Research On Bot Of Social Networks

Online social networks (OSNs) such as Facebook, Twitter, and Weibo are widelyused on the Internet. They are changing the way people communicate and interact withthe Internet. Due to the popularity of OSNs, attackers begin to design malicioussoftware that focuses on OSNs. A social bot is automated software running on a user’scomputer in the background. It controls an account on a particular OSN, andcommunicates with the bot master through posting and receiving messages from theOSN. This dissertation focuses on defense and detection of malicious bot programs,and makes contributions in the following four aspects:1. Analysis of botnet detection technique based on traffic graph. This paperpresents the structures and characteristics of Botnet communication graphs in severalcommon protocols. We compare and analyze their functions and mechanisms. We thensummarize some recent research of Botnet detection methods based on traffic graph.We further conduct a comparative analysis on their environments, experimental dataand results, the advantages and disadvantages of the methods. In the end, we proposesome possible improvements for Botnet detection.2．Detecting bot by correlating host behavior and network activity. We propose anovel correlation detection approach to detect this kind of bot. We utilize sliding timewindow iterative algorithm to solve the problem that host behavior and networkactivity of this kind of bot may be performed in different time windows, which provesto improve the detection accuracy. We utilize recommendation algorithm to correlatehost behavior and network activity to solve the problem that host-based detectionapproaches need global deployment. We analyze the influence of sliding time windowsize and host detection tools deployment rate on detection accuracy.3. Understanding social bot behavior on end hosts. We analyzed a series ofrepresentative social bots in depth, and then summarized the typical features of socialbot behaviors. First, we collected a representative set of social bots, which are widelyused in the literature. Second, we created a social bot simulated runtime environmentequipped with monitoring software in virtual machines. Third, we use the correlationanalysis method to analyze the profile data of social bot at runtime.