SocialWatch: detection of online service abuse via large-scale social graphs

  • Authors:

  • Junxian Huang;Yinglian Xie;Fang Yu;Qifa Ke;Martin Abadi;Eliot Gillum;Z. Morley Mao

  • Affiliations:

  • University of Michigan, Ann Arbor, MI, USA;Microsoft Research Silicon Valley, Mountain View, CA, USA;Microsoft Research Silicon Valley, Mountain View, CA, USA;Microsoft Research Silicon Valley, Mountain View, CA, USA;Microsoft Research Silicon Valley, Mountain View, CA, USA;Microsoft, Mountain View, CA, USA;University of Michigan, Ann Arbor, MI, USA

  • Venue:
  • Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we present a framework, SocialWatch, to detect attacker-created accounts and hijacked accounts for online services at a large scale. SocialWatch explores a set of social graph properties that effectively model the overall social activity and connectivity patterns of online users, including degree, PageRank, and social affinity features. These features are hard to mimic and robust to attacker counter strategies. We evaluate SocialWatch using a large, real dataset with more than 682 million users and over 5.75 billion directional relationships. SocialWatch successfully detects 56.85 million attacker-created accounts with a low false detection rate of 0.75% and a low false negative rate of 0.61%. In addition, SocialWatch detects 1.95 million hijacked accounts---among which 1.23 million were not detected previously---with a low false detection rate of 2%. Our work demonstrates the practicality and effectiveness of using large social graphs with billions of edges to detect real attacks.