AbuSniff: Automatic Detection and Defenses Against Abusive Facebook Friends

Abstract

Adversaries leverage social network friend relationships to collect sensitive data from users and target them with abuse that includes fake news, cyberbullying, malware, and propaganda. Case in point, 71 out of 80 user study participants had at least 1 Facebook friend with whom they never interact, either in Facebook or in real life, or whom they believe is likely to abuse their posted photos or status updates, or post offensive, false or malicious content. We introduce AbuSniff, a system that identifies Facebook friends perceived as strangers or abusive, and protects the user by unfriending, unfollowing, or restricting the access to information for such friends. We develop a questionnaire to detect perceived strangers and friend abuse. We introduce mutual Facebook activity features and show that they can train supervised learning algorithms to predict questionnaire responses. We have evaluated AbuSniff through several user studies with a total of 263 participants from 25 countries. After answering the questionnaire, participants agreed to unfollow and restrict abusers in 91.6% and 90.9% of the cases respectively, and sandbox or unfriend non-abusive strangers in 92.45% of the cases. Without answering the questionnaire, participants agreed to take the AbuSniff suggested action against friends predicted to be strangers or abusive, in 78.2% of the cases. AbuSniff increased the participant self-reported willingness to reject invitations from strangers and abusers, their awareness of friend abuse implications and their perceived protection from friend abuse.

Malware Detection and Analysis Tools

“…is called dynamic analysis. Before executing the malware sample, the appropriate monitoring tools like Process Monitor [13] and Capture BAT [14] (for file system and registry monitoring), Process Ex-plorer [15] and Process Hackerreplace [16] (for process monitoring), Wireshark [17] (for network monitoring) and Regshot [18] (for system change detection) are installed and activated.…”

“…Mobile technology in healthcare has also been a target of malware [10]. Few recent studies have been done on static and dynamic analysis of Android malware [11], de-tection using permission [12][13][14], based on system call sequences and LSTM [15].Many studies use static analysis for malware detection using exact decompilation [16], similarity testing framework [17], based on register contents [18], using two-dimensional binary program features [19], subroutine based detection [20], statistics of assembly instructions [21], file rela-tion graphs [22], de-anonymizing programmers via code stylometry [23], based upon a wavelet package technique [24], analysis and comparison of disassemblers for opcode [25].The studies that use dynamic analysis perform synthesis the semantics of obfuscated code [7], multihypothesis testing [26], analyzing quantitative data flow graph metrics [27], using simplified data-dependent api call graph [28], downloader graph analytics [29], access behavior [30,31], APIs in initial behavior [32], log-based crowdsourcing analysis [33].…”

Android malware detection via efficient application programming interface call sequences extraction and machine learning classifiers

“…The secure and controlled environment is a virtual platform [7] (e.g. virtual machine, simulator, emulator, and sandbox), and provides many system tools, such as Process Explorer [8] for process monitoring, Capture BAT [9] for file system, Wireshark [10] for network monitoring and Regshot [11] for system change detection [12]. Malwares will perform various threatening behaviours during running, such as modifying the file system, manipulating the registry and issuing HTTP requests.…”