分享式Spam攻击的轻量级检测方案

doi:10.11959/j.issn.1000-436x.2015144

Abstract

Abstract:

Spam is one of the most serious attacks against online social networks (OSN).Recently a new type of spam attack occurs,which named shared spam attack.The shared spam attack can separate the storage and dissemination of spam content,making the existing detection systems no longer effective.To address this problem,an empirical analysis of the process and properties of this new spam attack is performed.A novel lightweight iterative detection algorithm (LIDA) is proposed to detect spam accounts in OSN with these properties.LIDA contains two steps:target filter and content detection.It also noteworthy that LIDA is a lightweight algorithm to infer more spam accounts by exploiting spam accounts’ sharing instead of scanning or analyzing all accounts.Experimental results in RenRen,which has successfully detected 9 568 spam accounts,30 732 spam albums and 2 626 780 spam URL in four round iterations,indicate that LIDA is effective and efficiency in detecting shared spam accounts.

Key words: online social networks, Spam based on sharing, Spam detection, RenRen

Shao-qing LV,Dan FAN,Yu-qing ZHANG. Lightweight detection system of shared spam attacks[J]. Journal on Communications, 2015, 36(7): 80-91.

Figures/Tables 16

References 29

[1]	FaceBook[EB/OL]. . 2014.
[2]	RenRen[EB/OL]. . 2013.
[3]	MICHAEL F , ROY G , YUVAL E . Online social networks:threates and solutions[J]. IEEE Communications Surveys ＆ Tutorials, 2013,11(4): 1-19.
[4]	WANG A . Don’t follow me:spam detection in twitter[A]. International Conference on Security and Cryptography (SECRYPT)[C]. Athens,Greece, 2010. 142-151.
[5]	HARRIS . A Study of Social Networks Scams Interactive[R]. Public Relations Research, 2008.
[6]	EGELE M , STRINGHINI G , KRUEGEL C . COMPA:detecting compromised account on social networks[A]. Network ＆ Distributed System Security Symposium[C]. San Diego,CA,USA, 2013.
[7]	YANG Z , WILSON C , WANG X . Uncovering social network sybils in the wild[A]. Proceedings of the ACM SIGCOMM Conference on Internet Measurement[C]. Berlin,Germany, 2011. 259-268.
[8]	ZHU Y , WANG X , ZHONG E . Discovering spammers in social networks[A]. Proceedings of the Twenty-Sixth AAAI Conference on Artificial Intelligence[C]. Toronto,Canada, 2012. 171-177.
[9]	STRINGHINI G , KRUEGEL C , VIGNA G . Detecting spammers on social networks[A]. Annual Computer Security Applications Conference[C]. Austin,Texas,USA, 2010. 1-9.
[10]	THOMAS K , MCCOY D , GRIER C . Trafficking fraudulent accounts:the role of the underground market in twitter spam and abuse[A]. USENIX Security Conferences[C]. Washington D C,USA, 2013.
[11]	GAO H , HU J , WILSON C . Detecting and characterizing social spam campaigns[A]. Proceedings of the ACM SIGCOMM Conference on Internet Measurement[C]. New York,USA, 2010. 35-47.
[12]	LEE S , KIM J . WARNINGBIRD:detecting suspicious URLs in twitter stream[A]. Network ＆ Distributed System Security Symposium[C]. San Diego,California,USA. 2012.
[13]	THOMAS K , GRIER C , MA J . Design and evaluation of a real-time URL spam filtering service[A]. IEEE Symposium on Security ＆Privacy[C]. Oakland,California,USA, 2011. 447-462.
[14]	YANG C , HARKREADER R , GU G . Empirical evaluation and new design for fighting evolving twitter spammers[J]. IEEE Transactions on Information Forensics and Security, 2013,8(8): 1280-1293.
[15]	WANG G , KONOLIGE T , WILSON C . You are how you click:clickstream analysis for sybil detection[A]. USENIX Security Conferences[C]. Washington D C,USA, 2013. 241-256.
[16]	YANG C , HARKREADER R , ZHANG J . Analyzing spammer’s social networks for fun and profit[A]. Proceedings of the 21th International Conference on World Wide Web[C]. Lyon,France, 2012. 71-80.
[17]	GRIER C , THOMAS K , PAXSON V , et al. @spam:the underground on 140 characters or less[A]. Proceedings of the 17th ACM Conference on Computer and Communications Security[C]. Chicago,USA, 2010. 27-37.
[18]	LUPHER A , ENGLE C , XIN R . Detecting Spam on Social Networking Sites:Related Work[R]. University of California Berkeley, 2012.
[19]	FLORIAN K , STROHMAIER M . Short links under attack:geographical analysis of spam in a URL shortener network[A]. Proceedings of the 23rd ACM Conference on Hypertext and Social media[C]. Milwaukee,WI,USA, 2012. 83-88.
[20]	Google safe browsing[EB/OL]. . 2014.
[21]	DBL-the spamhaus project[EB/OL]. . 2014.
[22]	Wepawet[EB/OL]. . 2014.
[23]	LEE K , EOFF B , CAVERLEE J . Seven months with the devils:a long-term study of content polluters on twitter[A]. Proceedings of the Fifth International AAAI Conference on Weblogs and Social Media[C]. Barcelona,Spain, 2011. 185-192.
[24]	RenRen privacy statement[EB/OL]. . 2013.
[25]	RenRen search[EB/OL]. . 2013.
[26]	[EB/OL]. , 2014.
[27]	ZHANG J , PORRRAS P , ULLRICH J . Highly predictive blacklisting[A]. USENIX Security Conferences[C]. San Jose,CA,USA, 2008.
[28]	Spam and malware protection[EB/OL]. , 2014.
[29]	THOMAS K , GRIER C , PAXSON V . Suspended accounts in retrospect:an analysis of twitter spam[A]. Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference[C]. Berlin,Germany, 2011. 243-258.

Metrics

Recommended 0

No Suggested Reading articles found!

迭代次数	获取相册数	Spam相册数	Spam相册比	新增Spam账号
1	1 389	909	65.44%	349
2	12 989	4 880	37.57%	1 709
3	23 473	12 225	52.08%	3 237
4	89 079	12 718	14.28%	4 273
总数	126 930	30 732	24.21%	9 568

判断依据	独立URL数（所占比例）	总URL数（所占比例）
最终跳转地址	670 564(71.32%)	1 616 438(59.64%)
域名判断	255 496(27.17%)	1 057 363(39.01%)
照片描述	9 241(0.98%)	24 313(0.90%)
手动确定	4 899(0.53%)	12 247(0.45%)
Spam URL	915 922(97.42%)	2 626 780(96.92%)
正常 URL	24 278(2.58%)	83 581(3.08%)
总数	940 200	2 710 361

类别	独立URL数（所占比例）	总URL数（所占比例）
Spam URL	845 751(92.34%)	1 795 548(68.36%)
正常URL	8 742(36.01%)	11 140(13.33%)

短网址域名	独立Spam URL数（所占比例）	总Spam URL数（所占比例）
url7.me	182 157(19.89%)	503 982(19.19%)
t.cn	167 667(18.31%)	272 568(10.38%)
bit.ly	92 927(10.15%)	115 847(4.41%)
sinaapp.com	48 411(5.29%)	145 619(5.54%)
dwz.cn	44 098(4.81%)	81 219(3.09%)
taourl.com	38 328(4.18%)	44 843(1.71%)
feiyiban.cn	27 665(3.02%)	101 933(3.88%)
126.am	27 586(3.01%)	45 724(1.74%)
url.cn	15 800(1.73%)	19 772(0.75%)
tinyurl.com	13 932(1.52%)	16 988(0.65%)

相关工作	检测方法	特征	分享式Spam	轻量级
文献[6]		用户发送消息特征	×	×
文献[7]		好友关系网络	×	×
文献[8]		用户的活动行为	×	×
文献[9]	基于行为	好友关系、文本特征	×	×
文献[10]		用户名命名规则、注册时行为	×	×
文献[14]		用户好友网络结构、语义相似性	×	√
文献[15]		用户鼠标点击行为	√	×
文献[11]		用户发送消息中URL	×	×
文献[12]		URL重定向链	×	×
	基于内容
文献[13]		URL的内容和行为、IP地址	×	×
LIDA		照片描述中URL	√	√
注：表中√表示是；×表示否。

Lightweight detection system of shared spam attacks

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 16

References 29

Related Articles 5

Metrics

Recommended 0

[1]	Xiaomeng WANG, Binxing FANG, Hongli ZHANG, Xing WANG. TSL:predicting popularity of Facebook content based on tie strength [J]. Journal on Communications, 2019, 40(10): 1-9.
[2]	Jian PENG,Tuntun WANG,Yu CHEN,Tang LIU,Wenzheng XU. User recommendation based on cross-platform online social networks [J]. Journal on Communications, 2018, 39(3): 147-158.
[3]	Yong QUAN,Yan JIA,Liang ZHANG,Zheng ZHU,Bin ZHOU,Binxing FANG. Performance analysis and testing of personal influence algorithm in online social networks [J]. Journal on Communications, 2018, 39(10): 1-10.
[4]	Shao-qing LYU,Yu-qing ZHANG,Dong-hang LIU,Guang-hua ZHANG. Detecting Spam albums in online social network [J]. Journal on Communications, 2016, 37(9): 75-91.
[5]	Fu CHEN,Chuang LIN,Chao XUE,Yue-mei XU,Kun MENG,Yi-han NI. Vector semantic computing method study for short sentence [J]. Journal on Communications, 2016, 37(2): 11-19.