Upload
jadon
View
45
Download
0
Embed Size (px)
DESCRIPTION
Twitter Games: How Successful Spammers Pick Targets. Vasumathi Sridharan , Vaibhav Shankar, Minaxi Gupta School of Informatics and Computing, Indiana University ACSAC2012. Introduction - PowerPoint PPT Presentation
Citation preview
Twitter Games: How Successful Spammers Pick TargetsVasumathi Sridharan, Vaibhav Shankar, Minaxi GuptaSchool of Informatics and Computing, Indiana University ACSAC2012
OUTLINE
• Introduction- DATA COLLECTION- TWEET TYPES
• STRATEGIES FOR PICKING TARGET• DISCUSSION- Posting methodology- Unbinned Spam Profiles- Gathering followers
• RELATE WORK• CONCLUSION
Introduction• Email spam has been a problem for decades• As email spam filtering programs have improved, with
many claiming 99% or higher accuracies• Spammers have looked for other avenues
• Online social networks (OSNs)
OSN: TWITTERWHY Twitter ?- Twitter alone boasted 140 million users as of March 2012 [20]- Fighting spam on OSNs requires new types of filtering techniques
• New topic of spam on OSNs (Classifiers) we do not know how spammers pick their targets
DATA COLLECTION• Twitter’s streaming API (collect tweets)(samples)• November 2011• 19,991,050 tweets / 7,078,643 profiles
• we visited http://www.twitter.com/<username>• looked for suspended profiles (SPAM?)• 82274 suspended profiles
http://www.twitter.com/<username>82274 suspended profiles
DATA COLLECTION
• Eliminated languages other than English82274 -> 53083 (suspended profiles)
• 10 tweets within five days - successful spam profiles (14230)- unsuccessful spam profiles
• 70% of unsuccessful spam profiles and 15% of successful spam profiles get suspended on the first day
• [16] 77% of spam profiles were suspended on the first day and 92% within three days>
[16] Thomas, K., Grier, C., Song, D., and Paxson, V. Suspended accounts in retrospect: an analysis of twitter spam. In ACM/USENIX Internet Measurement Conference (IMC) (2011)
TWEET TYPES• regular tweetAttack : Sender’s follower• reply tweetAttack : anyone• mention tweetAttack : anyone• RetweetAttack : Sender’s follower
1. Regular Tweets: Successful spam > Unsuccessful spam2. Replies Tweets :Successful spam < Unsuccessful spamTwitter is known to suspend accounts which send large numbers of replies or mentions [19]
3. Mention Tweets: Successful, Unsuccessful : 1/5 ,1/4Thomas et al. a year ago [16] found that 52% of spam profiles made use of mention tweets.
we conclude that Twitter spammers have evolved their strategies in the last one year
• We find that over 3/4 of successful spam profiles exclusively used only one type of tweet
• Spammers vs Other-user
3/4 2/3 14%
STRATEGIES FOR PICKING TARGET
• 1.Spamming Ones Own Followers• 2.Spamming Followers of Popular Profiles• 3.Spamming based on Keywords in Tweets• 4.Trending Topics Hijacking• 5.Targeting Own Followers by Reweets
Spamming Ones Own Followers
Nearly 40% of unsuccessful spam profiles have zero followers and a total of 2/3 (66%) have less than 10.
Thomas et al. noted in their work that 89% of spam profiles have less than 10 followers. (1 year before)
1/3 of successful spamprofiles have over a 100 followers
spammers become smarter
• 14230 profiles >> ten regular tweets with link >> 7704>> 80% Url same Domain >> 6630
• 6630 <> 559 different domains- t.co (1822) - Amazon.com (1741) Affiliate ID
Amazon.com
All profiles using the same affiliate ID were clearly part of the same campaign.Profiles across multiple IDs belonged to a spam campaign
Top five
Spamming Followers of Popular Profiles
• Ex. Basketball lovers , <Target Michael Jordan>• Reply or Mention tweets• ( >4 user receive same spam & 50% follow same person )
• 14230 >> reply or mention >> 4086• >> 877 (26)
Spamming based on Keywords in Tweets• Spammers can also pick their targets based on the contentof tweets from Twitter users.• ex: search “bumbler” “justinbieber”• Reply or Mention tweets(TF-IDF[8] 7 million words(spam tweets) -> 50K words)
• 1004 (1)(150)Spam reply tweet:Here ip5 0rz.tw/ab
source tweet:Wow ip5~
Trending Topics Hijacking• Hashtag (圖 ) • Ex. #bumbler
• Spammers have been known to hijack trending topics to increase the visibility of their spam campaigns [16]
• Various types of tweets (#iphone5)• 4327 (spam,#) >> top 200 hashtag >> 1043 (523)(14)(3)
Targeting Own Followers by Reweets• Reweets• 1230 used retweets• 1230 >> 10 tweets with url >> 28• 26 retweeting from omgwire (promoting)
Overall 5 methods 8805 / 14230 (61.9%)
• DISCUSSION
- Posting methodology- Unbinned Spam Profiles- Gathering followers
Posting methodology
Twitterfeed : sucessful spammer tweets 2/3Web : profiles
Others
*organic profiles use several different apps,where as spammers have fewer dedicated apps.
92% 80% 60%
Unbinned Spam Profiles
• Overall 5 methods 8805 / 14230 (61.9%)• 10 url tweets , 80% same domain (5 url , 50%) • 61.9 % >> 72%
• TweetAdder, based on their geographical location and language
• Not spamer (ex. violence)
Gathering followers
• 1. communities (encourage following back)#InstantFollowBack(#IFB)
• 2. Buy
fiverr
RELATE WORK• YOUTUBE [2] video spam on Youtube and employ machine learningtechniques to identify spammers on YouTube
• FaceBook[5] involves detecting and characterizing spamcampaigns on Facebook.
youtube
CONCLUSION
• We analyzed strategies of successful Twitter spammers• Particularly as they relate to picking spam target
• The spammers themselves evolved in a mere mattter of one year(Thomas [16])
• Need more data
End
• THANKS