高级检索
    杨征, 殷其雷, 李浩然, 苗园莉, 元东, 王骞, 沈超, 李琦. 微信恶意账号检测研究[J]. 计算机研究与发展, 2021, 58(11): 2319-2332. DOI: 10.7544/issn1000-1239.2021.20210461
    引用本文: 杨征, 殷其雷, 李浩然, 苗园莉, 元东, 王骞, 沈超, 李琦. 微信恶意账号检测研究[J]. 计算机研究与发展, 2021, 58(11): 2319-2332. DOI: 10.7544/issn1000-1239.2021.20210461
    Yang Zheng, Yin Qilei, Li Haoran, Miao Yuanli, Yuan Dong, Wang Qian, Shen Chao, Li Qi. Study of Wechat Sybil Detection[J]. Journal of Computer Research and Development, 2021, 58(11): 2319-2332. DOI: 10.7544/issn1000-1239.2021.20210461
    Citation: Yang Zheng, Yin Qilei, Li Haoran, Miao Yuanli, Yuan Dong, Wang Qian, Shen Chao, Li Qi. Study of Wechat Sybil Detection[J]. Journal of Computer Research and Development, 2021, 58(11): 2319-2332. DOI: 10.7544/issn1000-1239.2021.20210461

    微信恶意账号检测研究

    Study of Wechat Sybil Detection

    • 摘要: 社交网络是一个有效的信息传播平台,使得人们的生活更加便捷.同时,在线社交网络也不断提高了社交网络账号的价值.然而,为了获取非法利益,犯罪团伙会利用社交网络平台隐秘地开展各种诈骗、赌博等犯罪活动.为了保护用户的社交安全,各种基于用户行为、关系传播的恶意账号检测方法被提出.此类方法需要积累足够的用户数据才能进行恶意检测,利用这个时间差,犯罪团伙可以开展大量的犯罪活动.首先系统分析了现有恶意账号检测工作.为克服现有方法的缺点而更快地检测恶意账号,设计了一种基于账号注册属性的恶意账号检测方法.方法首先通过分析恶意账号和正常账号在不同属性值上的分布,设计并提取了账号的相似性特征和异常特征;然后基于此计算两两账号的相似度构图以聚类挖掘恶意注册团体,从而有效实现注册阶段的恶意账号检测.

       

      Abstract: Online social networks (OSNs) are efficient platforms for information dissemination and facilitate our daily life. The value of OSN accounts increases with the popularity of OSNs. In order to obtain profits illegally, attackers leverage OSNs to construct various attacks such as fraud and gambling. A number of solutions have been proposed to protect users’ security, which mainly focuses on detecting malicious accounts (or Sybils) by analyzing user behavior or the propagation of user relations. Unfortunately, it usually takes much time to collect enough data to perform malicious account detection. Attackers can perform different kinds of attacks during the data collection phase. To detect Sybils efficiently, we propose a new approach that leverages account registration attributes to detect Sybils. First, we analyze the existing detection methods in sybil detection. Then, we analyze the registration data of WeChat. We analyze and compare the distribution of Sybils and benign accounts in different registration attributes, and find that Sybils are prone to cluster with some registration attributes. According to these statistics, we extract two kinds of features from different attributes, i.e., synchronization-based features and anomaly-based features, and calculate the similarity of two accounts based on those features. The accounts that have high similarity are more likely to be malicious. Finally, we build a graph upon accounts having a high similarity to cluster malicious users. We calculate a malicious score for each user to infer whether it is a Sybil. We prototype our approach, and the experimental results with real WeChat show that our approach can achieve 96% precision and 60% recall.

       

    /

    返回文章
    返回