Twitter Games: How Successful Spammers Pick Targets Vasumathi Sridharan, Vaibhav Shankar, Minaxi Gupta School of Informatics and Computing, Indiana University ACSAC2012

OUTLINE Introduction - DATA COLLECTION - TWEET TYPES STRATEGIES FOR PICKING TARGET DISCUSSION - Posting methodology - Unbinned Spam Profiles - Gathering followers RELATE WORK CONCLUSION

Introduction spam has been a problem for decades As spam filtering programs have improved, with many claiming 99% or higher accuracies Spammers have looked for other avenues Online social networks (OSNs)

OSN: TWITTER WHY Twitter ? - Twitter alone boasted 140 million users as of March 2012 [20] - Fighting spam on OSNs requires new types of filtering techniques New topic of spam on OSNs (Classifiers) we do not know how spammers pick their targets

DATA COLLECTION Twitter’s streaming API (collect tweets)(samples) November ,991,050 tweets / 7,078,643 profiles we visited looked for suspended profiles (SPAM?) suspended profiles

suspended profiles

DATA COLLECTION Eliminated languages other than English > (suspended profiles) 10 tweets within five days -successful spam profiles (14230) -unsuccessful spam profiles

70% of unsuccessful spam profiles and 15% of successful spam profiles get suspended on the first day [16] 77% of spam profiles were suspended on the first day and 92% within three days> [16] Thomas, K., Grier, C., Song, D., and Paxson, V. Suspended accounts in retrospect: an analysis of twitter spam. In ACM/USENIX Internet Measurement Conference (IMC) (2011)

TWEET TYPES regular tweet Attack : Sender’s follower reply tweet Attack : anyone mention tweet Attack : anyone Retweet Attack : Sender’s follower

1. Regular Tweets: Successful spam > Unsuccessful spam 2. Replies Tweets :Successful spam < Unsuccessful spam Twitter is known to suspend accounts which send large numbers of replies or mentions [19] 3. Mention Tweets: Successful, Unsuccessful : 1/5,1/4 Thomas et al. a year ago [16] found that 52% of spam profiles made use of mention tweets. we conclude that Twitter spammers have evolved their strategies in the last one year

We find that over 3/4 of successful spam profiles exclusively used only one type of tweet Spammers vs Other-user 3/4 2/3 14 %

STRATEGIES FOR PICKING TARGET 1.Spamming Ones Own Followers 2.Spamming Followers of Popular Profiles 3.Spamming based on Keywords in Tweets 4.Trending Topics Hijacking 5.Targeting Own Followers by Reweets

Spamming Ones Own Followers Nearly 40% of unsuccessful spam profiles have zero followers and a total of 2/3 (66%) have less than 10. Thomas et al. noted in their work that 89% of spam profiles have less than 10 followers. (1 year before) 1/3 of successful spam profiles have over a 100 followers spammers become smarter

14230 profiles >> ten regular tweets with link >> 7704 >> 80% Url same Domain >> <> 559 different domains - t.co (1822) - Amazon.com (1741) Affiliate ID

Amazon.com All profiles using the same affiliate ID were clearly part of the same campaign. Profiles across multiple IDs belonged to a spam campaign Top five

Spamming Followers of Popular Profiles Ex. Basketball lovers, Reply or Mention tweets ( >4 user receive same spam & 50% follow same person ) >> reply or mention >> 4086 >> 877 (26)

Spamming based on Keywords in Tweets Spammers can also pick their targets based on the content of tweets from Twitter users. ex: search “bumbler” “justinbieber” Reply or Mention tweets (TF-IDF[8] 7 million words(spam tweets) -> 50K words) 1004 (1)(150) Spam reply tweet: Here ip5 0rz.tw/ab source tweet: Wow ip5~

Trending Topics Hijacking Hashtag ( 圖 ) Ex. #bumbler Spammers have been known to hijack trending topics to increase the visibility of their spam campaigns [16] Various types of tweets (#iphone5) 4327 (spam,#) >> top 200 hashtag >> 1043 (523)(14)(3)

Targeting Own Followers by Reweets Reweets 1230 used retweets 1230 >> 10 tweets with url >> retweeting from omgwire (promoting) Overall 5 methods 8805 / (61.9%)

DISCUSSION - Posting methodology - Unbinned Spam Profiles - Gathering followers

Posting methodology

Twitterfeed : sucessful spammer tweets 2/3 Web : profiles

Others *organic profiles use several different apps, where as spammers have fewer dedicated apps. 92% 80%60%

Unbinned Spam Profiles Overall 5 methods 8805 / (61.9%) 10 url tweets, 80% same domain (5 url, 50%) 61.9 % >> 72% TweetAdder, based on their geographical location and language Not spamer (ex. violence)

Gathering followers 1. communities (encourage following back) #InstantFollowBack(#IFB) 2. Buy

fiverr

RELATE WORK YOUTUBE [2] video spam on Youtube and employ machine learning techniques to identify spammers on YouTube FaceBook [5] involves detecting and characterizing spam campaigns on Facebook.

youtube

CONCLUSION We analyzed strategies of successful Twitter spammers Particularly as they relate to picking spam target The spammers themselves evolved in a mere mattter of one year(Thomas [16]) Need more data

End THANKS