Abstract:Malicious accounts are one of the biggest threats to the security and privacy of online social networks (OSNs). In this work, we study a new type of OSN, called privacy-centric mobile social network (PC-MSN), such as KakaoTalk and LINE, which has attracted billions of users recently. The design of PC-MSN is inspired to protect their users' privacy from strangers: (1) a stranger is not easy to send a friend request to a user who does not want to make friends with strangers; and (2) strangers cannot view a user's post. Such a design mitigates the security issue of malicious accounts. At the same time, it also brings the battleground between attackers and defenders to an earlier stage, i.e., making friendship, than the one studied in previous works. Also, previous defense proposals mostly rely on certain assumptions on the attacker, which may not be robust in the new PC-MSNs. As a result, previous malicious accounts detection approaches are less effective on a PC-MSN. To mitigate this issue, we study the patterns in friend requests to distinguish malicious accounts, and perform a systematic study over 1 million labeled data from WLink, a real PC-MSN with billions of users, to confirm our hypothesis. Based on the results, we propose dozens of new features and leverage machine learning to detect malicious accounts. We evaluate our method and compare it with existing methods, and the results show that our method achieves a precision of 99.5% and a recall of 98.4%, which significantly outperform previous state-of-the-art methods. Importantly, we qualitatively analyze the robustness of the designed features, and our evaluation shows that using only robust features can achieve the same level of performance as using all features. WLink has deployed our detection method. Our method can detect 0.59 million malicious accounts daily, which is 6 times higher than the previous deployment on WLink, with a precision of over 90%.

I Know Your Social Network Accounts: A Novel Attack Architecture for Device-Identity Association

MagAttack - Guessing Application Launching and Operation via Smartphone.

A Nonlinearity-Based Secure Face-to-Face Device Authentication for Mobile Devices

Characterizing and Detecting Malicious Accounts in Privacy-Centric Mobile Social Networks: A Case Study

A Defence Scheme Against Identity Theft Attack Based on Multiple Social Networks

Adversarial WiFi Sensing Using a Single Smartphone

DeviceWatch: Identifying Compromised Mobile Devices through Network Traffic Analysis and Graph Inference

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

Smart App Attack: Hacking Deep Learning Models in Android Apps

2 SocialImpact : Bring Order to Online Underground Social Dynamics

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Lie to Me: Abusing the Mobile Content Sharing Service for Fun and Profit

A Novel Location Privacy Protection Algorithm for Social Discovery Application

Stealing Reality

A Brief Survey on De-anonymization Attacks in Online Social Networks

IoTBeholder: A Privacy Snooping Attack on User Habitual Behaviors from Smart Home Wi-Fi Traffic.

Attacking Strategies and Temporal Analysis Involving Facebook Discussion Groups

Need for Symmetry: Addressing Privacy Risks in Online Social Networks

Seeing is (Not) Believing: Practical Phishing Attacks Targeting Social Media Sharing Cards

Peek-a-Boo: I see your smart home activities, even encrypted!

No Seeing is Also Believing: Electromagnetic-emission-based Application Guessing Attacks via Smartphones