Towards detecting anomalous user behavior in online social networks

Proceedings of the 23rd USENIX Security Symposium

Volumn , Issue , 2014, Pages 223-238

  Viswanath, Bimal ^a   Bashir, M Ahmad ^a   Crovella, Mark ^b   Guha, Saikat ^c   Gummadi, Krishna P ^a   Krishnamurthy, Balachander ^d   Mislove, Alan ^e  

^a MAX PLANCK INSTITUTE FOR SOFTWARE SYSTEMS   (Germany)

^b BOSTON UNIVERSITY   (United States)

^c MSR   (India)

^d AT AND T LABS RESEARCH   (United States)

^e NORTHEASTERN UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION; BEHAVIORAL RESEARCH; PRINCIPAL COMPONENT ANALYSIS;

FALSE POSITIVE RATES; GROUND TRUTH DATA; LOW-DIMENSIONAL SUBSPACE; NORMAL BEHAVIOR; ON-LINE SOCIAL NETWORKS; SEMI-SUPERVISED; UNSUPERVISED ANOMALY DETECTION; USER BEHAVIORS;

SOCIAL NETWORKING (ONLINE);

EID: 85029269023     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (67)

1. Apache Mahout. http://mahout.apache.org/.
2. Facebook Advertisement Value (BBC). http://www.bbc.co.uk/news/technology-18813237.
3. BEUTEL, A., XU, W., GURUSWAMI, V., PALOW, C., and FALOUTSOS, C. Copycatch: Stopping group attacks by spotting lockstep behavior in social networks. In Proc. of WWW (2013).
4. BHATTACHARYA, P., GHOSH, S., KULSHRESTHA, J., MON-DAL, M., ZAFAR, M. B., GANGULY, N., and GUMMADI, K. P. Deep Twitter Diving: Exploring Topical Groups in Microblogs at Scale. In Proc. of CSCW (2014).
5. CATTELL, R. B. The Scree Test For The Number Of Factors. Journal of Multivariate Behavioral Research 1, 2 (1966).
6. Click Farms (Washington Post). http://www.washingtonpost.com/blogs/wonkblog/wp/2014/01/06/click-farms-are-the-new-sweatshops.
7. Collusion Network Site #1. http://addmefast.com/.
8. Collusion Network Site #2. http://likesasap.com/.
9. CROUX, C., FILZMOSER, P., and OLIVEIRA, M. Algorithms for ProjectionPursuit Robust Principal Component Analysis. Journal of Chemometrics and Intelligent Laboratory Systems 87, 2 (2007).
10. DANEZIS, G., and MITTAL, P. SybilInfer: Detecting Sybil Nodes Using Social Networks. In Proc. of NDSS (2009).
11. DAVE, V., GUHA, S., and ZHANG, Y. Measuring and Fingerprinting Click-Spam in Ad Networks. In Proc. of SIGCOMM (2012).
12. DAVE, V., GUHA, S., and ZHANG, Y. ViceROI: Catching Click-Spam in Search Ad Networks. In Proc. of CCS (2013).
13. DING, Q., and KOLACZYK, E. D. A Compressed PCA Subspace Method for Anomaly Detection in High-Dimensional Data. IEEE Transactions on Information Theory 59, 11 (2013).
14. EGELE, M., STRINGHINI, G., KRUEGEL, C., and VIGNA, G. COMPA: Detecting Compromised Accounts on Social Networks. In Proc. of NDSS (2013).
15. Facebook Accounts Compromised. http://mashable.com/2013/12/04/hackers-facebook-twitter-gmail/.
16. Facebook Ads Fake Clicks. http://www.businessinsider.com/mans-600000-facebook-ad-disaster-2014-2.
17. Facebook Advertisement Value (Salon). http://www.salon.com/2014/02/14/facebooks_big_like_problem_major_money_and_major_scams/.
18. Facebook Black Market Service #1. http://fbviro.com.
19. Facebook Black Market Service #2. http://get-likes.com/facebook-likes-store/.
20. Facebook Black Market Service #3. http://www.buyfbservices.com.
21. Facebook Black Market Service #4. http://twittertechnology.com/facebook.
22. Facebook Black Market Service #5. http://www.pagelution.com/buy-facebook-fans.html.
23. Facebook Black Market Service #6. http://teamfollowpromo.com/facebooklikes.
24. Facebook COSN Group. https://www.facebook.com/groups/cosn2013.
25. Facebook Directory. https://www.facebook.com/directory/people/.
26. Facebook Graph Search. https://www.facebook.com/about/graphsearch.
27. Fake Likes on Facbook and Instagram. http://www.huffingtonpost.com/2013/08/16/fake-instagram-likes_n_3769247.html.
28. Facebook Malware Extension. http://bit.ly/1mIum7L.
29. Facebook Internet Explorer Malware. http://blogs.technet.com/b/mmpc/archive/2013/11/14/febipos-for-internet-explorer.aspx.
30. Facebook Page insights. https://www.facebook.com/help/336893449723054.
31. Facebook Quarterly Report (2013). http://investor.fb.com/releasedetail.cfm?ReleaseID=821954.
32. Facebook's estimate of fraction of undesirable accounts for 2013. http://investor.fb.com/.
33. Facebook SIGCOMM Group. https://www.facebook.com/groups/sigcomm/.
34. Facebook Timeline. https://www.facebook.com/about/timeline.
35. Febipos. A Malware. http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan:JS/Febipos.A.
36. GAO, H., HU, J., WILSON, C., LI, Z., CHEN, Y., and ZHAO, B. Y. Detecting and Characterizing Social Spam Campaigns. In Proc. of IMC (2010).
37. GRIER, C., THOMAS, K., PAXSON, V., and ZHANG, C. M. @spam: The Underground on 140 Characters or Less. In Proc. of CCS (2010).
38. HADDADI, H. Fighting Online Click-Fraud Using Bluff Ads. ACM SIGCOMM Computer Communications Review 40, 2 (2010).
39. HUANG, L., and JOSEPH., A. D., NELSON, B., RUBINSTEIN, B. I., and TYGAR, J. D. Adversarial Machine Learning. In Proc. of AISec (2011).
40. K. LEE and J. CAVERLEE and AND S. WEBB. Uncovering Social Spammers: Social Honeypots + Machine Learning. In Proc. of SIGIR (2010).
41. KOREN, Y. Collaborative filtering with temporal dynamics. In Proc. of KDD (2009).
42. KRISHNAMURTHY, B., and WILLS, C. E. On the Leakage of Personally Identifiable Information via Online Social Networks. ACM SIGCOMM Computer Communications Review 40, 1 (2010).
43. L2 Norm. http://mathworld.wolfram.com/L2-Norm.html.
44. LAKHINA, A., CROVELLA, M., and DIOT, C. Diagnosing Network-wide Traffic Anomalies. In Proc. of SIGCOMM (2004).
45. LI, X., BIAN, F., CROVELLA, M., DIOT, C., GOVINDAN, R., IANNACCONE, G., and LAKHINA, A. Detection and Identification of Network Anomalies Using Sketch Subspaces. In Proc. of IMC (2006).
46. LIBERTY, E. Simple and Deterministic Matrix Sketching. In Proc. of KDD (2013).
47. Zeus Botnet Cleanup (Microsoft). http://blogs.technet.com/b/microsoft_blog/archive/2014/06/02/microsoft-helps-fbi-in-gameover-zeus-botnet-cleanup.aspx.
48. MISLOVE, A., POST, A., GUMMADI, K. P., and DRUSCHEL, P. Ostra: Leverging Trust to Thwart Unwanted Communication. In Proc. of NSDI (2008).
49. MOHAISEN, A., YUN, A., and KIM, Y. Measuring the Mixing Time of Social Graphs. Tech. rep., University of Minnesota, 2010.
50. MOLAVI KAKHKI, A., KLIMAN-SILVER, C., and MISLOVE, A. Iolaus: Securing Online Content Rating Systems. In Proc. of WWW (2013).
51. MOTOYAMA, M., MCCOY, D., LEVCHENKO, K., SAVAGE, S., and VOELKER, G. M. Dirty Jobs: The Role of Freelance Labor in Web Service Abuse. In Proc. of USENIX Security (2011).
52. QUERCIA, D., and HAILES, S. Sybil Attacks Against Mobile Users: Friends and Foes to the Rescue. In Proc. of INFOCOM (2010).
53. RAHMAN, M. S., HUANG, T.-K., and MADHYASTHA., H. V., and FALOUTSOS, M. Efficient and Scalable Socware Detection in Online Social Networks. In Proc. of USENIX Security (2012).
54. RINGBERG, H., SOULE, A., REXFORD, J., and DIOT, C. Sensitivity of pca for traffic anomaly detection. In Proc. of SIGMET-RICS (2007).
55. RUBINSTEIN, B. I. P., NELSON, B., HUANG, L., JOSEPH, A. D., HON LAU, S., RAO, S., TAFT, N., and TYGAR, J. D. Stealthy Poisoning Attacks on PCA-based Anomaly Detectors. ACM SIGMETRICS Performance Evaluation Review 37, 2 (2009).
56. RUBINSTEIN, B. I. P., NELSON, B., HUANG, L., JOSEPH, A. D., LAU, S.-H., TAFT, N., and TYGAR, D. Compromising PCA-based Anomaly Detectors for Network-Wide Traffic. Tech. rep., EECS Department, University of California, Berkeley, 2008.
57. SHARMA, A., and PALIWAL, K. K. Fast Principal Component Analysis Using Fixed-point Algorithm. Journal of Pattern Recognition Letters 28, 10 (2007).
58. STRINGHINI, G., EGELE, M., KRUEGEL, C., and VIGNA, G. Poultry Markets: On the Underground Economy of Twitter Followers. In Proc. of WOSN (2012).
59. STRINGHINI, G., WANG, G., EGELE, M., KRUEGEL, C., VI-GNA, G., ZHENG, H., and ZHAO, B. Y. Follow the Green: Growth and Dynamics in Twitter Follower Markets. In Proc. of IMC (2013).
60. TAN, E., GUO, L., CHEN, S., ZHANG, X., and ZHAO, Y. E. UNIK: Unsupervised Social Network Spam Detection. In Proc. of CIKM (2013).
61. TRAN, N., LI, J., SUBRAMANIAN, L., and CHOW, S. S. Optimal Sybil-resilient Node Admission Control. In Proc. of INFO-COM (2011).
62. VISWANATH, B., POST, A., GUMMADI, K. P., and MISLOVE, A. An Analysis of Social Network-based Sybil Defenses. In Proc. of SIGCOMM (2010).
63. WANG, G., KONOLIGE, T., WILSON, C., WANG, X., ZHENG, H., and ZHAO, B. Y. You are How You Click: Clickstream Analysis for Sybil Detection. In Proc. of USENIX Security (2013).
64. XIE, Y., YU, F., ACHAN, K., PANIGRAHY, R., HULTEN, G., AND OSIPKOV, I. Spamming Botnets: Signatures and Characteristics. In Proc. of SIGCOMM (2008).
65. YANG, Z., WILSON, C., WANG, X., GAO, T., and ZHAO., B. Y., and DAI, Y. Uncovering Social Network Sybils In the Wild. In Proc. of IMC (2011).
66. YU, H., and GIBBONS., P. B., KAMINSKY, M., and XIAO, F. Sybil-Limit: A Near-optimal Social Network Defense Against Sybil Attacks. In Proc. of IEEE S & P (2008).
67. YU, H., KAMINSKY, M., GIBBONS, P. B., and FLAXMAN, A. SybilGuard: Defending Against Sybil Attacks via Social Networks. In Proc. of SIGCOMM (2006).