ProfileGen: Generation of Automatic and Realistic Artificial Profiles

Abstract

Online social networks (OSNs) are abused by cyber criminals for various malicious activities. One of the most effective approaches for detecting malicious activity in OSNs involves the use of social network honeypotsartificial profiles that are deliberately planted within OSNs in order to attract abusers. Honeypot profiles have been used in detecting spammers, potential cyber attackers, and advanced attackers. Therefore, there is a growing need for the ability to reliably generate realistic artificial honeypot profiles in OSNs. In this research we present 'ProfileGen' -a method for the automated generation of profiles for professional social networks, giving particular attention to producing realistic education and employment records. 'ProfileGen' creates honeypot profiles that are similar to actual data by extrapolating the characteristics and properties of real data items. Evaluation by 70 domain experts confirms the method's ability to generate realistic artificial profiles that are indistinguishable from real profiles, demonstrating that our method can be applied to generate realistic artificial profiles for a wide range of applications.

Forensics and Deep Learning Mechanisms for Botnets in Internet of Things: A Survey of Challenges and Solutions

“…Attackers have been known to target social networks, where they are capable of gaining sensitive information from unsuspecting users, proliferating malware infections and more. As such, Paradise et al (2018) [87] presented ProfileGen, a tool that produces realistic and compelling social profiles, which function as honeypots, in that they attract the attention of attackers. The proposed system, makes use of an automated process that relies on the generation of a Markov model from collected data.…”

“…• Honeypots-[48],[62],[73],[77],[87],[87],[90]-are devices, many times simulated ones which run in a controllable virtual environment, that have been designed to appear as an appealing target to attackers and malware infections. Honeypots are generally separated into high interaction and low interaction honeypots, with the former imitating entire systems (e.g., Windows, Linux) and allowing for extended interactions and information gathering, while the latter simulates certain services available through the net, which are often targeted by attackers.…”