Identification of Sybil Communities Generating Context-Aware Spam on Online Social Networks

  • Faraz Ahmed
  • Muhammad Abulaish
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7808)


This paper presents a hybrid approach to identify coordinated spam or malware attacks carried out using sybil accounts on online social networks. It also presents an online social network data collection methodology, with a special focus on Facebook social network. The pages crawled from Facebook network are grouped according to users’ interests and analyzed to retrieve users’ profiles from each of them. As a result, based on the users’ page-likes behavior, a total number of six groups has been identified. Each group is treated separately and modeled using a graph structure, termed as profile graph, in which a node represents a profile and a weighted edge connecting a pair of profiles represents the degree of their behavior similarity. Behavior similarity is calculated as a function of common shared links, common page-likes, and cosine similarity of the posts, and used to determine weights of the edges of the profile graph. Louvain’s community detection algorithm is applied on the profile graphs to identify various communities. Finally, a set of statistical features identified in one of our previous works is used classify the obtained communities either as malicious or benign. The experimental results on a real dataset show that profiles belonging to a malicious community have high closeness-centrality representing high behavioral similarity, whereas those of a benign community have low closeness-centrality.


Social network analysis social network security sybil community detection 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Boshmaf, Y., Muslukhov, I., Beznosov, K., Ripeanu, M.: Key challenges in defending against malicious socialbots. In: Proceedings of the 5th USENIX Conference on Large-scale Exploits and Emergent Threats, LEET, vol. 12 (2012)Google Scholar
  2. 2.
    Nagaraja, S., Houmansadr, A., Piyawongwisal, P., Singh, V., Agarwal, P., Borisov, N.: Stegobot: A covert social network botnet. In: Filler, T., Pevný, T., Craver, S., Ker, A. (eds.) IH 2011. LNCS, vol. 6958, pp. 299–313. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  3. 3.
    Thomas, K., Nicol, D.: The koobface botnet and the rise of social malware. In: IEEE 2010 5th International Conference on Malicious and Unwanted Software, MALWARE, pp. 63–70 (2010)Google Scholar
  4. 4.
    Yu, H., Kaminsky, M., Gibbons, P., Flaxman, A.: Sybilguard: defending against sybil attacks via social networks. ACM SIGCOMM Computer Communication Review 36, 267–278 (2006)CrossRefGoogle Scholar
  5. 5.
    Boyd, S., Ghosh, A., Prabhakar, B., Shah, D.: Gossip algorithms: Design, analysis and applications. In: Proceedings IEEE 24th Annual Joint Conference of the IEEE Computer and Communications Societies, INFOCOM 2005, vol. 3, pp. 1653–1664. IEEE (2005)Google Scholar
  6. 6.
    Danezis, G., Lesniewski-Laas, C., Frans Kaashoek, M., Anderson, R.: Sybil-resistant DHT routing. In: De Capitani di Vimercati, S., Syverson, P.F., Gollmann, D. (eds.) ESORICS 2005. LNCS, vol. 3679, pp. 305–318. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  7. 7.
    Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B., Dai, Y.: Uncovering social network sybils in the wild. In: Conference on Internet Measurement (2011)Google Scholar
  8. 8.
    Gao, H., Hu, J., Wilson, C., Li, Z., Chen, Y., Zhao, B.: Detecting and characterizing social spam campaigns. In: Proceedings of the 10th Annual Conference on Internet Measurement, pp. 35–47. ACM (2010)Google Scholar
  9. 9.
    Lee, K., Caverlee, J., Cheng, Z., Sui, D.: Content-driven detection of campaigns in social media (2011)Google Scholar
  10. 10.
    Jin, X., Lin, C., Luo, J., Han, J.: A data mining-based spam detection system for social media networks. Proceedings of the VLDB Endowment 4(12) (2011)Google Scholar
  11. 11.
    Stringhini, G., Kruegel, C., Vigna, G.: Detecting spammers on social networks. In: Proceedings of the 26th Annual Computer Security Applications Conference, pp. 1–9. ACM (2010)Google Scholar
  12. 12.
    Lee, K., Eoff, B., Caverlee, J.: Seven months with the devils: A long-term study of content polluters on twitter. In: Int’l AAAI Conference on Weblogs and Social Media, ICWSM (2011)Google Scholar
  13. 13.
    Yang, C., Harkreader, R.C., Gu, G.: Die free or live hard? Empirical evaluation and new design for fighting evolving twitter spammers. In: Sommer, R., Balzarotti, D., Maier, G. (eds.) RAID 2011. LNCS, vol. 6961, pp. 318–337. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  14. 14.
    Yu, H., Gibbons, P., Kaminsky, M., Xiao, F.: Sybillimit: A near-optimal social network defense against sybil attacks. In: IEEE Symposium on Security and Privacy, SP 2008, pp. 3–17. IEEE (2008)Google Scholar
  15. 15.
    Danezis, G., Mittal, P.: Sybilinfer: Detecting sybil nodes using social networks. NDSS (2009)Google Scholar
  16. 16.
    Tran, N., Min, B., Li, J., Subramanian, L.: Sybil-resilient online content voting. In: Proceedings of the 6th USENIX Symposium on Networked Systems Design and Implementation, pp. 15–28. USENIX Association (2009)Google Scholar
  17. 17.
    Cao, Q., Sirivianos, M., Yang, X., Pregueiro, T.: Aiding the detection of fake accounts in large scale social online services. Technical Report (2011),
  18. 18.
    Wang, G., Mohanlal, M., Wilson, C., Wang, X., Metzger, M., Zheng, H., Zhao, B.: Social turing tests: Crowdsourcing sybil detection. Arxiv preprint arXiv:1205.3856 (2012)Google Scholar
  19. 19.
    Thomas, K., Grier, C., Ma, J., Paxson, V., Song, D.: Design and evaluation of a real-time url spam filtering service. In: IEEE Symposium on Security and Privacy (2011)Google Scholar
  20. 20.
    McCord, M., Chuah, M.: Spam detection on twitter using traditional classifiers. In: Calero, J.M.A., Yang, L.T., Mármol, F.G., García Villalba, L.J., Li, A.X., Wang, Y. (eds.) ATC 2011. LNCS, vol. 6906, pp. 175–186. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  21. 21.
    Ahmed, F., Abulaish, M.: An mcl-based approach for spam profile detection in online social networks. In: The 11th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2012, IEEE (2012)Google Scholar
  22. 22.
    Blondel, V., Guillaume, J., Lambiotte, R., Lefebvre, E.: Fast unfolding of communities in large networks. Journal of Statistical Mechanics: Theory and Experiment 2008, 10008 (2008)Google Scholar
  23. 23.
    Blondel, V.: The Louvain method for community detection in large networks (2011), (accessed July 11, 2012)

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Faraz Ahmed
    • 1
  • Muhammad Abulaish
    • 1
  1. 1.Center of Excellence in Information AssuranceKing Saud UniversityRiyadhSaudi Arabia

Personalised recommendations