TWC: Medium: Collaborative: Online Social Network Fraud and Attack Research and Identification

在线社交网络(OSN)面临各种形式的欺诈和攻击，如垃圾邮件、拒绝服务、Sybil攻击和病毒式营销。为了建立可信和安全的OSN，开发分析和检测OSN欺诈和攻击的技术变得至关重要。现有的OSN安全方法通常针对特定类型的OSN欺诈或攻击，并且经常无法检测到更复杂的攻击，例如涉及许多欺诈性OSN帐户的合谋攻击，或者随着时间的推移包含多个攻击阶段的动态攻击。这项名为oSAFARI(在线社交网络欺诈和攻击研究与识别)的研究对OSN欺诈和攻击进行建模、分析和表征；设计、开发和评估一种检测静态OSN欺诈和攻击的新方法；并进一步增强多阶段处理动态攻击的方法。研究小组计划开发一门专注于OSN攻击和防御的新课程，该课程有可能在许多机构提供。为了提高公共安全意识，该团队还计划开发关于典型OSN攻击及其防御的教程课程，并在受欢迎的公共活动和新生课堂上提供这些课程。研究团队将向研究社区、IT行业和OSN公司广泛传播他们的结果、工具、软件和文档。该项目包括对OSN欺诈和攻击进行系统、全面的研究。它通过将OSN视为嵌入了攻击者节点和边的图来对OSN威胁进行建模，识别和分析特定形式的欺诈和攻击，并评估最先进的攻击分析和防御方法。它开发了一个基于频谱分析的OSN欺诈和攻击检测框架。该框架将OSN图的拓扑信息转换为谱空间中由谱坐标形成的模式，并引入谱图扰动理论来更容易地建模和捕获攻击者、受害者和规则节点的谱坐标变化。此外，本研究开发了基于谱分析的复杂网络检测方法，其中节点可以携带属性，边可以是负的、加权的或不对称的。通过将网络动力学和向量自回归模型相结合，提出了一种基于自动谱分析的动态攻击检测方法，同时避免了传统方法的高成本和低精度。它还将攻击特征从高维频谱空间转换为独特的视觉模式，并为分析人员开发交互机制，以整合领域知识并灵活处理攻击。研究团队将构建一个仿真框架来评估针对不同类型的OSN攻击的检测方法，在其中可以插入不同的OSN数据集来评估和比较不同的检测方法。此外，研究团队将在OSN上构建一个原型oSAFARI，并评估oSAFARI如何在真实环境中抵御各种攻击。

Online social networks (OSNs) face various forms of fraud and attacks, such as spam, denial of service, Sybil attacks, and viral marketing. In order to build trustworthy and secure OSNs, it has become critical to develop techniques to analyze and detect OSN fraud and attacks. Existing OSN security approaches usually target a specific type of OSN fraud or attack and often fall short of detecting more complex attacks such as collusive attacks that involve many fraudulent OSN accounts, or dynamic attacks that encompass multiple attack phases over time. This research, dubbed oSAFARI (Online SociAl network Fraud and Attack Research and Identification), models, analyzes and characterizes OSN frauds and attacks; designs, develops, and evaluates a new approach to detecting static OSN frauds and attacks; and further enhances the approach to handle dynamic attacks with multiple phases. The research team plans to develop a new course focused on OSN attacks and defenses, which has the potential to be offered across many institutions. To increase public security awareness, the team also plans to develop tutorial courses on typical OSN attacks and their defense and offer them at popular public events and in freshman classes. The research team will broadly disseminate their results, tools, software, and documents to the research community, IT industries, and to OSN companies. This project embraces a systematic, comprehensive study of OSN frauds and attacks. It models OSN threats by viewing an OSN as a graph embedded with attacker nodes and edges, identifies and analyzes specific forms of frauds and attacks, and evaluates state-of-the-art attack analysis and defense approaches. It develops a spectral-analysis-based framework for OSN fraud and attack detection. The framework transforms topological information of an OSN graph into patterns formed by spectral coordinates in the spectral space, and introduces the use of the spectral graph perturbation theory to more easily model and capture changes of spectral coordinates for attacker, victim, and regular nodes. Further, this research develops spectral-analysis-based detection approaches for complex networks where nodes can carry attributes and edges can be negative, weighted, or asymmetric. Through a novel combination of the network dynamics and the vector autoregressive model, it develops an automatic spectral-analysis-based approach to detecting dynamic attacks while avoiding the high cost and low accuracy of traditional approaches. It also transforms attack characteristics from high-dimensional spectral spaces into distinctive visual patterns, and develops interactive mechanisms for analysts to incorporate domain knowledge and flexibly handle attacks. The research team will build a simulation framework to evaluate the detection approaches against different types of OSN attacks, where one can plug in different OSN datasets to evaluate and compare different detection approaches. Moreover, the research team will build a prototype oSAFARI on top of an OSN, and evaluate how oSAFARI can withstand various attacks in a real setting.