Detecting Malicious Users in Social Network via Collaborative Filtering

As social networking sites have risen in popularity, cyber-criminals started to exploit these sites to spread malwares and to carry out scams. Previous works has extensively studied the use of fake accounts that attackers set up to distribute spam messages (mostly messages that contain links to scam pages or drive-by download sites). Fake accounts typically exhibit highly anomalous behavior, and hence, are relatively easy to detect. As a response, attackers have started to compromise and abuse legitimate accounts. In this paper, we present a novel approach to detect malicious user's accounts in social networks. Our approach uses a collaborative filtering algorithm for detecting and identifies accounts that experience a sudden change in behavior. Since behavior changes can also be due to benign reasons (e.g., a user could switch her preferred client application or post updates at an unusual time), it is necessary to derive a way to distinguish between malicious and legitimate changes. To this end, we look for groups of accounts that all experience similar changes within a short period of time, assuming that these changes are the result of a malicious campaign that is unfolding. We developed a tool, called ABCF (Approach based on collaborative filtering). ABCF was able to identify malicious and fake accounts in online social networks.