Anti-Reconnaissance Tools: Detecting Targeted Socialbots

Abstract

Attackers employ artificial, machine-operated, social network profiles called socialbots to connect to real members of an organization, thus greatly increasing the amount of information the attacker can collect. to connect socialbots, attackers employ several strategies. the authors' approach detects socialbots by intelligently selecting organization member profiles and monitoring their activity. their study demonstrates their method's efficacyspecifically, that when an attacker knows the defense strategy being deployed, the most effective attack is randomly sprayed friend requests, which eventually lead to a low number of connections.A dvanced cyberattacks follow a well-designed methodology. 1 Initial reconnaissance constitutes the basis for establishing a successful attack against an organization. During the reconnaissance phase, attackers look for "appropriate" organizational entry points to launch an attack. 2 The open Web gives attackers a great deal of publicly available information, such as the location and size of branches, employees' contact details, commercial partners, technical presentations, network domain, IP address ranges, and even security policies.One of the most fertile sources for entry points into an organization are social networks (SNs). Information extracted from SNs can include organizational structure, positions and roles within the organization (administrator, IT, sales, and so on), contact information (such as email), and much more that might not appear on the official organizational website. 3 Moreover, attackers might gain a foothold in the organization and obtain even more information by employing fake SN profiles that establish connections with an organization's employees through the SN. 4 These social connections form a solid base for the next attack phase, also known as initial penetration, where malware is injected through direct messages, emails with malicious attachments, posts on the wall of targeted employees, and so on. The ease with which SN users accept friend requests from strangers plays into the attackers' hands. 5 Attackers employ several strategies to connect their socialbots to other profiles within an SN, ranging from randomly spraying friend requests to sophisticated approaches that maximize the chance that their targets will accept the request. In this

Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks

“…The key insights behind this is that it becomes difficult for attackers to set up links to real users, and strong trusts are lacking in real OSNs, such as RenRen [47] and Facebook [5,8,12,22]. Souche [46] and Anti-Reconnaissance [31] also rely on the assumption that social network structure alone separates real users from Sybil users. Unfortunately, this was proven unrealistic since real users refuse to interact with unknown accounts [37].…”

Endogenetic structure of filter bubble in social networks

“…Social bots are generally considered to be harmful, although some of them are benign and, in principle, innocuous or even helpful. Therefore, social bots are often the subject of research that needs to be eliminated [26], but researchers have yet to recognize their potential value as a powerful tool in social network analysis [25,27]. The social bot in our experiment is designed to imitate similarity-based relationship formation, which reflects the selective exposure of information and relationships depending on one’s preferred topics.…”

Online Social Deception and Its Countermeasures: A Survey

“…Honeypots technology is not new and has been popularly used in communication networks as a defensive deception to proactively deal with attackers by luring them to honeypots for preventing them from accessing a target [27]. The existing approaches using social honeypots have mainly focused on detecting social spammers, socialbots [234], or malware [107,108,145,146,147,177,208] as a passive monitoring tool. These works use some profiles of attackers to detect them based on the features collected from the social honeypots placed as fake SNS accounts (e.g., Facebook or Twitter).…”