A novel machine learning approach to the detection of identity theft in social networks based on emulated attack instances and support vector machines

Abstract

The proliferation of social networks and their usage by a wide spectrum of user profiles has been specially notable in the last decade. A social network is frequently conceived as a strongly interlinked community of users, each featuring a compact neighborhood tightly and actively connected through different communication flows. This realm unleashes a rich substrate for a myriad of malicious activities aimed at unauthorizedly profiting from the user itself or from his/her social circle. This manuscript elaborates on a practical approach for the detection of identity theft in social networks, by which the credentials of a certain user are stolen and used without permission by the attacker for its own benefit. The proposed scheme detects identity thefts by exclusively analyzing connection time traces of the account being tested in a nonintrusive manner. The manuscript formulates the detection of this attack as a binary classification problem, which is tackled by means of a support vector classifier applied over features inferred from the original connection time traces of the user. Simulation results are discussed in depth toward elucidating the potentiality of the proposed system as the first step of a more involved impersonation detection framework, also relying on connectivity patterns and elements from language processing. Goals pursued by attacks in social networks may reside not only in the economic profitability of the attacker, but also in other interests achievable by unauthorizedly accessing the information of the victim (e.g. bullying or intimidation, particularly frequent within the teenage community). It is often the case that sensitive information items are carelessly posted in social networks, whose revelation may trigger dramatic consequences, security breaches, and eventually fatal circumstances for the victim. Although the need for detection schemes specially tailored to attacks in social networks has been noted by the research community, contributions in this matter are relatively scarce. Furthermore, they hinge mostly on ad-hoc designed detectors for a certain attack class approach based mainly on analyzing private features from the user account (e.g. content of the messages or contact list).From a more general point of view, motivations and goals for cybercrimes may vary within a wide spectrum of possibilities that unchain an equally diverse portfolio of detection methods. In particular, phishing refers to those procedures used for broadcasting messages from apparently reputable sources succinctly devoted to capturing sensitive information such as account credentials or credit card details [4][5][6][7]. Research on this class of attacks has gravitated on the application of textual phishing indicators [8,9] and information retrieval algorithms such as hidden Markov models, latent Dirichlet allocation, or naïve bag-of-words procedures [10]. Other features used for the detection of phishing attacks have been found in Internet search engines, which help find inconsistencies between the fake and the...

Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data

“…The results show a good performance in real time, however, without using any reaction and threats prevention. Villar‐Rodriguez et al propose the use of Support Vector Machine (SVM) to detect identity theft in social networks . The authors monitor user profiles based on connection time information.…”

Knowledge‐based approaches for identity management in online social networks

“…In addition to that, some works have focused on finding automated ways to detect compromised and hijacked accounts, such as Egele, Stringhini, Kruegel, and Vigna (, ) and Zangerle and Specht (). More recently, some works have explored deep learning techniques to detect identity theft attacks, such as Reyns and Henson (), Wang, Yang, and Luo (), and Villar‐Rodíguez, Del Ser, Torre‐Bastida, Bilbao, and Salcedo‐Sanz (). To keep focus in this article, we mostly discuss works that tackle mass attacks.…”

Multilayer hybrid strategy for phishing email zero‐day filtering

“…SMO is a WEKA implementation of the sequential minimal optimization algorithm. It is a fast version of support vector machine, which form an important class . SMO can be invoked in WEKA with four kernels.…”

“…Figure 3 presents the results obtained in filtering phishing emails by these kernels of BN for Dataset A of Table I as training set and Datasets B and C of Table I as validate sets. SMO is a WEKA implementation of the sequential minimal optimization algorithm. It is a fast version of support vector machine, which form an important class [52,53]. SMO can be invoked in WEKA with four kernels.…”