Twitter Games: How Successful Spammers Pick TargetsVasumathi Sridharan, Vaibhav Shankar, Minaxi GuptaSchool of Informatics and Computing, Indiana University

ACSAC2012

OUTLINE

• Introduction- DATA COLLECTION

- TWEET TYPES

• STRATEGIES FOR PICKING TARGET• DISCUSSION- Posting methodology

- Unbinned Spam Profiles

- Gathering followers

• RELATE WORK• CONCLUSION

Introduction

• Email spam has been a problem for decades• As email spam filtering programs have improved, with

many claiming 99% or higher accuracies• Spammers have looked for other avenues

• Online social networks (OSNs)

OSN: TWITTER

WHY Twitter ?

- Twitter alone boasted 140 million users as of March 2012 [20]

- Fighting spam on OSNs requires new types of filtering techniques

• New topic of spam on OSNs (Classifiers)

we do not know how spammers pick their targets

DATA COLLECTION

• Twitter’s streaming API (collect tweets)(samples)• November 2011• 19,991,050 tweets / 7,078,643 profiles

• we visited http://www.twitter.com/<username>• looked for suspended profiles (SPAM?)• 82274 suspended profiles

http://www.twitter.com/<username>

82274 suspended profiles

DATA COLLECTION

• Eliminated languages other than English

82274 -> 53083 (suspended profiles)

• 10 tweets within five days - successful spam profiles (14230)- unsuccessful spam profiles

• 70% of unsuccessful spam profiles and 15% of successful spam profiles get suspended on the first day

• [16] 77% of spam profiles were suspended on the first day and 92% within three days>

[16] Thomas, K., Grier, C., Song, D., and Paxson, V. Suspended accounts in retrospect: an analysis of twitter spam. In ACM/USENIX Internet Measurement Conference (IMC) (2011)

TWEET TYPES

• regular tweet

Attack : Sender’s follower• reply tweet

Attack : anyone• mention tweet

Attack : anyone• Retweet

Attack : Sender’s follower

1. Regular Tweets: Successful spam > Unsuccessful spam

2. Replies Tweets :Successful spam < Unsuccessful spamTwitter is known to suspend accounts which send large numbers of replies or mentions [19]

3. Mention Tweets: Successful, Unsuccessful : 1/5 ,1/4Thomas et al. a year ago [16] found that 52% of spam profiles made use of mention tweets.

we conclude that Twitter spammers have evolved their strategies in the last one year

• We find that over 3/4 of successful spam profiles exclusively used only one type of tweet

• Spammers vs Other-user

3/4 2/3 14%

STRATEGIES FOR PICKING TARGET

• 1.Spamming Ones Own Followers• 2.Spamming Followers of Popular Profiles• 3.Spamming based on Keywords in Tweets• 4.Trending Topics Hijacking• 5.Targeting Own Followers by Reweets

Spamming Ones Own Followers

Nearly 40% of unsuccessful spam profiles have zero followers and a total of 2/3 (66%) have less than 10.

Thomas et al. noted in their work that 89% of spam profiles have less than 10 followers. (1 year before)

1/3 of successful spamprofiles have over a 100 followers

spammers become smarter

• 14230 profiles >> ten regular tweets with link >> 7704

>> 80% Url same Domain >> 6630

• 6630 <> 559 different domains

- t.co (1822)

- Amazon.com (1741)

Affiliate ID

Amazon.com

All profiles using the same affiliate ID were clearly part of the same campaign.

Profiles across multiple IDs belonged to a spam campaign

Top five

Spamming Followers of Popular Profiles

• Ex. Basketball lovers , <Target Michael Jordan>• Reply or Mention tweets• ( >4 user receive same spam & 50% follow same person )

• 14230 >> reply or mention >> 4086• >> 877 (26)

Spamming based on Keywords in Tweets

• Spammers can also pick their targets based on the content

of tweets from Twitter users.• ex: search “bumbler” “justinbieber”• Reply or Mention tweets

(TF-IDF[8] 7 million words(spam tweets) -> 50K words)

• 1004 (1)(150)Spam reply tweet:Here ip5 0rz.tw/ab

source tweet:Wow ip5~

Trending Topics Hijacking

• Hashtag (圖 ) • Ex. #bumbler

• Spammers have been known to hijack trending topics to increase the visibility of their spam campaigns [16]

• Various types of tweets (#iphone5)• 4327 (spam,#) >> top 200 hashtag >> 1043 (523)(14)(3)

Targeting Own Followers by Reweets• Reweets• 1230 used retweets• 1230 >> 10 tweets with url >> 28• 26 retweeting from omgwire (promoting)

Overall 5 methods 8805 / 14230 (61.9%)

• DISCUSSION

- Posting methodology

- Unbinned Spam Profiles

- Gathering followers

Posting methodology

Twitterfeed : sucessful spammer tweets 2/3Web : profiles

Others

*organic profiles use several different apps,where as spammers have fewer dedicated apps.

92% 80% 60%

Unbinned Spam Profiles

• Overall 5 methods 8805 / 14230 (61.9%)• 10 url tweets , 80% same domain (5 url , 50%) • 61.9 % >> 72%

• TweetAdder, based on their geographical location and language

• Not spamer (ex. violence)

Gathering followers

• 1. communities (encourage following back)

#InstantFollowBack(#IFB)

• 2. Buy

fiverr

RELATE WORK

• YOUTUBE

[2] video spam on Youtube and employ machine learning

techniques to identify spammers on YouTube

• FaceBook

[5] involves detecting and characterizing spam

campaigns on Facebook.

youtube

CONCLUSION

• We analyzed strategies of successful Twitter spammers• Particularly as they relate to picking spam target

• The spammers themselves evolved in a mere mattter of one year(Thomas [16])

• Need more data

End

• THANKS