If it looks like a spammer and behaves like a spammer, it must be a spammer: analysis and detection of microblogging spam accounts

Abdullah Almaatouq, Erez Shmueli, Mariam Nouh, Ahmad Alabdulkareem, Vivek K. Singh, Mansour Alsaleh, Abdulrahman Alarifi, Anas Alfaris, Alex ‘Sandy’ Pentland

Research output: Contribution to journalArticlepeer-review

41 Scopus citations

Abstract

Spam in online social networks (OSNs) is a systemic problem that imposes a threat to these services in terms of undermining their value to advertisers and potential investors, as well as negatively affecting users’ engagement. As spammers continuously keep creating newer accounts and evasive techniques upon being caught, a deeper understanding of their spamming strategies is vital to the design of future social media defense mechanisms. In this work, we present a unique analysis of spam accounts in OSNs viewed through the lens of their behavioral characteristics. Our analysis includes over 100 million messages collected from Twitter over the course of 1 month. We show that there exist two behaviorally distinct categories of spammers and that they employ different spamming strategies. Then, we illustrate how users in these two categories demonstrate different individual properties as well as social interaction patterns. Finally, we analyze the detectability of spam accounts with respect to three categories of features, namely content attributes, social interactions, and profile properties.

Original languageEnglish (US)
Pages (from-to)475-491
Number of pages17
JournalInternational Journal of Information Security
Volume15
Issue number5
DOIs
StatePublished - Oct 1 2016

All Science Journal Classification (ASJC) codes

  • Software
  • Information Systems
  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications

Keywords

  • Account abuse
  • Microblogging
  • Online social networks
  • Spam analysis
  • Spam detection

Fingerprint Dive into the research topics of 'If it looks like a spammer and behaves like a spammer, it must be a spammer: analysis and detection of microblogging spam accounts'. Together they form a unique fingerprint.

Cite this