Compromised Social Network Accounts Detection and Incentives - - PowerPoint PPT Presentation

▶
compromised social
SMART_READER_LITE
LIVE PREVIEW

Compromised Social Network Accounts Detection and Incentives - - PowerPoint PPT Presentation

Jul 31, 2023 340 likes •530 views

Compromised Social Network Accounts Detection and Incentives Manuel Egele Dept. of Electrical & Computer Engineering Boston University megele@bu.edu As Seen on Twitter 2 Why Compromised Accounts? Historically, attackers create fake

slide-1
SLIDE 1

Compromised Social Network Accounts

Manuel Egele

  • Dept. of Electrical & Computer Engineering

Boston University megele@bu.edu

Detection and Incentives

slide-2
SLIDE 2

As Seen on Twitter …

2

slide-3
SLIDE 3

Why Compromised Accounts?

Historically, attackers create fake accounts

– Detection mechanisms proposed – Detection implemented by OSNs – Identified fake accounts can simply be removed

Attackers compromise legitimate accounts

– Leverage existing trust relationships – Fake account detection not applicable – Cannot be removed easily

  • Involves costly password-reset process

3

slide-4
SLIDE 4

COMPA: Overview

Detect compromised accounts by observing change in behavior

  • Statistical modeling

– Extract behavioral profile for accounts

  • Anomaly detection

– Compare new messages against observed behavior

  • Legitimate changes might seem anomalous

– Identify campaigns by grouping similar messages and look for similar compromises

4

slide-5
SLIDE 5

Statistical Modeling

  • Behavioral profile: collection of statistical models
  • Build statistical models of

features to model normal behavior

  • Features:

– Direct User Interaction – Message Topic – Links in Messages – Message Text (language) – Time (hour of day) – Message Source (application) – User Proximity

5

slide-6
SLIDE 6

COMPA: Overview

Step 1: Group similar messages

6

        Step 2: Match messages with behavioral profile

slide-7
SLIDE 7

Case Study

  • @foxnewspolitics
  • Anomaly scores:

– Time: 1.00 (1:24am EST, usually 8-10am EST) – Source: 0.94 (Web, commonly using TweetDeck) – Hashtag: 0.88 – Domain: 0.26 – Mention: 0.67 – Lang: 0.00

7

BREAKING NEWS: President @BarackObama assassinated, 2 gunshot wounds have proved too much. It's a sad 4th for #america. #obamadead RIP

slide-8
SLIDE 8

Evaluation: Data Sources

  • 10% of public Twitter activity (1.4 billion tweets)

– Individual tweets – No direct messages, no protected profile tweets – May 13, 2011 – Aug 12, 2011

  • 20,000 REST-API requests to Twitter / hour

– To retrieve message stream (timeline) – Max 200 tweets/request

  • 106 million Facebook posts

– Five geographical networks from 2009 (London, NY, LA, Monterey Bay, Santa Barbara)

8

slide-9
SLIDE 9

Evaluation

Text similarity:

– 374,920 groups identified – 9,362 compromised (343,229 accounts) – FP: 377 groups (4%), 12,382 accounts (3.6%)

Landing page similarity:

– 14,548 groups identified – 1,236 compromised (54,907 accounts) – FP: 72 groups (5.8%), 2,141 accounts (3.8%)

Facebook:

– 48,586 groups identified – 671 compromised (11,499 accounts) – FP: 22 groups (3.3%), 412 accounts (3.6%)

9

slide-10
SLIDE 10

Case Studies

Spam is not exclusively using URLs

Obama is giving FREE Gas Cards Worth $250! Call now-> 1 888-858-5783 (US Only)@@@

Similar spam applications are used

[ Add Seguidores ] 31/03/11 [ Add Seguidores ] 01-04

Spam links to 4 “Get More Follower” sites

– They use the same backend (i.e., one cannot sign up at two of the services simultaneously)

10

But, Why?

slide-11
SLIDE 11

Followers Are a Measure of Reputation

Building a network of followers is difficult!

11

slide-12
SLIDE 12

Pyramid Merchants

Offer a small number of followers for free Take control of the accounts of free subscribers Use free subscribers to advertise the market Use free subscribers to follow paying customers

Twitter’s ToS forbid users to participate in Follower Markets

12

slide-13
SLIDE 13

Active Twitter Follower Markets

Market $ for 10K Followers Pyramid? Newfollow.info $216 YES Bigfolo.com $91.99 YES Bigfollow.net $70 YES Intertwitter.com $65 NO Justfollowers.in $95 YES Twiends.com $169 NO Socialwombat.com $49 NO Devumi.com $64 NO Hitfollow.info $214 YES Plusfollower.info $214 YES Buyactivefans.com $40 NO

avg ~ US$ 107

13

slide-14
SLIDE 14

Market Sizes

Tweets that advertise the top 5 markets 10% total tweets, collected between January 16 and May 7 2013

Market Tweets Victims BigFollow 662,858 90,083 BigFolo 4,732,016 611,825 JustFollowers 302 257 NewFollow 77,865 38,341 InterTwitter Total 5,473,041 740,506

14

US$ 107 x 2,909 = US$ 311,263

slide-15
SLIDE 15

Summary

  • Incentives are important
  • Monetary gain is a popular incentive
  • Adversaries can make money from

compromised OSN accounts

15

slide-16
SLIDE 16

References

16

slide-17
SLIDE 17

QUESTIONS?

slide-18
SLIDE 18

END