在线社交网络恶意网址检测

发布时间：2018-09-17 17:46

【摘要】：在线社交网络已经成为人们熟悉的交流平台,例如Facebook、Twitter、以及新浪微博等。与此同时,其开放性也引起了攻击者的关注。攻击者尝试利用社交网络平台传播和隐藏包含恶意网址的消息,间接对用户隐私安全构成威胁。为了解决在线社交网络上存在的恶意网址问题,研究学者、安全机构不断提出了对应的解决方案;主要包括消息中恶意网址检测以及spammer检测两个方向。当前大部分检测社交消息中恶意网址的解决方法是采用机器学习策略。此类方法会基于不同种类的特征集合,训练并构建检测器。不过,大部分现有工作中采取的特征主要是基于常规消息、以及账户特征等,与社交网络平台的特性并不相关。对于spammer检测,现有工作主要是针对社交网络中单一用户节点进行检测,而且,部分算法过度依赖于用户之间的社交网络关系。此类检测方法多会造成对同一用户的重复检测,并且不能有效的、一次性地清除采取策略潜藏的spammer团体。因此,有必要通过消息传播路径,将spammer与其发送的消息统一起来共同考虑。同时,利用消息相关联的用户的可疑程度,也能够在有限次数内将潜藏的spammer团体有效清除。本文针对社交消息中恶意网址检测方向,提出了基于消息转发的特征集合,并依此类特征设计了恶意网址检测器。转发行为是消息传播的主要途径,能够促进消息在社交网络平台上实时、快速的传播。为了验证检测器的性能,我们收集了大约有100 000条初始新浪微博消息,作为转发行为分析与研究的数据样本。经过训练以及检测器性能测试,该分类器的准确率为83.21%,而误报率为10.3%。为了验证提出的转发特征集的有效性,通过构建不包含此类特征的检测器,并与先前所设计检测器进行对比实验,其结果充分说明了基于消息转发行为特征在社交网络恶意网址检测研究上的有效性。针对spammer检测方向,本文引入了消息转发树,通过消息传播路径,将账户与其发送的消息统一结合起来。采用此方法,有利于解决社交网络中采用策略进行潜藏的spammer团体问题。首先,分析并总结了基于消息转发树的6个特征,分别是消息转发树层级、传播范围、重复转发行为、传播速度、以及消息转发树的权值均值。其次,通过机器学习策略,对此类特征集合矩阵进行训练并生成检测器。实验结果表明,该检测器的准确率高达95.3%,而误报率仅为0.5%。最后,对参与训练的特征集合进行特征影响度排名,结果表明基于消息转发树的特征都位居前列。同时,提出并采用了基于转发特征以及消息转发树的概念,在此领域尚属首例,对同类工作有借鉴意义。
[Abstract]:Online social networks have become familiar communication platforms, such as Facebook,Twitter, and Sina Weibo. At the same time, its openness also attracted the attention of the attackers. An attacker attempts to spread and hide messages containing malicious web addresses on a social network platform, which indirectly threatens the privacy of users. In order to solve the problem of malicious web address in online social network, researchers and security organizations have put forward corresponding solutions, mainly including malicious URL detection and spammer detection. At present, most of the solutions to detect malicious web addresses in social messages are machine learning strategies. Such methods train and construct detectors based on different types of feature sets. However, most of the features taken in the current work are based on regular messages and account features, and are not related to the features of the social network platform. For spammer detection, the existing work mainly focuses on the detection of single user nodes in social networks, and some of the algorithms are overly dependent on the social network relationships between users. This kind of detection method often results in repeated detection of the same user, and it can not effectively eliminate the spammer group that has adopted the strategy in one time. Therefore, it is necessary to unify the spammer and the message it sends through the message propagation path. At the same time, using the suspicious degree of users associated with messages, the hidden spammer group can be effectively removed in a limited number of times. In this paper, a message forwarding based feature set is proposed to detect malicious web addresses in social messages, and a malicious URL detector is designed according to these features. Forwarding behavior is the main way to spread messages, which can promote the real-time and fast spread of messages on the social network platform. To verify the performance of the detector, we collected about 100,000 initial Sina Weibo messages as data samples for forwarding behavior analysis and research. After training and detector performance testing, the accuracy of the classifier is 83.21, and the false alarm rate is 10.3. In order to verify the validity of the proposed forwarding feature set, a detector that does not contain such features is constructed and compared with the previously designed detector. The results fully demonstrate the effectiveness of message forwarding behavior in the research of malicious web address detection in social networks. Aiming at the direction of spammer detection, this paper introduces a message forwarding tree, which unifies the account with the message it sends through the message propagation path. This method is helpful to solve the problem of spammer group which is hidden by strategy in social network. Firstly, six characteristics of message forwarding tree based on message forwarding tree are analyzed and summarized, which are message forwarding tree level, propagation range, repeat forwarding behavior, propagation speed and the average weight of message forwarding tree. Secondly, this kind of feature set matrix is trained by machine learning strategy and the detector is generated. The experimental results show that the accuracy of the detector is as high as 95.3 and the false alarm rate is only 0.5. Finally, we rank the feature sets involved in the training, and the results show that the features based on message forwarding tree are in the forefront. At the same time, the concepts based on forwarding feature and message forwarding tree are proposed and adopted, which is the first example in this field.
【学位授予单位】：吉林大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】