在线社交网络中异常帐号检测研究

发布时间：2018-03-06 15:57

本文选题：社交网络安全　切入点：Spam帐号　出处：《西安电子科技大学》2016年博士论文　论文类型：学位论文

【摘要】：社交网络的方便快捷共享特性,使其成为人们生活中不可分割的一部分。目前使用社交网络展示自己、与好友交流、获取最新资讯已成为人们的一种习惯。然而,社交网络在带给人们各种便利的同时也吸引了攻击者的目光,成为攻击者获取利益的新平台。攻击者通过在社交网络中创建虚假帐号以及劫持正常帐号(我们统称为异常帐号)来发布广告、色情、钓鱼等恶意消息以及执行恶意点赞、批量关注等行为来获取利益,这些恶意行为严重影响威胁到正常用户的隐私信息安全、使用体验以及社交网络平台自身的信誉体系。针对这些问题,我们展开了在线社交网络中异常帐号检测的工作,重点研究在线社交网络中新出现的Photo Spam攻击方式的检测,并取得了如下一些主要成果：(1)分析总结了目前在线社交网络中异常帐号检测的研究工作。将异常帐号的生命周期分为创建、发展、应用三个阶段,然后根据异常帐号的表现形式将不同称谓的异常帐号统一在同一个框架中；总结了目前异常帐号检测研究的实验方法,包括数据获取方式、数据标识方式和结果验证方式；在此基础上深入分析了社交网络中新的攻击方式Photo Spam,分析了Photo Spam的攻击过程和攻击策略,并对比了Photo Spam与传统Spam,发现与传统Spam攻击相比,Photo Spam更难被检测到而且对正常用户的危害更大。(2)提出一种专门针对Photo Spam帐号的检测方案。Photo Spam是攻击者为了绕过社交网络现有检测系统的新式Spam攻击,具有Spam信息的存储与传播分离的特性,在攻击过程中有两类行为方式不同的Spam帐号参与。目前对Photo Spam的检测方案都是根据帐号行为方式进行检测,无法将两类Spam帐号都检测到。针对这一问题,我们首次提出了一种专门针对Photo Spam帐号的检测方案。首先通过对Photo Spam攻击的分析构造了基于用户信息和基于内容两方面的特征；然后利用这些特征设计了有监督学习的检测方案,通过包含2,046个帐号的数据集训练成为专门针对Photo Spam帐号的分类器,我们的分类器能够检测全部类型的Photo Spam帐号；最后将训练后的分类器应用到包含有85,148个帐号的真实数据集中,共检测到5,756个Photo Spam帐号,检测正确率为97.05%。(3)提出一种针对Photo Spam帐号的轻量级迭代检测算法。社交网络为了保护正常用户的个人信息安全和使用体验,需要在有限的时间内降低Spam帐号的比例,而目前采用数据挖掘的检测方案要对所有用户都进行深入检测,将耗费大量的时间和机器成本,无法满足这一现实需求。针对这一问题,我们首次提出一种针对Photo Spam帐号的轻量级迭代检测算法LIDA。LIDA包括目标筛选和内容检测2个步骤,通过目标筛选根据已知Spam帐号获取更多可疑帐号,通过内容检测对可疑帐号进行深入检测判断是否的确为Spam帐号。LIDA只对可疑帐号进行深入检测,避免了对社交网络中所有用户都进行检测的问题,实现了对Photo Spam帐号的轻量级检测。通过人人网的4次迭代实验,共检测到9,568个Spam帐号,检出率为18.84%,比基于数据挖掘的检测算法更加高效。(4)提出一种针对社交网络中Spam相册的检测方案。目前检测Photo Spam的方案都是针对Spam帐号进行检测,检测依据主要是帐号的恶意行为,因此需要Spam帐号存在一定时间之后才能够检测到,而在此期间Spam帐号的恶意行为已经对正常用户造成了危害,所以针对Spam帐号的检测方案滞后于Spam攻击,无法有效保护正常用户。针对这一问题,我们首次提出一种针对Spam相册的检测方案。首先基于Spam相册和正常相册的差异构造了12个提取及时且计算高效的特征；然后通过这些特征设计了针对Spam相册的检测模型；利用包含2,356个相册的数据集训练形成Spam相册分类器,实验表明能够正确区分测试集中100%的Spam相册和98.2%的正常相册；最后将检测模型应用到包含315,115个相册的真实数据集中,共检测到89,163个Spam相册,正确率达到94.2%。
[Abstract]:The social network convenient sharing characteristics, make it become an integral part of people's life. At present, the use of social networks to show their communication with friends, get the latest information has become a habit of people. However, in the social network to bring people convenience at the same time also attracted the attacker's eyes become a new platform for the attacker getting benefits. Attackers use in social networks to create a false account and account hijacking normal (we referred to as abnormal account) to publish advertisements, pornography, phishing and other malicious messages and execute malicious praise, batch attention acts to get benefits, these malicious behavior seriously affect the privacy of information security threats to the normal user the use of experience and social networking platform, its own credit system. To solve these problems, we launched the online social network account abnormal detection work, heavy Detection of Photo Spam attack to new research in online social networks, and the following conclusions: (1) analyzed and summarized the current account in the online social network abnormal detection research. The abnormal account life cycle is divided into creation, development, application of three stages, unified account and abnormal according to the form of abnormal account will different titles in the same framework; summarizes the current research of detecting abnormal account methods, including data acquisition, data identification and verification results; on the basis of in-depth analysis of the new attack methods in social network Photo Spam, analyzes the attack process and attack strategy Photo Spam and Photo Spam, compared with the traditional Spam, and found that the traditional Spam attack, Photo Spam is more difficult to be detected and the harm to the normal user more. (2) proposed A specific Photo Spam account.Photo Spam detection scheme is the attacker to bypass the existing social network detection system of the new Spam attack, characteristics of storage and transmission with Spam information, there are two types of behavior of different Spam account participation in the process of attack. The current detection scheme of Photo Spam are tested according to the account behavior cannot be two Spam accounts are detected. To solve this problem, we propose a Spam account specifically for Photo detection scheme. By analyzing the Photo Spam attack is constructed based on user information and based on the characteristics of the two aspects of the content; and then use these features to design a detection scheme supervised learning, by including the 2046 account data set training is specifically for the Photo Spam account classifier, our classifier can detect all Type Photo Spam account; finally by the trained classifier to contain real data of 85148 accounts, 5756 Photo Spam accounts were detected. The detection accuracy is 97.05%. (3) proposed a lightweight Spam account for Photo iterative detection algorithm. The social network in order to the security of personal information and experience to protect the normal users, the need to reduce the proportion of Spam account for a limited time, and the detection scheme of data mining should be carried out in-depth inspection of all users will spend a lot of time and cost of the machine, can not meet the realistic demand. To solve this problem, we propose a lightweight iteration for LIDA.LIDA Photo Spam account detection algorithm including the target selection and content detection of 2 steps, through the target screening according to the known Spam account for the more suspicious account through content Detection of suspicious account further detecting and judging whether does Spam.LIDA account only for further detection of suspicious account, to avoid all the users in the social network testing problem, realize the lightweight detection of the Photo Spam account. By 4 iterations the renren.com, 9568 Spam accounts were detected, the detection the rate is 18.84%, the detection algorithm based on data mining more efficient. (4) proposed a scheme for detection of social network Spam album. At present the detection of Photo Spam scheme is to detect the Spam account, according to the detection of malicious behavior is the main account, so we need to Spam account for a certain period of time to be able to detected, while the malicious behavior of normal user Spam account has been damaged, so the detection scheme for the Spam account is behind the Spam attack, can not effectively protect it Ordinary users. To solve this problem, we first proposed a detection scheme for Spam photo album. The first difference between Spam and normal album album based on the structure characteristics of the 12 extracted timely and efficient calculation; then based on these features, design a detection model for Spam photo album; training set form contains 2356 Spam photo album using classifier the album data, experiments show that the normal album can correctly differentiate the test set 100% Spam album and 98.2%; the detection model is applied to the real data contains 315115 albums, 89163 Spam albums were detected, the correct rate of 94.2%.

【学位授予单位】：西安电子科技大学
【学位级别】：博士
【学位授予年份】：2016
【分类号】：TP393.09

【相似文献】