SocialClymene: A negative reputation system for covert botnet detection in social networks

Abstract

Online social networks, or simply social networks, are one of the most popular services on the Internet, providing a platform for users to interact, communicate, and collaborate with others. With this in mind, they have been able to attract millions of active users. However, they are being increasingly threatened by so-called covert social network botnets, a new generation of botnets that exploit social networks to establish covert command and control channels. Stego-botnets are typical covert social network botnets that use images shared on a social network to send the botmaster's commands and receive the information stolen from infected users. In this paper, we present SocialClymene, a PageRank-based negative reputation system to detect stego-botnets. At the heart of SocialClymene lies a negative reputation subsystem that analyzes images shared by social network users and calculates a negative reputation score for every user based on the user's history of participation in suspicious group activities. More precisely, the negative reputation score of every user is calculated by the sum of its incoming normalized suspicious values weighted by the negative reputation scores of its neighbors in a suspicious group activity graph. Our experimental results have shown that SocialClymene can efficiently detect stego-botnets with a high detection rate and an acceptable low false alarm rate.