Understanding a prospective approach to designing malicious social bots

Abstract

AbstractThe security implications of social bots are evident in consideration of the fact that data sharing and propagation functionality are well integrated with social media sites. Existing social bots primarily use Really Simple Syndication and OSN (online social network) application program interface to communicate with OSN servers. Researchers have profiled their behaviors well and have proposed various mechanisms to defend against them. We predict that a web test automation rootkit (WTAR) is a prospective approach for designing malicious social bots. In this paper, we first present the principles of designing WTAR‐based social bots. Second, we implement three WTAR‐based bot prototypes on Facebook, Twitter, and Weibo. Third, we validate this new threat by analyzing behaviors of the prototypes in a lab environment and on the Internet, and analyzing reports from widely‐used antivirus software. Our analyses show that WTAR‐based social bots have the following features: (i) they do not connect to OSN directly, and therefore produce few network flows; (ii) they can log in to OSNs easily and perform a variety of social activities; (iii) they can mimic the behaviors of a human user on an OSN. Finally, we propose several possible mechanisms in order to defend against WTAR‐based social bots. Copyright © 2016 John Wiley & Sons, Ltd.