Multilevel Analysis to Detect Covert Social Botnet in Multimedia Social Networks

Abstract

In recent years, social botnets have become a major security threat to both online social networking websites and their users. Social bots communicate over probabilistically unobservable communication channels and steal sensitive information from its victims. Stegobot is a social botnet which uses image steganography to hide the presence of communication. Since these botnets exhibit unique propagation methods, existing botnet detection techniques cannot identify these bots. In this paper, we propose an effective method to detect Stegobot hosts within a monitored social network. Based on the observations, Stegobot often has a differentiable communication pattern because of the unique design and implementation. Hence by investigating each host profile activity, it is possible to determine whether the profile is a Stegobot or normal. Our experiments show that the traffic patterns among Stegobot and normal traffic can be classified efficiently using multilevel social network profile analysis. In addition to the ability to detect bot traffic, a classification model is constructed using profile level and content level analysis to improve the detection ability. The experimental results show that the proposed method can detect Stegobot profiles with more than 97% accuracy and false-positive rate lower than 3%.