Collective Classification of Spam Campaigners on Twitter

Abstract

Cybercriminals have leveraged the popularity of a large user base available on Online Social Networks (OSNs) to spread spam campaigns by propagating phishing URLs, attaching malicious contents, etc. However, another kind of spam attacks using phone numbers has recently become prevalent on OSNs, where spammers advertise phone numbers to attract users' attention and convince them to make a call to these phone numbers. The dynamics of phone number based spam is different from URL-based spam due to an inherent trust associated with a phone number. While previous work has proposed strategies to mitigate URL-based spam attacks, phone number based spam attacks have received less attention.In this paper, we aim to detect spammers that use phone numbers to promote campaigns on Twitter. To this end, we collected information (tweets, user meta-data, etc.) about 3, 370 campaigns spread by 670, 251 users. We model the Twitter dataset as a heterogeneous network by leveraging various interconnections between different types of nodes present in the dataset. In particular, we make the following contributions -(i) We propose a simple yet effective metric, called Hierarchical Meta-Path Score (HMPS) to measure the proximity of an unknown user to the other known pool of spammers. (ii) We design a feedback-based active learning strategy and show that it significantly outperforms three state-of-the-art baselines for the task of spam detection. Our method achieves 6.9% and 67.3% higher F1-score and AUC, respectively compared to the best baseline method. (iii) To overcome the problem of less training instances for supervised learning, we show that our proposed feedback strategy achieves 25.6% and 46% higher F1-score and AUC respectively than other oversampling strategies. Finally, we perform a case study to show how our method is capable of detecting those users as spammers who have not been suspended by Twitter (and other baselines) yet. CCS CONCEPTS• Information systems; • Security and privacy; • Applied computing; This paper is published under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. Authors reserve their rights to disseminate the work on their personal and corporate Web sites with the appropriate attribution.

Author classification using transfer learning and predicting stars in co‐author networks

“…The combination of structural features and content of the labeled nodes to classify the unlabeled node 31,32 . The collective classification achieves higher classification accuracy compared with the individual classification methods shown in the previous techniques 33,34 . A collective classification method to decrease the learning and inference changes within the domains whereas the same set of nodes are connected by multiple networks 35 .…”

A Survey of Attacks Against Twitter Spam Detectors in an Adversarial Environment

“…Approach (HMPS) [41] Built heterogeneous networks and detected nodes connected by the same phone number or URL.…”

Retweet Us, We will Retweet You: Spotting Collusive Retweeters Involved in Blackmarket Services

“…On the contrary, when they write tweets on Twitter and do not submit these tweets to any blackmarket services, they are not expected to perform such credit-based retweeting activity. We use the following set of features to capture this phenomenon: (LF 1-7 ) tweeting likelihood per day for seven days (Monday-Sunday), (LF [8][9][10][11][12][13][14] ) retweeting likelihood per day for seven days, (LF 15-21 ) regularity of tweeting activity per day for seven days, (LF 22-28 ) regularity of retweeting activity per day for seven days, (LF 29 ) tweet steadiness, (LF 30 ) retweet steadiness, (LF 31-37 ) maximum tweet likelihood per day for seven days, and (LF 38-44 ) maximum retweet likelihood per day for seven days. LF 1-7 (resp.…”

“…LF 1-7 (resp. LF [8][9][10][11][12][13][14] ) is calculated by taking the ratio of the tweets (resp. retweets) of a user per day to the total number of tweets (resp.…”