NetDER: An Architecture for Reasoning About Malicious Behavior

Karbala International Journal of Modern Science, 2020

Nowadays, Twitter has become one of the fastest-growing Online Social Networks (OSNs) for data sharing frameworks and microblogging. It attracts millions of users worldwide where subscribers communicate with each through posts and messages known as "tweets". The open structure and behaviour of Twitter cause it to be vulnerable to attacks from fake accounts and a large number of automated software, known as 'bots'. Bots are regarded to be malicious as they send spam to users of social networks over the internet. Data security and privacy are among the most critical issues of social network users, as the protection and fulfilment of these requirements strengthen the network's interest and, ultimately, its credibility. To overcome these issues, we need to build an efficient model to detect and classify fake twitter accounts. This paper presents a new approach with dual functions, namely to identify and classify the twitter bots based on ontological engineering and Semantic Web Rule Language (SWRL) rules. Web Ontology Language (OWL), Semantic Web Rule Language (SWRL) rules, and reasoners are deployed to inductively learn the rules that distinguish a fake account (bot) from a real one, as well as to classify fake accounts into fake followers or spam bot. Our approach could properly identify the false account with an accuracy of (97%) in the first stage, after which these fake accounts were classified into spam or fake follower bots with an accuracy rate of (94.9%). Furthermore, it has been found that he ontology classifier is a more interpretable model that offers straightforward and human-interpretable decision rules, as compared to other machine learning classifiers.

As social networking sites such as Facebook and Twitter are becoming increasingly popular, a growing number of malicious attacks, such as phishing and malware, are exploiting them. Among these attacks, social botnets have sophisticated infrastructure that leverages compromised users accounts, known as bots, to automate the creation of new social networking accounts for spamming and malware propagation. Traditional defense mechanisms are often passive and reactive to non-zero-day attacks. In this paper, we adopt a proactive approach for enhancing security in social networks by infiltrating botnets with honeybots. We propose an integrated system named SODEXO which can be interfaced with social networking sites for creating deceptive honeybots and leveraging them for gaining information from botnets. We establish a Stackelberg game framework to capture strategic interactions between honeybots and botnets, and use quantitative methods to understand the tradeoffs of honeybots for their d...

International Journal of Intelligent Engineering and Systems, 2021

One of the most popular social media platforms, Twitter is used by millions of people to share information, broadcast tweets, and follow other users. Twitter is an open application programming interface and thus vulnerable to attack from fake accounts, which are primarily created for advertisement and marketing, defamation of an individual, consumer data acquisition, increase fake blog or website traffic, share disinformation, online fraud, and control. Fake accounts are harmful to both users and service providers, and thus recognizing and filtering out such content on social media is essential. This study presents a new approach to detect fake Twitter accounts using ontology and Semantic Web Rule Language (SWRL) rules. SWRL rules-based reasoner is utilized under predefined rules to infer whether the profile is trust or fake. This approach achieves a high detection accuracy of 97%. Furthermore, ontology classifier is an interpretable model that offers straightforward and human-inter...

Electronics, 2020

Online social network (OSN) users are increasingly interacting with each other via articles, comments, and responses. When access control mechanisms are weak or absent, OSNs are perceived by attackers as rich environments for influencing public opinions via fake news posts or influencing commercial transactions via practices such as phishing. This has led to a body of research looking at potential ways to predict OSN user behavior using social science concepts such as conformity and the bandwagon effect. In this paper, we address the question of how social recommendation systems affect the occurrence of malicious URLs on Facebook, based on the assumption that there are no differences among recommendation systems in terms of delivering either legitimate or harmful information to users. Next, we use temporal features to build a prediction framework with >75% accuracy to predict increases in certain user group behaviors. Our effort involves the demarcation of URL classes, from malic...

New Security Paradigms Workshop 2020, 2020

This paper presents TrollHunter, an automated reasoning mechanism we used to hunt for trolls on Twitter during the COVID-19 pandemic in 2020. Trolls, poised to disrupt the online discourse and spread disinformation, quickly seized the absence of a credible response to COVID-19 and created a COVID-19 infodemic by promulgating dubious content on Twitter. To counter the COVID-19 infodemic, the TrollHunter leverages a unique linguistic analysis of a multi-dimensional set of Twitter content features to detect whether or not a tweet was meant to troll. TrollHunter achieved 98.5% accuracy, 75.4% precision and 69.8% recall over a dataset of 1.3 million tweets. Without a final resolution of the pandemic in sight, it is unlikely that the trolls will go away, although they might be forced to evade automated hunting. To explore the plausibility of this strategy, we developed and tested an adversarial machine learning mechanism called TrollHunter-Evader. TrollHunter-Evader employs a Test Time Evasion (TTE) approach in a combination with a Markov chain-based mechanism to recycle originally trolling tweets. The recycled tweets were able to achieve a remarkable 40% decrease in the TrollHunter's ability to correctly identify trolling tweets. Because the COVID-19 infodemic could have a harmful impact on the COVID-19 pandemic, we provide an elaborate discussion about the implications of employing adversarial machine learning to evade Twitter troll hunts. CCS CONCEPTS • Security and privacy → Social network security and privacy; Malware and its mitigation; • Computing methodologies → Dynamic programming for Markov decision processes;

Communications in Computer and Information Science, 2019

Online Social Networks (OSNs) have fundamentally and permanently altered the arena of digital and classical crime. Recently, law enforcement agencies (LEAs) have been using OSNs as a data source to collect Open Source Intelligence for fighting and preventing crime. However, most existing technological developments for LEAs to fight and prevent crime rely on conventional database technology, which poses problems. As social network usage is increasing rapidly, storing and querying data for information retrieval is critical because of the characteristics of social networks, such as unstructured nature, high volumes, velocity, and data interconnectivity. This paper presents a knowledge graph-based framework, an outline of a framework designed to support crime investigators solve and prevent crime, from data collection to inferring digital evidence admissible in court. The main component of the proposed framework is a hybrid ontology linked to a graph database, which provides LEAs with the possibility to process unstructured data and identify hidden patterns and relationships in the interconnected data of OSNs.

From a petabyte era of today, the world is moving towards an Exabyte era aided by a digital tsunami that is sweeping the virtual world. The analysis of big data is going to be one of the topmost challenges to computer scientists and engineers. Within the world of big data, lies the smaller world of social networks which is going to outpace all other means of generation of digital data. Deriving information from this ocean of data with a purpose of identifying events caused by social triggers and thereafter modeling the propagation of these events is one of the high priority research areas in social network analysis. The recent events which the country witnessed involving the mass migration of northeastern Indians from Bangalore was spread primarily with the aid of social media. Identifying the triggers leading to such massive events would allow us to predict the onset, and subsequently the scale and pace, of such events in order for agencies to take appropriate measures. The study of the events leading to the generation of large social cascades are important in the field of security. By being able to understand the nature of these events by means of analyzing the various social triggers which led to its cascade, we will be able to contain its further spread.

—A major challenge in cyber-threat analysis is combining information from different sources to find the person or the group responsible for the cyber-attack. It is one of the most important technical and policy challenges in cyber-security. The lack of ground truth for an individual responsible for an attack has limited previous studies. In this paper, we take a first step towards overcoming this limitation by building a dataset from the capture-the-flag event held at DEFCON, and propose an argumentation model based on a formal reasoning framework called DeLP (Defeasible Logic Programming) designed to aid an analyst in attributing a cyber-attack. We build models from latent variables to reduce the search space of culprits (attackers), and show that this reduction significantly improves the performance of classification-based approaches from 37% to 62% in identifying the attacker.

Spam detection and destroying spamming activities has been a major research area of interest. In detecting the spam on social networks has been a major breakthrough in research field. Over the last few years, online social networks (OSNs), such as Facebook, Twitter and Sina Weibo, have experienced exponential growth in both profile registrations and social interactions. These networks allow people to share different information ranging from news, photos, videos, feelings, personal information or research activities. The rapid growth of OSNs has triggered a dramatic rise in malicious activities including spamming, fake accounts creation, phishing, and malware distribution. However, developing an efficient detection system that can identify malicious accounts, as well as their suspicious behaviors on the social networks, has been quite challenging. Researchers have proposed a number of features and methods to detect malicious accounts and spam activities. This paper presents a systematic mapping review of related studies that deal with detection of spam and identifying the root cause of spam and destroying spam activities on social networking sites. The mapping review focuses on four main categories, which include detection of spam accounts,fake accounts, compromised accounts, and phishing. To group the studies, the pragmatic approach of the different features and methods used in the literature to identify malicious spam and their behaviors are proposed. The review considered only social networking sites and excluded studies such as email spam detection. The significance of proposed features and methods, as well as their limitations, are analyzed. Key issues and challenges that require substantial research efforts are discussed. In conclusion, the paper identifies the important future research areas with the aim of advancing the development of scalable malicious spam and destroying the potential target of spam on social networks.

Efficient and sensitive monitoring of social networks has become increasingly important for criminal investigations and crime prevention during the last years. However, with the growing amount of data and increasing complexity to be considered, monitoring tasks are difficult to handle, up to a point where manual observation is infeasible in most cases and, thus, automated systems are very much needed. In this paper, a system of adaptive agents is proposed, which aims at monitoring publicly accessible parts of a given social network for malign actions, such as propaganda, hate speeches or other malicious posts and comments made by groups or individuals. Subsequently, some of these agents try to gain access to crime relevant information exchanged in closed environments said individuals or groups are potentially part of. The presented monitoring and investigation processes are implemented by mimicking central aspects of the human immune system. The monitoring processes are realized by ...