分享式Spam攻击的轻量级检测方案

doi:10.11959/j.issn.1000-436x.2015144

摘要/Abstract

摘要：

Spam攻击是针对社交网络最主要的攻击方式，分享式Spam攻击具有Spam内容的存储与传播分离的新特性，目前没有有效的检测方案。针对这一问题分析了其攻击过程和特征，利用分享式Spam攻击传播和存储的特征设计了轻量级迭代检测算法LIDA，通过目标筛选和内容检测2个步骤实现对分享式Spam的检测。同时，轻量级算法避免了传统算法对每个用户都做深度检测的问题，更具实用性。通过人人网的4次迭代实验，共检测到9 568个Spam账号、30 732个Spam相册以及2 626 780条Spam URL，表明所提的检测算法对于分享式Spam攻击是行之有效的。

关键词: 社交网络, 分享式Spam, ；Spam检测, 人人网

Abstract:

Spam is one of the most serious attacks against online social networks (OSN).Recently a new type of spam attack occurs,which named shared spam attack.The shared spam attack can separate the storage and dissemination of spam content,making the existing detection systems no longer effective.To address this problem,an empirical analysis of the process and properties of this new spam attack is performed.A novel lightweight iterative detection algorithm (LIDA) is proposed to detect spam accounts in OSN with these properties.LIDA contains two steps:target filter and content detection.It also noteworthy that LIDA is a lightweight algorithm to infer more spam accounts by exploiting spam accounts’ sharing instead of scanning or analyzing all accounts.Experimental results in RenRen,which has successfully detected 9 568 spam accounts,30 732 spam albums and 2 626 780 spam URL in four round iterations,indicate that LIDA is effective and efficiency in detecting shared spam accounts.

Key words: online social networks, Spam based on sharing, Spam detection, RenRen

吕少卿,范丹,张玉清. 分享式Spam攻击的轻量级检测方案[J]. 通信学报, 2015, 36(7): 80-91.

Shao-qing LV,Dan FAN,Yu-qing ZHANG. Lightweight detection system of shared spam attacks[J]. Journal on Communications, 2015, 36(7): 80-91.

图/表 16

图1

图2

图3

图4

表1

表2

图5

图6

图7

图8

图9

图10

表3

图11

表4

表5

参考文献 29

[1]	FaceBook[EB/OL]. . 2014.
[2]	RenRen[EB/OL]. . 2013.
[3]	MICHAEL F , ROY G , YUVAL E . Online social networks:threates and solutions[J]. IEEE Communications Surveys ＆ Tutorials, 2013,11(4): 1-19.
[4]	WANG A . Don’t follow me:spam detection in twitter[A]. International Conference on Security and Cryptography (SECRYPT)[C]. Athens,Greece, 2010. 142-151.
[5]	HARRIS . A Study of Social Networks Scams Interactive[R]. Public Relations Research, 2008.
[6]	EGELE M , STRINGHINI G , KRUEGEL C . COMPA:detecting compromised account on social networks[A]. Network ＆ Distributed System Security Symposium[C]. San Diego,CA,USA, 2013.
[7]	YANG Z , WILSON C , WANG X . Uncovering social network sybils in the wild[A]. Proceedings of the ACM SIGCOMM Conference on Internet Measurement[C]. Berlin,Germany, 2011. 259-268.
[8]	ZHU Y , WANG X , ZHONG E . Discovering spammers in social networks[A]. Proceedings of the Twenty-Sixth AAAI Conference on Artificial Intelligence[C]. Toronto,Canada, 2012. 171-177.
[9]	STRINGHINI G , KRUEGEL C , VIGNA G . Detecting spammers on social networks[A]. Annual Computer Security Applications Conference[C]. Austin,Texas,USA, 2010. 1-9.
[10]	THOMAS K , MCCOY D , GRIER C . Trafficking fraudulent accounts:the role of the underground market in twitter spam and abuse[A]. USENIX Security Conferences[C]. Washington D C,USA, 2013.
[11]	GAO H , HU J , WILSON C . Detecting and characterizing social spam campaigns[A]. Proceedings of the ACM SIGCOMM Conference on Internet Measurement[C]. New York,USA, 2010. 35-47.
[12]	LEE S , KIM J . WARNINGBIRD:detecting suspicious URLs in twitter stream[A]. Network ＆ Distributed System Security Symposium[C]. San Diego,California,USA. 2012.
[13]	THOMAS K , GRIER C , MA J . Design and evaluation of a real-time URL spam filtering service[A]. IEEE Symposium on Security ＆Privacy[C]. Oakland,California,USA, 2011. 447-462.
[14]	YANG C , HARKREADER R , GU G . Empirical evaluation and new design for fighting evolving twitter spammers[J]. IEEE Transactions on Information Forensics and Security, 2013,8(8): 1280-1293.
[15]	WANG G , KONOLIGE T , WILSON C . You are how you click:clickstream analysis for sybil detection[A]. USENIX Security Conferences[C]. Washington D C,USA, 2013. 241-256.
[16]	YANG C , HARKREADER R , ZHANG J . Analyzing spammer’s social networks for fun and profit[A]. Proceedings of the 21th International Conference on World Wide Web[C]. Lyon,France, 2012. 71-80.
[17]	GRIER C , THOMAS K , PAXSON V , et al. @spam:the underground on 140 characters or less[A]. Proceedings of the 17th ACM Conference on Computer and Communications Security[C]. Chicago,USA, 2010. 27-37.
[18]	LUPHER A , ENGLE C , XIN R . Detecting Spam on Social Networking Sites:Related Work[R]. University of California Berkeley, 2012.
[19]	FLORIAN K , STROHMAIER M . Short links under attack:geographical analysis of spam in a URL shortener network[A]. Proceedings of the 23rd ACM Conference on Hypertext and Social media[C]. Milwaukee,WI,USA, 2012. 83-88.
[20]	Google safe browsing[EB/OL]. . 2014.
[21]	DBL-the spamhaus project[EB/OL]. . 2014.
[22]	Wepawet[EB/OL]. . 2014.
[23]	LEE K , EOFF B , CAVERLEE J . Seven months with the devils:a long-term study of content polluters on twitter[A]. Proceedings of the Fifth International AAAI Conference on Weblogs and Social Media[C]. Barcelona,Spain, 2011. 185-192.
[24]	RenRen privacy statement[EB/OL]. . 2013.
[25]	RenRen search[EB/OL]. . 2013.
[26]	[EB/OL]. , 2014.
[27]	ZHANG J , PORRRAS P , ULLRICH J . Highly predictive blacklisting[A]. USENIX Security Conferences[C]. San Jose,CA,USA, 2008.
[28]	Spam and malware protection[EB/OL]. , 2014.
[29]	THOMAS K , GRIER C , PAXSON V . Suspended accounts in retrospect:an analysis of twitter spam[A]. Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference[C]. Berlin,Germany, 2011. 243-258.

迭代次数	获取相册数	Spam相册数	Spam相册比	新增Spam账号
1	1 389	909	65.44%	349
2	12 989	4 880	37.57%	1 709
3	23 473	12 225	52.08%	3 237
4	89 079	12 718	14.28%	4 273
总数	126 930	30 732	24.21%	9 568

判断依据	独立URL数（所占比例）	总URL数（所占比例）
最终跳转地址	670 564(71.32%)	1 616 438(59.64%)
域名判断	255 496(27.17%)	1 057 363(39.01%)
照片描述	9 241(0.98%)	24 313(0.90%)
手动确定	4 899(0.53%)	12 247(0.45%)
Spam URL	915 922(97.42%)	2 626 780(96.92%)
正常 URL	24 278(2.58%)	83 581(3.08%)
总数	940 200	2 710 361

类别	独立URL数（所占比例）	总URL数（所占比例）
Spam URL	845 751(92.34%)	1 795 548(68.36%)
正常URL	8 742(36.01%)	11 140(13.33%)

短网址域名	独立Spam URL数（所占比例）	总Spam URL数（所占比例）
url7.me	182 157(19.89%)	503 982(19.19%)
t.cn	167 667(18.31%)	272 568(10.38%)
bit.ly	92 927(10.15%)	115 847(4.41%)
sinaapp.com	48 411(5.29%)	145 619(5.54%)
dwz.cn	44 098(4.81%)	81 219(3.09%)
taourl.com	38 328(4.18%)	44 843(1.71%)
feiyiban.cn	27 665(3.02%)	101 933(3.88%)
126.am	27 586(3.01%)	45 724(1.74%)
url.cn	15 800(1.73%)	19 772(0.75%)
tinyurl.com	13 932(1.52%)	16 988(0.65%)

相关工作	检测方法	特征	分享式Spam	轻量级
文献[6]		用户发送消息特征	×	×
文献[7]		好友关系网络	×	×
文献[8]		用户的活动行为	×	×
文献[9]	基于行为	好友关系、文本特征	×	×
文献[10]		用户名命名规则、注册时行为	×	×
文献[14]		用户好友网络结构、语义相似性	×	√
文献[15]		用户鼠标点击行为	√	×
文献[11]		用户发送消息中URL	×	×
文献[12]		URL重定向链	×	×
	基于内容
文献[13]		URL的内容和行为、IP地址	×	×
LIDA		照片描述中URL	√	√
注：表中√表示是；×表示否。