Towards understanding bogus traffic service in online social networks

Abstract

Critical functionality and huge influence of the hot trend/topic page (HTP) in microblogging sites have driven the creation of a new kind of underground service called the bogus traffic service (BTS). BTS provides a kind of illegal service which hijacks the HTP by pushing the controlled topics into it for malicious customers with the goal of guiding public opinions. To hijack HTP, the agents of BTS maintain an army of black-market accounts called bogus traffic accounts (BTAs) and control BTAs to generate a burst of fake traffic by massively retweeting the tweets containing the customer desired topic (hashtag). Although this service has been extensively exploited by malicious customers, little has been done to understand it. In this paper, we conduct a systematic measurement study of the BTS. We first investigate and collect 125 BTS agents from a variety of sources and set up a honey pot account to capture BTAs from these agents. We then build a BTA detector that detects 162 218 BTAs from Weibo, the largest Chinese microblogging site, with a precision of 94.5%. We further use them as a bridge to uncover 296 916 topics that might be involved in bogus traffic. Finally, we uncover the operating mechanism from the perspectives of the attack cycle and the attack entity. The highlights of our findings include the temporal attack patterns and intelligent evasion tactics of the BTAs. These findings bring BTS into the spotlight. Our work will help in understanding and ultimately eliminating this threat.

摘要

由于热门趋势/话题页在在线社交网络平台中的巨大影响力,一种名为社交网络虚假流量服务的新的灰黑色产业应运而生。社交网络虚假流量服务提供了一种恶意服务使得想引导舆论的恶意客户将其给定话题推送到社交网络热门趋势/话题页。为达成他们劫持社交网络热门趋势/话题页,这些服务的提供商维持着一支被称为“虚假流量账户”的恶意账户大军,他们控制这些账户,通过短时间内大量转发含有客户所需话题(标签)的推文产生大量虚假流量。尽管这项服务已经广泛影响了社交网络生态,但人们对它知之甚少。本文对社交网络虚假流量服务进行系统性的测量研究。首先调查并发现不同来源的125个社交网络虚假流量提供商,并设立一个蜜罐账户捕获这些提供商控制的恶意账户。之后,建立了一个社交网络虚假流量检测器,从中国最大的微博网站新浪微博中检测出162 218个恶意账户,检测精度达到94.5%。进一步利用这些恶意账户作为桥梁,发现了296 916个可能涉及虚假流量的话题。最后,从攻击周期和攻击实体的角度揭示了社交网络虚假流量灰黑色产业链的运行机制。其中,发现了涉及社交网络虚假流量的恶意账户的时间性攻击模式和智能规避战术。这些发现使得社交网络虚假流量的运行机制暴露在大众的视野下。基于这些发现,我们的工作将有助于理解并最终消除这种威胁。

Supplementary materials for

Appendix