corresponding to a star graph on the interested users, with the root being the source of the tweet, and the broadest interest spanning the whole graph. We show that if tweets are generated using such a mix of interests, coupled with a varying infectiousness parameter, then we can qualitatively explain our observation that cascades die out much more quickly than is predicted by the SIR model. In the same breath, this model also explains how cascades can have large size, but low "structural virality" or average path length.