DETECTING SPAMMERS ON SOCIAL NETWORKS

1. DETECTING SPAMMERS ON SOCIAL NETWORKS Network and Systems Security By , Vigya Sharma (2011MCS2564) FaisalAlam(2011MCS2608)

2. Introduction • Social Network contain huge amount of personal information. • This attracts not only legitimate users but also spammers. • Spammers are looking for ways to reach new victims with their unsolicited messages. • Market Survey reveals in 2008 , 53% of users of social networks have received at least 6 unwanted friend requests or messages.

3. Network of Trust • Social networks have unique characteristic: • Information access and interaction is based on trust. • Users share substantial personal information , access to which is regulated by network of trust. • No strong authentication mechanism are available. • It is easy to impersonate a user and sneak into person’s network of trust. • To gain popularity, users accept any friend request they receive, exposing personal information to unknown people. • Presence of spam profiles work like poison, killing user experience on social networks.

4. 45% of users on social networking sites , readily click on links posted by their “friend’s” account , even if they do not know that person in real life

5. Detecting Spam Profiles • Create a set of honey net accounts on major social networking sites. • Investigate how spammers are using social networks. • Examine the effectiveness of the counter measures taken by those sites to prevent spam. • Identify characteristics that allow us to detect spammers on our social networks. • Build tool to detect spammers.

6. Types of Spam Bots Classification of spam bots based on different activity levels and strategy to deliver spam

7. Displayer Bot • Do not pose spam messages . • Display spam contents on own profile page. • In order to view spam, victim has to manually visit the profile page of the bot. • It is least effective in terms of people reached.

8. Bragger Bot • Post messages to their own profiles. • As a result, the span message is distributed and shown on all victim feeds. • However, the spam is not shown on victim’s profile, when the page is visited by someone else.

9. Poster Bot • These send a direct message to each victim. • On Facebook, the message might be a post on the victim’s wall. • Unlike bragger, it can be viewed by victim’s friends, visiting her profile page.

10. Whisperer Bot • These send private messages to their victims. • Messages are addressed to a specific user. • Difference between Whisperer and Poster – • Here, the message is only visible to the user.

11. Spam Profile Detection Rules derived from machine learning techniques to classify spammers and legitimate users.

12. FF Ratio • Compares the number of friend requests that a user sends to the number of friends she has. • Since a bot is not a real person, only a fraction of profiles contacted would acknowledge a friend request. • The ratio friend requests : actual friends is large for spammers and low for regular users.

13. URL Ratio • Bots are likely to send URLs in messages to attract users to their web pages. • The ratio messages_containing_URLs : total_messagesis high for malicious users and low for legitimate users.

14. Message Similarity • Most bots send very similar messages, considering both message size and content, as well as the advertized sites. • The similarity pattern S is obtained by: • Where P is the set of possible message to message combinations among any 2 messages. p is a single pair. C(p) is a function calculating the number of words 2 messages share. • La = average length of messages posted by that user. • Lp is the number of message combinations.

15. Friend Choice • Attempts to detect whether a profile likely used a list of names to pick it’s friends or not. • F = Tn : Dn • Tnis the total number of names among the profile’s friends, and Dnis the number of distinct first names. • Legitimate profiles have friend choice values close to 1.

16. Messages Sent and Friend Number • Messages Sent : Number of messages sent by a profile. • Most spam bots send les than 20 messages. • Friend Number : Number of friends a profile has. • Profiles with hundreds of friends are less likely to be spammers than profile with few friends.

17. Honey Profiles • Profiles created to log traffic received from other users of the network. • Generate statistical data , regarding friend requests received , names , messages received. • They are called honey profiles due to their resemblance to the concept of honey pots.

18. Spam Campaign • It refers to multiple spam profiles that act under the coordination of a single spammer. • Most bots hide the real URL using tinyurl. • A campaign is considered to be successful if the bots belonging to it have a longer lifetime. • For this metric , we introduce the parameter Gc . where , • Md is the average number of messages sent per day. • Sd is the ratio of actual spam messages • Campaigns with Gc close to 1 have a long lifetime.

19. Conclusion and References • A study was collaborated with Twitter and correctly detected and deleted 15,857 spam profiles. • References : • Detecting Spammers on Social Networks , by : GianlucaStringhini , Christopher Kruegel & Giovanni Vigna.

20. Thank You