1. Network and Systems Security By, Vigya Sharma (2011MCS2564) FaisalAlam(2011MCS2608) DETECTING SPAMMERS ON SOCIAL NETWORKS

2. Introduction Social Network contain huge amount of personal information. This attracts not only legitimate users but also spammers. Spammers are looking for ways to reach new victims with their unsolicited messages. Market Survey reveals in 2008, 53% of users of social networks have received at least 6 unwanted friend requests or messages.

3. Network of Trust Social networks have unique characteristic: Information access and interaction is based on trust. Users share substantial personal information, access to which is regulated by network of trust. No strong authentication mechanism are available. It is easy to impersonate a user and sneak into person’s network of trust. To gain popularity, users accept any friend request they receive, exposing personal information to unknown people. Presence of spam profiles work like poison, killing user experience on social networks.

4. 45% of users on social networking sites, readily click on links posted by their “friend’s” account, even if they do not know that person in real life

5. Detecting Spam Profiles Create a set of honey net accounts on major social networking sites. Investigate how spammers are using social networks. Examine the effectiveness of the counter measures taken by those sites to prevent spam. Identify characteristics that allow us to detect spammers on our social networks. Build tool to detect spammers.

6. Types of Spam Bots Classification of spam bots based on different activity levels and strategy to deliver spam

7. Displayer Bot Do not pose spam messages. Display spam contents on own profile page. In order to view spam, victim has to manually visit the profile page of the bot. It is least effective in terms of people reached.

8. Bragger Bot Post messages to their own profiles. As a result, the span message is distributed and shown on all victim feeds. However, the spam is not shown on victim’s profile, when the page is visited by someone else.

9. Poster Bot These send a direct message to each victim. On Facebook, the message might be a post on the victim’s wall. Unlike bragger, it can be viewed by victim’s friends, visiting her profile page.

10. Whisperer Bot These send private messages to their victims. Messages are addressed to a specific user. Difference between Whisperer and Poster – Here, the message is only visible to the user.

11. Spam Profile Detection Rules derived from machine learning techniques to classify spammers and legitimate users.

12. FF Ratio Compares the number of friend requests that a user sends to the number of friends she has. Since a bot is not a real person, only a fraction of profiles contacted would acknowledge a friend request. The ratio friend requests : actual friends is large for spammers and low for regular users.

13. URL Ratio Bots are likely to send URLs in messages to attract users to their web pages. The ratio messages_containing_URLs : total_messages is high for malicious users and low for legitimate users.

14. Message Similarity Most bots send very similar messages, considering both message size and content, as well as the advertized sites. The similarity pattern S is obtained by:  Where P is the set of possible message to message combinations among any 2 messages. p is a single pair. C(p) is a function calculating the number of words 2 messages share.  La = average length of messages posted by that user.  Lp is the number of message combinations.

15. Friend Choice Attempts to detect whether a profile likely used a list of names to pick it’s friends or not. F = T n : D n T n is the total number of names among the profile’s friends, and D n is the number of distinct first names. Legitimate profiles have friend choice values close to 1.

16. Messages Sent and Friend Number Messages Sent : Number of messages sent by a profile. Most spam bots send les than 20 messages. Friend Number : Number of friends a profile has. Profiles with hundreds of friends are less likely to be spammers than profile with few friends.

17. Honey Profiles Profiles created to log traffic received from other users of the network. Generate statistical data, regarding friend requests received, names, messages received. They are called honey profiles due to their resemblance to the concept of honey pots.

18. Spam Campaign It refers to multiple spam profiles that act under the coordination of a single spammer. Most bots hide the real URL using tinyurl. A campaign is considered to be successful if the bots belonging to it have a longer lifetime. For this metric, we introduce the parameter G c. where,  M d is the average number of messages sent per day.  S d is the ratio of actual spam messages Campaigns with G c close to 1 have a long lifetime.

19. Conclusion and References A study was collaborated with Twitter and correctly detected and deleted 15,857 spam profiles. References :  Detecting Spammers on Social Networks, by : Gianluca Stringhini, Christopher Kruegel & Giovanni Vigna.

20. Thank You