Twitter is used for a variety of reasons, including informa- tion dissemination, marketing, political organizing and to spread propaganda, spamming, promotion, conversations, and so on. Characterizing these activities and categoriz- ing associated user generated content is a challenging task. We present a information-theoretic approach to classica- tion of user activity on Twitter. We focus on tweets that contain embedded URLs and study their collective 'retweet- ing' dynamics. We identify two features, time-interval and user entropy, which we use to classify retweeting activity. We achieve good separation of dierent activities using just these two features and are able to categorize content based on the collective user response it generates. We have identi- ed ve distinct categories of retweeting activity on Twitter: automatic robotic activity, newsworthy information dissem- ination, advertising and promotion, campaigns, and para- sitic advertisement. In the course of our investigations, we have shown how Twitter can be exploited for promotional and spam-like activities. The content-independent, entropy- based activity classication method is computationally e- cient, scalable and robust to sampling and missing data. It has many applications, including automatic spam-detection, trend identication, trust management, user-modeling, so- cial search and content classication on online social media.
In this paper, we focus on characterizing spamming botnets by leveraging both spam payload and spam server traffic properties. Towards this goal, we developed a spam signature generation framework called AutoRE to detect botnet-based spam emails and botnet membership. AutoRE does not require pre-classified training data or white lists. Moreover, it outputs high quality regular expression signatures that can detect botnet spam with a low false positive rate. Using a three-month sample of emails from Hotmail, AutoRE successfully identified 7,721 botnet-based spam campaigns together with 340,050 unique botnet host IP addresses. Our in-depth analysis of the identified botnets revealed several interesting findings regarding the degree of email obfuscation, properties of botnet IP addresses, sending patterns, and their correlation with network scanning traffic. We believe these observations are useful information in the design of botnet detection schemes.