Real-time Classification of Malicious URLs on Twitter using Machine Activity Data

Abstract

Massive online social networks with hundreds of millions of active users are increasingly being used by Cyber criminals to spread malicious software (malware) to exploit vulnerabilities on the machines of users for personal gain. Twitter is particularly susceptible to such activity as, with its 140 character limit, it is common for people to include URLs in their tweets to link to more detailed information, evidence, news reports and so on. URLs are often shortened so the endpoint is not obvious before a person clicks the link. Cyber criminals can exploit this to propagate malicious URLs on Twitter, for which the endpoint is a malicious server that performs unwanted actions on the person's machine. This is known as a drive-by-download. In this paper we develop a machine classification system to distinguish between malicious and benign URLs within seconds of the URL being clicked (i.e. 'real-time'). We train the classifier using machine activity logs created while interacting with URLs extracted from Twitter data collected during a large global event-the Superbowl-and test it using data from another large sporting event-the Cricket World Cup. The results show that machine activity logs produce precision performances of up to 0.975 on training data from the first event and 0.747 on a test data from a second event. Furthermore, we examine the properties of the learned model to explain the relationship between machine activity and malicious software behaviour, and build a learning curve for the classifier to illustrate that very small samples of training data can be used with only a small detriment to performance.

Using supervised machine learning algorithms to detect suspicious URLs in online social networks

“…They do this by conducting spam campaigns that make their "fake" accounts connect with other fake accounts, increasing the follower and following numbers [22]. The majority of previous studies [23][24] [21] begin by collecting data using the Twitter streaming API 3 . Multiple features are then extracted and different feature sets utilized.…”

“…Burnap et al [23] used an entirely different method to detect malicious URLs. They deployed a high-interaction honey-net 4 to collect system state changes, such as the sending/receiving packets and CPU usage.…”

Review on Detecting OSN Malicious Account and Fake Reviews in Online Promotions

“…As, this is an automatic detection method, It can be applied easily by online social networks which has millions of people whose profiles cannot be examined manually. Pete Burnap, et.all [7] :-In this paper they have develop a machine classification system that distinguish between Malicious and benign URLs within seconds of the URL being clicked. They have train the classifier using machine activity logs created while interacting with URLs extracted from Twitter data collected from large sporting event and test it using data collect from another large sporting event the Cricket World Cup.…”

A Framework for Evaluating Anti Spammer Systems for Twitter

“…A number of researchers have utilized features related to URLs. Examples of these are the number of URLs [9], the number of URLs per word [6], and the number of unique URLs [10]. In Twitter, the #hashtag is used to describe a term, event, or emotion.…”

“…When the user selects the name of an existing anti spammer system, WEST automatically selects the set of features used by that system. WEST also allows for new features to be added by the user and presently there are 17 systems [1,2,4,[6][7][8][9][10][11][12][13][14][15][16][17][18][19] and 173 features. Each of those features can be grouped into four types: profile, activities, relations, and tweet contents.…”