Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis

YANG Haifeng; DU Shaoyong; WEI Guo; SHI Wenqi; LUO Xiangyang

doi:10.11959/j.issn.2096-109x.2024060

您当前的位置：

首页 >

文章列表页 >

Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis

Papers

- Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis
- Chinese Journal of Network and Information Security Vol. 10, Issue 4, Pages: 143-158(2024)
- 作者机构：
  
  1.郑州大学网络空间安全学院，河南郑州 450002
  2.河南省网络空间态势感知重点实验室，河南郑州 450001
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(U23A20305;62172435;62372465;62002386);Key Research and Development Project of Henan Province(221111321200);The Henan Province Science Foundation for Youths(232300421098)
- DOI：10.11959/j.issn.2096-109x.2024060
  CLC： TP309
- Received：30 January 2024，
  
  Revised：2024-07-28，
  
  Published：25 August 2024
- 稿件说明：
移动端阅览
杨海峰, 杜少勇, 魏果, 等. 基于时空行为与静态属性分析的陌陌应用恶意用户检测方法[J]. 网络与信息安全学报, 2024, 10(4): 143-158.

Format: YANG H F, DU S Y, WEI G, et al. Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 143-158.
杨海峰, 杜少勇, 魏果, 等. 基于时空行为与静态属性分析的陌陌应用恶意用户检测方法[J]. 网络与信息安全学报, 2024, 10(4): 143-158. DOI： 10.11959/j.issn.2096-109x.2024060.

Format: YANG H F, DU S Y, WEI G, et al. Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 143-158. DOI： 10.11959/j.issn.2096-109x.2024060.

摘要

陌陌是一款流行的移动社交应用，其中存在实施诈骗、网赌网贷等网络违法犯罪活动的恶意用户，发现陌陌中的恶意用户具有重要意义。然而，陌陌应用具有用户间社交关系松散、发布文本内容有限等特点，导致现有恶意用户检测方法难以准确刻画用户特征，检测准确率低。为此，提出一种基于用户时空行为与静态属性分析的恶意用户检测方法。基于陌陌提供的位置服务，搜集用户在线时间、位置、异常标签等数据，构建用户时空信息数据集；对比数据集中正常用户与具有异常标签的恶意用户的在线时间和位置分布差异，分析恶意用户的时空行为特征；基于用户在不同时间段的在线概率刻画用户的时间行为特征，基于用户历史位置分布的聚集程度刻画用户的空间行为特征；最后，融合已获得的时空行为特征与性别属性训练用户分类模型，检测恶意用户。基于收集的67 280个陌陌用户的1 894 917条数据，开展了恶意用户检测实验，结果表明，提出的方法能够有效检测出恶意用户，特别是针对历史发布内容较少的恶意用户时，所提方法正确分类恶意用户的能力显著优于代表性方法SybilSCAR和DatingSec，AUC-ROC和AUC-PR分别提升4.6%以上和19.88%以上。

Abstract

Momo

a popular mobile social application

has attracted a significant number of malicious users engaged in illegal online activities such as fraud

online gambling

and illegal lending. The detection of these malicious users is of great importance. However

the loose social relationships between users and the limited textual content on Momo have made it challenging for existing methods to accurately characterize user features

resulting in low detection accuracy. To address this issue

a malicious user detection method based on the analysis of user spatio-temporal behavior and static attributes was proposed. Firstly

a user spatio-temporal information dataset was constructed by collecting user online time

location

and abnormal labels data provided by Momo’s location service. Then

the differences in online time and location distribution between normal users and malicious users with abnormal labels in the dataset were compared to analyze the spatio-temporal behavior characteristics of malicious users. Subsequently

the temporal behavior characteristics of users were characterized by the online probability of users in different time periods

and the spatial behavior characteristics of users were characterized by the degree of clustering of users’ historical location distribution. Finally

the obtained spatio-temporal behavior features and gender attributes were combined to train a user classification model for malicious user detection. A malicious user detection experiment was conducted based on 1

894

917 data points collected from 67

280 Momo users. The results demonstrate that the proposed method could effectively detect malicious users

especially for those with fewer historical content publications. The proposed method exhibits significantly better performance in correctly classifying malicious users compared to representative methods such as SybilSCAR and DatingSec

with an improvement of over 4.6% in AUC-ROC and over 19.88% in AUC-PR.

关键词

Keywords

references

COBB C , KOHNO T . How public is my private life privacy in online dating [C ] // Proceedings of the 26th International Conference on World Wide Web . Republic and Canton of Geneva, Switzerland : International World Wide Web Conferences Steering Committee , 2017 : 1231 - 140 .

CHENG Z Y , CAVERLEE J , LEE K , et al . Exploring millions of footprints in location sharing services [J ] . Proceedings of the International AAAI Conference on Web and Social Media , 2021 , 5 ( 1 ): 81 - 88 .

LI J , YAN H Y , LIU Z L , et al . Location-sharing systems with enhanced privacy in mobile online social networks [J ] . IEEE Systems Journal , 2017 , 11 ( 2 ): 439 - 448 .

CHEN T , KAAFAR M , BORELI R . The where and when of finding new friends: analysis of a location-based social discovery network [J ] . Proceedings of the International AAAI Conference on Web and Social Media , 2021 , 7 ( 1 ): 61 - 70 .

LI H X , ZHU H J , DU S G , et al . Privacy leakage of location sharing in mobile social networks: attacks and defense [J ] . IEEE Transactions on Dependable and Secure Computing , 2018 , 15 ( 4 ): 646 - 660 .

THILAKARATHNA K , SENEVIRATNE S , GUPTA K , et al . A deep dive into location-based communities in social discovery networks [J ] . Computer Communications , 2017 , 100 : 78 - 90 .

HONG G , YANG Z M , YANG S , et al . Analyzing ground-truth data of mobile gambling scams [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 2176 - 2193 .

DING Y , PEDDINTI S T , ROSS K W . Stalking Beijing from Timbuktu: a generic measurement approach for exploiting location-based social discovery [C ] // Proceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices . New York : ACM , 2014 : 75 - 80 .

WANG J L , CHENG H N , XUE M H , et al . Revisiting localization attacks in mobile app people-nearby services [C ] // International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage . Cham : Springer , 2017 : 17 - 30 .

CAO Q , SIRIVIANOS M , YANG X W , et al . Aiding the detection of fake accounts in large scale social online services [C ] // Proceedings of the 9th USENIX conference on Networked Systems Design and Implementation . New York : ACM , 2012 : 15 .

GONG N Z , FRANK M , MITTAL P . SybilBelief: a semi-supervised learning approach for structure-based sybil detection [J ] . IEEE Transactions on Information Forensics and Security , 2014 , 9 ( 6 ): 976 - 987 .

WANG B H , ZHANG L , GONG N Z . SybilSCAR: Sybil detection in online social networks via local rule based propagation [C ] // Proceedings of the IEEE INFOCOM 2017 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2017 : 1 - 9 .

GAO P , WANG B H , GONG N Z , et al . SYBILFUSE: combining local attributes with global structure to perform robust sybil detection [C ] // Proceedings of the 2018 IEEE Conference on Communications and Network Security (CNS) . Piscataway : IEEE Press , 2018 : 1 - 9 .

LI S Y , YANG J , LIANG G , et al . SybilFlyover: Heterogeneous graph-based fake account detection model on social networks [J ] . Knowledge-Based Systems , 2022 , 258 : 110038 .

WANG B H , JIA J Y , GONG N Z . Graph-based security and privacy analytics via collective classification with joint weight learning and propagation [C ] // Proceedings 2019 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2019 : 24 - 27 .

AL-QURISHI M , HOSSAIN M S , ALRUBAIAN M , et al . Leveraging analysis of user behavior to identify malicious activities in large-scale social networks [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 2 ): 799 - 813 .

HE X L , GONG Q Y , CHEN Y , et al . DatingSec: detecting malicious accounts in dating Apps using a content-based attention network [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 18 ( 5 ): 2193 - 2208 .

SHEN X F , LV W T , QIU J H , et al . Trust-aware detection of malicious users in dating social networks [J ] . IEEE Transactions on Computational Social Systems , 2023 , 10 ( 5 ): 2587 - 2598 .

BREUER A , KHOSRAVANI N , TINGLEY M , et al . Preemptive detection of fake accounts on social networks via multi-class preferential attachment classifiers [C ] // Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . New York : ACM , 2023 : 105 - 116 .

XU T , GOOSSEN G , CEVAHIR H K , et al . Deep entity classification: abusive account detection for online social networks [C ] // USENIX Security Symposium . [ S.l. : s.n. ] , 2021 : 4097 - 4114 .

SAEED M H , ALI S , BLACKBURN J , et al . TrollMagnifier: detecting state-sponsored troll accounts on reddit [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 2161 - 2175 .

ZHU H Y , WANG C . Enabling fraud prediction on preliminary data through information density booster [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 5706 - 5720 .

LI M Y , ZHU H J , GAO Z Y , et al . All your location are belong to us: breaking mobile social networks for automated user location tracking [C ] // Proceedings of the 15th ACM International Symposium on Mobile Ad Hoc Networking and Computing . New York : ACM , 2014 : 43 - 52 .

CHENG H N , MAO S L , XUE M H , et al . On the impact of location errors on localization attacks in location-based social network services [C ] //WANG G, RAY I, ALCARAZ CALERO J, et al. International Conference on Security , Privacy and Anonymity in Computation, Communication and Storage . Cham : Springer , 2016 : 343 - 357 .

SHI W Q , LUO X Y , ZHAO F , et al . Geolocating a WeChat user based on the relation between reported and actual distance [J ] . International Journal of Distributed Sensor Networks , 2018 , 14 ( 4 ): 1550147718774462 .

PENG J W , MENG Y , XUE M H , et al . Attacks and defenses in location-based social networks: a heuristic number theory approach [C ] // Proceedings of the 2015 International Symposium on Security and Privacy in Social Networks and Big Data (SocialSec) . Piscataway : IEEE Press , 2015 : 64 - 71 .

POLAKIS I , ARGYROS G , PETSIOS T , et al . Where’s wally? precise user discovery attacks in location proximity services [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2015 : 817 - 828 .

时文旗 , 罗向阳 , 郭家山 . 基于加权最小二乘的社交网络用户定位方法 [J ] . 网络与信息安全学报 , 2022 , 8 ( 3 ): 41 - 52 .

SHI W Q , LUO X Y , GUO J S . Social network user geolocating method based on weighted least squares [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 3 ): 41 - 52 .

ANDY M , LAUREN S G . The ESRI guide to GIS analysis, volume 2: spartial measurements and statistics [M ] . Redlands : ESRI press , 2005 : 109 - 111 .

ESTER M , KRIEGEL H P , SANDER J , et al . A density-based algorithm for discovering clusters in large spatial databases with noise [C ] // Proceedings of the Second International Conference on Knowledge Discovery and Data Mining . New York : ACM , 1996 : 226 - 231 .

PRIM R C . Shortest connection networks and some generalizations [J ] . Bell System Technical Journal , 1957 , 36 ( 6 ): 1389 - 1401 .

FAWCETT T . An introduction to ROC analysis [J ] . Pattern Recognition Letters , 2006 , 27 ( 8 ): 861 - 874 .

DAVIS J , GOADRICH M . The relationship between Precision-Recall and ROC curves [C ] // Proceedings of the 23rd International Conference on Machine learning - ICML '06 . New York : ACM , 2006 : 233 - 240 .

HAN S Q , HU X Y , HUANG H L , et al . ADBench: anomaly detection benchmark [EB ] . arXiv Preprint , 2022 , arXiv: 2206.09426 .

PROKHORENKOVA L , GUSEV G , VOROBEV A , et al . CatBoost: unbiased boosting with categorical features [C ] // Proceedings of the 32nd International Conference on Neural Information Processing Systems . New York : ACM , 2018 : 6639 - 6649 .

CHEN T Q , GUESTRIN C . XGBoost: a scalable tree boosting system [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2016 : 785 – 794 .

KE G L , MENG Q , FINLEY T , et al . LightGBM: a highly efficient gradient boosting decision tree [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems . New York : ACM , 2017 : 3149 - 3157 .

YANG Z , WILSON C , WANG X , et al . Uncovering social network Sybils in the wild [J ] . ACM Transactions on Knowledge Discovery from Data , 2014 , 8 ( 1 ): 2 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Personal data privacy protection method based onvertical partitioning

Review of malware detection and classification visualization techniques

Related Author

ZUO Peng

CHEN Yong

KONG Kaichuan

HE Ming

HOU Ronghao

LI Qinghao

LIU Chunling

TANG Yonghe

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

School of Medical Information, Wannan Medical College

School of Physics and Electronic Information, Anhui Normal University

⁰