Abstract

Compromised accounts in Online Social Networks (OSNs) are more positive than Sybil accounts to spammers and other malicious OSN attacker. Malicious parties exploit the well-established relations and trust connection between the genuine account owners and their friends. In this paper we study the friend’s collusiveness feature of OSN users, i.e. their usage of OSN services, and the application of which in detecting compromised accounts. We propose a set of social friends’ collusiveness features that can effectively characterize the user social activities on OSNs. We validate the efficacy of these friends’ collusiveness features by collecting and analyzing real user click streams to an OSN website. Based on our measurement study, we devise individual user’s social behavioral profile by combining its respective friend’s collusiveness features metrics. A social behavioral profile correctly reflects a user’s OSN activity patterns. While an authentic owner conforms to its account’s social behavioral profile reluctantly, it is hard and costly for imposters to feign.