Privacy Issues in Light of Reconnaissance Attacks with Incomplete Information

Abstract

A reconnaissance attack, in which attackers lure targets into becoming their friends in order to extract victims' sensitive information for sale or use in future attacks, is one of the most dangerous attacks in social networks. The core of this attack lies in intelligently sending friend requests to a small subset of users, called Critical Friending Set (CFS), so that the attacker can evade current defense mechanisms. Motivated by the above, we present a new paradigm to measure OSN vulnerability in light of reconnaissance attacks. Specifically, we introduce a new optimization problem, namely Min-Friending, which identifies a minimum CFS to friend in order to obtain at least Q benefit, in terms of personal information. A significant challenge of this problem is that network information (i.e. who friends with whom) is generally unknown to attackers. In this paper, we show that Min-Friending is inapproximable within a factor of (1 – o(1)) ln Q and present an adaptive algorithm which has a tight performance bound of (1+ln Q) using adaptive stochastic optimization. The key feature of our solution lies in the adaptive method, where partial network topology is revealed during each successful friend request. Thus the decision of sending each friend request is made taking into account observation about the outcomes of past decisions.