基于时空行为与静态属性分析的陌陌应用恶意用户检测方法

杨海峰; 杜少勇; 魏果; 时文旗; 罗向阳

doi:10.11959/j.issn.2096-109x.2024060

您当前的位置：

首页 >

文章列表页 >

基于时空行为与静态属性分析的陌陌应用恶意用户检测方法

学术论文

- 基于时空行为与静态属性分析的陌陌应用恶意用户检测方法
- Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis
- 网络与信息安全学报 2024年10卷第4期页码：143-158
- 作者机构：
  
  1.郑州大学网络空间安全学院，河南郑州 450002
  2.河南省网络空间态势感知重点实验室，河南郑州 450001
- 作者简介：
  
  [ "杨海峰（1997- ），男，河南安阳人，郑州大学硕士生，主要研究方向为移动社交应用隐私安全、网络空间资源测绘。" ]
  [ "杜少勇（1989- ），男，河北任县人，博士，河南省网络空间态势感知重点实验室讲师，主要研究方向为移动安全。" ]
  [ "魏果（1997- ），女，河南信阳人，河南省网络空间态势感知重点实验室博士生，主要研究方向为网络空间资源测绘。" ]
  [ "时文旗（1993- ），男，河南周口人，博士，河南省网络空间态势感知重点实验室讲师，主要研究方向为网络目标定位、网络空间资源测绘。" ]
  [ "罗向阳（1978- ），男，湖北荆门人，河南省网络空间态势感知重点实验室教授、博士生导师，主要研究方向为网络空间资源测绘、多媒体安全。" ]
- 基金信息：
  
  国家重点研发计划;The National Key Research and Development Program of China(2022YFB3102900);国家自然科学基金(U23A20305;62172435;62372465;62002386);河南省重点研发项目(221111321200);河南省自然科学青年基金(232300421098)
- DOI：10.11959/j.issn.2096-109x.2024060
  中图分类号： TP309
- 收稿：2024-01-30，
  
  修回：2024-07-28，
  
  纸质出版：2024-08-25
- 稿件说明：
移动端阅览
杨海峰, 杜少勇, 魏果, 等. 基于时空行为与静态属性分析的陌陌应用恶意用户检测方法[J]. 网络与信息安全学报, 2024, 10(4): 143-158.

Format: YANG H F, DU S Y, WEI G, et al. Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 143-158.
杨海峰, 杜少勇, 魏果, 等. 基于时空行为与静态属性分析的陌陌应用恶意用户检测方法[J]. 网络与信息安全学报, 2024, 10(4): 143-158. DOI： 10.11959/j.issn.2096-109x.2024060.

Format: YANG H F, DU S Y, WEI G, et al. Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 143-158. DOI： 10.11959/j.issn.2096-109x.2024060.

摘要

陌陌是一款流行的移动社交应用，其中存在实施诈骗、网赌网贷等网络违法犯罪活动的恶意用户，发现陌陌中的恶意用户具有重要意义。然而，陌陌应用具有用户间社交关系松散、发布文本内容有限等特点，导致现有恶意用户检测方法难以准确刻画用户特征，检测准确率低。为此，提出一种基于用户时空行为与静态属性分析的恶意用户检测方法。基于陌陌提供的位置服务，搜集用户在线时间、位置、异常标签等数据，构建用户时空信息数据集；对比数据集中正常用户与具有异常标签的恶意用户的在线时间和位置分布差异，分析恶意用户的时空行为特征；基于用户在不同时间段的在线概率刻画用户的时间行为特征，基于用户历史位置分布的聚集程度刻画用户的空间行为特征；最后，融合已获得的时空行为特征与性别属性训练用户分类模型，检测恶意用户。基于收集的67 280个陌陌用户的1 894 917条数据，开展了恶意用户检测实验，结果表明，提出的方法能够有效检测出恶意用户，特别是针对历史发布内容较少的恶意用户时，所提方法正确分类恶意用户的能力显著优于代表性方法SybilSCAR和DatingSec，AUC-ROC和AUC-PR分别提升4.6%以上和19.88%以上。

Abstract

Momo

a popular mobile social application

has attracted a significant number of malicious users engaged in illegal online activities such as fraud

online gambling

and illegal lending. The detection of these malicious users is of great importance. However

the loose social relationships between users and the limited textual content on Momo have made it challenging for existing methods to accurately characterize user features

resulting in low detection accuracy. To address this issue

a malicious user detection method based on the analysis of user spatio-temporal behavior and static attributes was proposed. Firstly

a user spatio-temporal information dataset was constructed by collecting user online time

location

and abnormal labels data provided by Momo’s location service. Then

the differences in online time and location distribution between normal users and malicious users with abnormal labels in the dataset were compared to analyze the spatio-temporal behavior characteristics of malicious users. Subsequently

the temporal behavior characteristics of users were characterized by the online probability of users in different time periods

and the spatial behavior characteristics of users were characterized by the degree of clustering of users’ historical location distribution. Finally

the obtained spatio-temporal behavior features and gender attributes were combined to train a user classification model for malicious user detection. A malicious user detection experiment was conducted based on 1

894

917 data points collected from 67

280 Momo users. The results demonstrate that the proposed method could effectively detect malicious users

especially for those with fewer historical content publications. The proposed method exhibits significantly better performance in correctly classifying malicious users compared to representative methods such as SybilSCAR and DatingSec

with an improvement of over 4.6% in AUC-ROC and over 19.88% in AUC-PR.

关键词

Keywords

references

COBB C , KOHNO T . How public is my private life privacy in online dating [C ] // Proceedings of the 26th International Conference on World Wide Web . Republic and Canton of Geneva, Switzerland : International World Wide Web Conferences Steering Committee , 2017 : 1231 - 140 .

CHENG Z Y , CAVERLEE J , LEE K , et al . Exploring millions of footprints in location sharing services [J ] . Proceedings of the International AAAI Conference on Web and Social Media , 2021 , 5 ( 1 ): 81 - 88 .

LI J , YAN H Y , LIU Z L , et al . Location-sharing systems with enhanced privacy in mobile online social networks [J ] . IEEE Systems Journal , 2017 , 11 ( 2 ): 439 - 448 .

CHEN T , KAAFAR M , BORELI R . The where and when of finding new friends: analysis of a location-based social discovery network [J ] . Proceedings of the International AAAI Conference on Web and Social Media , 2021 , 7 ( 1 ): 61 - 70 .

LI H X , ZHU H J , DU S G , et al . Privacy leakage of location sharing in mobile social networks: attacks and defense [J ] . IEEE Transactions on Dependable and Secure Computing , 2018 , 15 ( 4 ): 646 - 660 .

THILAKARATHNA K , SENEVIRATNE S , GUPTA K , et al . A deep dive into location-based communities in social discovery networks [J ] . Computer Communications , 2017 , 100 : 78 - 90 .

HONG G , YANG Z M , YANG S , et al . Analyzing ground-truth data of mobile gambling scams [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 2176 - 2193 .

DING Y , PEDDINTI S T , ROSS K W . Stalking Beijing from Timbuktu: a generic measurement approach for exploiting location-based social discovery [C ] // Proceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices . New York : ACM , 2014 : 75 - 80 .

WANG J L , CHENG H N , XUE M H , et al . Revisiting localization attacks in mobile app people-nearby services [C ] // International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage . Cham : Springer , 2017 : 17 - 30 .

CAO Q , SIRIVIANOS M , YANG X W , et al . Aiding the detection of fake accounts in large scale social online services [C ] // Proceedings of the 9th USENIX conference on Networked Systems Design and Implementation . New York : ACM , 2012 : 15 .

GONG N Z , FRANK M , MITTAL P . SybilBelief: a semi-supervised learning approach for structure-based sybil detection [J ] . IEEE Transactions on Information Forensics and Security , 2014 , 9 ( 6 ): 976 - 987 .

WANG B H , ZHANG L , GONG N Z . SybilSCAR: Sybil detection in online social networks via local rule based propagation [C ] // Proceedings of the IEEE INFOCOM 2017 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2017 : 1 - 9 .

GAO P , WANG B H , GONG N Z , et al . SYBILFUSE: combining local attributes with global structure to perform robust sybil detection [C ] // Proceedings of the 2018 IEEE Conference on Communications and Network Security (CNS) . Piscataway : IEEE Press , 2018 : 1 - 9 .

LI S Y , YANG J , LIANG G , et al . SybilFlyover: Heterogeneous graph-based fake account detection model on social networks [J ] . Knowledge-Based Systems , 2022 , 258 : 110038 .

WANG B H , JIA J Y , GONG N Z . Graph-based security and privacy analytics via collective classification with joint weight learning and propagation [C ] // Proceedings 2019 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2019 : 24 - 27 .

AL-QURISHI M , HOSSAIN M S , ALRUBAIAN M , et al . Leveraging analysis of user behavior to identify malicious activities in large-scale social networks [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 2 ): 799 - 813 .

HE X L , GONG Q Y , CHEN Y , et al . DatingSec: detecting malicious accounts in dating Apps using a content-based attention network [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 18 ( 5 ): 2193 - 2208 .

SHEN X F , LV W T , QIU J H , et al . Trust-aware detection of malicious users in dating social networks [J ] . IEEE Transactions on Computational Social Systems , 2023 , 10 ( 5 ): 2587 - 2598 .

BREUER A , KHOSRAVANI N , TINGLEY M , et al . Preemptive detection of fake accounts on social networks via multi-class preferential attachment classifiers [C ] // Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . New York : ACM , 2023 : 105 - 116 .

XU T , GOOSSEN G , CEVAHIR H K , et al . Deep entity classification: abusive account detection for online social networks [C ] // USENIX Security Symposium . [ S.l. : s.n. ] , 2021 : 4097 - 4114 .

SAEED M H , ALI S , BLACKBURN J , et al . TrollMagnifier: detecting state-sponsored troll accounts on reddit [C ] // Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 2161 - 2175 .

ZHU H Y , WANG C . Enabling fraud prediction on preliminary data through information density booster [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 5706 - 5720 .

LI M Y , ZHU H J , GAO Z Y , et al . All your location are belong to us: breaking mobile social networks for automated user location tracking [C ] // Proceedings of the 15th ACM International Symposium on Mobile Ad Hoc Networking and Computing . New York : ACM , 2014 : 43 - 52 .

CHENG H N , MAO S L , XUE M H , et al . On the impact of location errors on localization attacks in location-based social network services [C ] //WANG G, RAY I, ALCARAZ CALERO J, et al. International Conference on Security , Privacy and Anonymity in Computation, Communication and Storage . Cham : Springer , 2016 : 343 - 357 .

SHI W Q , LUO X Y , ZHAO F , et al . Geolocating a WeChat user based on the relation between reported and actual distance [J ] . International Journal of Distributed Sensor Networks , 2018 , 14 ( 4 ): 1550147718774462 .

PENG J W , MENG Y , XUE M H , et al . Attacks and defenses in location-based social networks: a heuristic number theory approach [C ] // Proceedings of the 2015 International Symposium on Security and Privacy in Social Networks and Big Data (SocialSec) . Piscataway : IEEE Press , 2015 : 64 - 71 .

POLAKIS I , ARGYROS G , PETSIOS T , et al . Where’s wally? precise user discovery attacks in location proximity services [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2015 : 817 - 828 .

时文旗 , 罗向阳 , 郭家山 . 基于加权最小二乘的社交网络用户定位方法 [J ] . 网络与信息安全学报 , 2022 , 8 ( 3 ): 41 - 52 .

SHI W Q , LUO X Y , GUO J S . Social network user geolocating method based on weighted least squares [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 3 ): 41 - 52 .

ANDY M , LAUREN S G . The ESRI guide to GIS analysis, volume 2: spartial measurements and statistics [M ] . Redlands : ESRI press , 2005 : 109 - 111 .

ESTER M , KRIEGEL H P , SANDER J , et al . A density-based algorithm for discovering clusters in large spatial databases with noise [C ] // Proceedings of the Second International Conference on Knowledge Discovery and Data Mining . New York : ACM , 1996 : 226 - 231 .

PRIM R C . Shortest connection networks and some generalizations [J ] . Bell System Technical Journal , 1957 , 36 ( 6 ): 1389 - 1401 .

FAWCETT T . An introduction to ROC analysis [J ] . Pattern Recognition Letters , 2006 , 27 ( 8 ): 861 - 874 .

DAVIS J , GOADRICH M . The relationship between Precision-Recall and ROC curves [C ] // Proceedings of the 23rd International Conference on Machine learning - ICML '06 . New York : ACM , 2006 : 233 - 240 .

HAN S Q , HU X Y , HUANG H L , et al . ADBench: anomaly detection benchmark [EB ] . arXiv Preprint , 2022 , arXiv: 2206.09426 .

PROKHORENKOVA L , GUSEV G , VOROBEV A , et al . CatBoost: unbiased boosting with categorical features [C ] // Proceedings of the 32nd International Conference on Neural Information Processing Systems . New York : ACM , 2018 : 6639 - 6649 .

CHEN T Q , GUESTRIN C . XGBoost: a scalable tree boosting system [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2016 : 785 – 794 .

KE G L , MENG Q , FINLEY T , et al . LightGBM: a highly efficient gradient boosting decision tree [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems . New York : ACM , 2017 : 3149 - 3157 .

YANG Z , WILSON C , WANG X , et al . Uncovering social network Sybils in the wild [J ] . ACM Transactions on Knowledge Discovery from Data , 2014 , 8 ( 1 ): 2 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法

基于垂直分割的个人数据隐私保护方法

恶意软件检测和分类可视化技术综述