Enhancing and identifying cloning attacks in online social networks

ABSTRACT

Recently Online Social Networks (OSNs) are enjoying a continuous boom, while suffering from omnifarious malicious attacks. Cloning attack is one of the attack patterns towards online social networks, where typically the attacker disguises fake accounts as real users by thieving and copying their profiles, and sends friend requests to the friends of the cloned victim. It is difficult for ordinary users to detect these fake identities because of the identical names and similar profile information. In this paper, we raise two possible improvements, namely snowball sampling and iteration attack, to the regular attack pattern upgrading its efficiency and power, so that the attackers can more easily engage into the community. An experiment has been conducted on Renren, the largest OSN in China, to fully compare and substantiate the effectiveness of the enhanced strategy with traditional attacks and different levels of cloning attacks. Then we discuss approaches to detect cloning attacks and put forward a detector named CloneSpotter, which can be deployed into OSN servers. The detector takes advantage of the detailed login IP records and provides solid evidence of locations, in order to judge whether the suspicious accounts are manipulated by real users or attackers. Besides, we discuss a content-based approach to protect users from cloning attacks, which can be easily implemented into distributed clients.

Our contribution lies in two aspects. First, we improve a threatening attack pattern towards OSNs, and test its effectiveness in real systems. Second, we provide an effective defense method to detect cloning attacks, which is real-time and lightweight. By deploying the detectors, OSN systems can assist users to accurately distinguish cloning accounts, and safeguard their privacy.

References

1. P. Biernacki and D. Waldorf. Snowball sampling: Problems, techniques and chain-referral sampling. Sociological Methods And Research, 10(2): 141--163, 1981.
2. L. Bilge, T. Strufe, D. Balzarotti, and E. Kirda. All your contacts are belong to us: automated identity theft attacks on social networks. In Proceedings of the 18th international conference on World wide web, WWW '09, pages 551--560, New York, NY, USA, 2009. ACM.
3. G. Danezis and P. Mittal. Sybilinfer: Detecting sybil nodes using social networks.
4. J. Douceur. The sybil attack. In P. Druschel, F. Kaashoek, and A. Rowstron, editors, Peer-to-Peer Systems, volume 2429 of Lecture Notes in Computer Science, pages 251--260. Springer Berlin / Heidelberg, 2002.
5. L. Garton, C. Haythornthwaite, and B. Wellman. Studying online social networks. Journal of Computer-Mediated Communication, 3(1): 0--0, 1997.
6. S. Ghosh, B. Viswanath, F. Kooti, N. K. Sharma, G. Korlam, F. Benevenuto, N. Ganguly, and K. P. Gummadi. Understanding and combating link farming in the twitter social network. In Proceedings of the 21st international conference on World Wide Web, WWW '12, pages 61--70, New York, NY, USA, 2012. ACM.
7. N. Hastings and P. McLean. Tcp/ip spoofing fundamentals. In Computers and Communications, 1996., Conference Proceedings of the 1996 IEEE Fifteenth Annual International Phoenix Conference on, pages 218--224, mar 1996.
8. P. Heymann, G. Koutrika, and H. Garcia-Molina. Fighting spam on social web sites: A survey of approaches and future challenges. Internet Computing, IEEE, 11(6): 36--45, nov.-dec. 2007.
9. M. Huber, M. Mulazzani, E. Weippl, G. Kitzler, and S. Goluch. Friend-in-the-middle attacks: Exploiting social networking sites for spam. Internet Computing, IEEE, 15(3): 28--34, may-june 2011.
10. J. Jiang, Z. Shan, W. Sha, X. Wang, and Y. Dai. Detecting and validating sybil groups in the wild. In Distributed Computing Systems Workshops (ICDCSW), 2012 32nd International Conference on, pages 127--132, june 2012.
11. G. Kontaxis, I. Polakis, S. Ioannidis, and E. Markatos. Detecting social network profile cloning. In Pervasive Computing and Communications Workshops (PERCOM Workshops), 2011 IEEE International Conference on, pages 295--300, march 2011.
12. N. Tran, B. Min, J. Li, and L. Subramanian. Sybil-resilient online content voting. In Proceedings of the 6th USENIX symposium on Networked systems design and implementation, NSDI'09, pages 15--28, Berkeley, CA, USA, 2009. USENIX Association.
13. W. Wei, F. Xu, C. Tan, and Q. Li. Sybildefender: Defend against sybil attacks in large social networks. In INFOCOM, 2012 Proceedings IEEE, pages 1951--1959, march 2012.
14. C. Yang, R. Harkreader, J. Zhang, S. Shin, and G. Gu. Analyzing spammers' social networks for fun and profit: a case study of cyber criminal ecosystem on twitter. In Proceedings of the 21st international conference on World Wide Web, WWW '12, pages 71--80, New York, NY, USA, 2012. ACM.
15. Z. Yang, C. Wilson, X. Wang, T. Gao, B. Y. Zhao, and Y. Dai. Uncovering social network sybils in the wild. In Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, IMC '11, pages 259--268, New York, NY, USA, 2011. ACM.
16. H. Yu, P. Gibbons, M. Kaminsky, and F. Xiao. Sybillimit: A near-optimal social network defense against sybil attacks. In Security and Privacy, 2008. SP 2008. IEEE Symposium on, pages 3--17, may 2008.
17. H. Yu, M. Kaminsky, P. B. Gibbons, and A. Flaxman. Sybilguard: defending against sybil attacks via social networks. SIGCOMM Comput. Commun. Rev., 36(4): 267--278, Aug. 2006.

Index Terms

• Applied computing

  • Law, social and behavioral sciences

• Human-centered computing

  • Collaborative and social computing

    • Collaborative and social computing systems and tools

• Information systems

  • World Wide Web