Identification of Sybil Communities Generating Context-Aware Spam on Online Social Networks

This paper presents a hybrid approach to identify coordinated spam or malware attacks carried out using sybil accounts on online social networks. It also presents an online social network data collection methodology, with a special focus on Facebook social network. The pages crawled from Facebook network are grouped according to users’ interests and analyzed to retrieve users’ profiles from each of them. As a result, based on the users’ page-likes behavior, a total number of six groups has been identified. Each group is treated separately and modeled using a graph structure, termed as profile graph, in which a node represents a profile and a weighted edge connecting a pair of profiles represents the degree of their behavior similarity. Behavior similarity is calculated as a function of common shared links, common page-likes, and cosine similarity of the posts, and used to determine weights of the edges of the profile graph. Louvain’s community detection algorithm is applied on the profile graphs to identify various communities. Finally, a set of statistical features identified in one of our previous works is used classify the obtained communities either as malicious or benign. The experimental results on a real dataset show that profiles belonging to a malicious community have high closeness-centrality representing high behavioral similarity, whereas those of a benign community have low closeness-centrality.