Malicious Bots Research Articles

Online Defamation in the Digital Age: Issues and Challenges with Particular Reference to Deepfakes and Malicious Bots

Online Defamation in the Digital Age: Issues and Challenges with Particular Reference to Deepfakes and Malicious Bots

Tracing the dynamics of misinformation and vaccine stance in Finland amid COVID-19

ABSTRACT This study analyzed 1,683,700 vaccine-related tweets in Finnish using FinBERT language model, Botometer, and BERTopic, from December 2019 to October 2022. A strong correlation was identified between Negative Stance towards Vaccines (NSV) and misinformation, with an upward trend over time and a significant role of malicious bot accounts. Topic modeling revealed persistent themes of vaccine skepticism and diverse misinformation themes adapting to debunking efforts. Approximately a third of tweets contained misinformation, irrespective of source reliability, leading to increased NSV. The study observed a gap in active countering of misinformation by authorities, suggesting proactive involvement by public authorities, public education for effective misinformation management and social media literacy.

Performance evaluation of lightweight network-based bot detection using mouse movements

Confronted with the challenge of malicious bot abuse disrupting daily life, bot detection has become a crucial field of research. Among the various methods proposed, a behavior-driven framework analyzing mouse movements stands out for its widespread applicability, adaptability, and non-intrusive nature. Traditionally, this area of research has relied on manually extracted features from mouse dynamics and classical machine learning techniques, which often struggle to identify complex behavior patterns. To address these limitations, our research turns to Convolutional Neural Networks (CNNs), which have proven effective in image processing, to explore their application in bot detection using mouse movement data. We employ various visual representation techniques to convert mouse movements into trajectory images suitable for CNN analysis. Our empirical findings show that among all the lightweight networks tested, EfficientNet_b3 not only achieves the highest accuracy, with an impressive precision of 99.82%, but also surpasses more complex models like ResNet50 in terms of detection accuracy and modeling speed. These results not only enhance the practical application of deep learning in bot detection but also offer valuable insights into more effective strategies for advancing bot detection technologies.

Towards Understanding and Characterizing the Arbitrage Bot Scam In the Wild

This paper presents the first comprehensive analysis of an emerging cryptocurrency scam named "arbitrage bot" disseminated on online social networks. The scam revolves around Decentralized Exchanges (DEX) arbitrage and aims to lure victims into executing a so-called "bot contract" to steal funds from them. To entice victims and convince them of this scheme, we found that scammers have flocked to publish YouTube videos to demonstrate plausible profits and provide detailed instructions and links to the bot contract. To collect the scam at a large scale, we developed a fully automated scam detection system named CryptoScamHunter, which continuously collects YouTube videos and automatically detects scams. Meanwhile, CryptoScamHunter can download the source code of the bot contract from the provided links and extract the associated scam cryptocurrency address. Through deploying CryptoScamHunter from Jun. 2022 to Jun. 2023, we have detected 10,442 arbitrage bot scam videos published from thousands of YouTube accounts. Our analysis reveals that different strategies have been utilized in spreading the scam, including crafting popular accounts, registering spam accounts, and using obfuscation tricks to hide the real scam address in the bot contracts. Moreover, from the scam videos we have collected over 800 malicious bot contracts with source code and extracted 354 scam addresses. By further expanding the scam addresses with a similar contract matching technique, we have obtained a total of 1,697 scam addresses. Through tracing the transactions of all scam addresses on the Ethereum mainnet and Binance Smart Chain, we reveal that over 25,000 victims have fallen prey to this scam, resulting in a financial loss of up to 15 million USD. Our work sheds light on the dissemination tactics and censorship evasion strategies adopted in the arbitrage bot scam, as well as on the scale and impact of such a scam on online social networks and blockchain platforms, emphasizing the urgent need for effective detection and prevention mechanisms against such fraudulent activity.

ПРОБЛЕМЫ НЕГАТИВНОГО ВОЗДЕЙСТВИЯ И ЭКОНОМИЧЕСКОГО ВРЕДА, НАНОСИМОГО БОТНЕТАМИ

Currently, malicious bots pose a serious threat in the field of information security due to the fact that they are used for such crimes on the Internet as fraud, extortion, blocking the Internet resources of enterpris-es, which leads to a deterioration in the reputation of enterprises and the inability to fully implement business processes. Thus, at the present stage of development of infor-mation systems and information protection, detection and elimination of malicious bots is one of the most pressing tasks. This article discusses the architecture of malicious bots and possible ways to destroy them.

Evaluating Machine Learning Techniques for Web Robot Detection

A web robot, also known as a web crawler, is an automated script that systematically browses the World Wide Web in a methodical manner. Web robots are commonly used by search engines to index web pages, gather information, and update search engine databases. They follow hyperlinks from one web page to another, collecting data and information for various purposes such as indexing, data mining, and website monitoring. Web robot detection is the process of identifying and distinguishing between human users and web robots on websites, which are a major source of web traffic. This process is vital to prevent malicious web robots from having a negative effect on web servers’ traffic and their users’ privacy. Companies such as Imperva, Inc. use machine learning models to identify malicious bots and prevent them from having unauthorized access to an organization’s server. To understand the benefit that machine learning models bring to web robot detection, we used pre-published server log data to construct machine learning models on Orange (a Data Mining Software) and Python that can distinguish between malicious and benign web robots. We evaluated the performance of three well-known machine learning algorithms: kNN, neural network, and decision tree. Based on our experimental results, the neural network gains the highest precision and the lowest false-positive and false-negative percentage of web robots. However, the neural network requires more time to generate the desired output.

Detecting Malicious Twitter Bots using Machine Learning

Abstract: Twitter play a significant role in our daily lives, offering a wide range of opportunities to their users. However, Twitter and online social networks (OSNs) in general are increasingly being utilized by automated accounts, commonly known as bots, as they continue to gain immense popularity across various user demographics. Malicious twitter Bots detection is required to detect real users from fraudulent users because it leads to spreading of spam messages and engage in fraudulent activities. To overcome this, we are going to differentiate bots from legitimate users using feature extraction techniques and find malicious bots and tweets using machine learning algorithm and deep learning architecture known as VGG19 which is combined with the convolutional neural network (CNN) in order to identify whether the tweets are posted by bots or real users and also identifying malicious twitter bots along with malicious URLs. By following these techniques, we can identify the account as bots or real user and prevent spreading of malicious content in the society. The deep learning architecture combined with convolutional neural network to evaluate over a series of experiments using two large real Twitter datasets and compare the experimental results with other machine learning algorithms and provide advantages over other existing techniques like logistic regression targeting the identification of malicious users in social media.

Long-term assessment of social amplification of risk during COVID-19: challenges to public health agencies amid misinformation and vaccine stance

This study employs the Social Amplification of Risk Framework to investigate the stance on COVID-19 vaccines and the spread of misinformation on Twitter in Finland. Analyzing over 1.6 million tweets and manually annotating 4150 samples, the research highlights the challenges faced by the Finnish Institute for Health and Welfare (THL) in steering online vaccination communication. Using BERT models, Botometer, and additional computational methods, the study classifies text, identifies bot-like accounts, and detects malicious bots. Social network analysis further uncovers the underlying social structures and key actors in Twitter discussions during the pandemic. The THL remained a primary source of COVID-19 information throughout the pandemic, maintaining its influence despite challenges posed by malicious bots spreading misinformation and adopting negative vaccine stances. However, THL ceased its Twitter activity at the end of 2022 because its posts were being exploited to gain visibility and traction for misinformation and negative vaccine stance. The study also identifies key influencers in online vaccine discussions, suggesting avenues for improving public health communication. Overall, the research underscores the need to understand social media dynamics to counter misinformation and foster accurate public communication on COVID-19 and vaccination.

Detection and impact estimation of social bots in the Chilean Twitter network

The rise of bots that mimic human behavior represents one of the most pressing threats to healthy information environments on social media. Many bots are designed to increase the visibility of low-quality content, spread misinformation, and artificially boost the reach of brands and politicians. These bots can also disrupt civic action coordination, such as by flooding a hashtag with spam and undermining political mobilization. Social media platforms have recognized these malicious bots’ risks and implemented strict policies and protocols to block automated accounts. However, effective bot detection methods for Spanish are still in their early stages. Many studies and tools used for Spanish are based on English-language models and lack performance evaluations in Spanish. In response to this need, we have developed a method for detecting bots in Spanish called Botcheck. Botcheck was trained on a collection of Spanish-language accounts annotated in Twibot-20, a large-scale dataset featuring thousands of accounts annotated by humans in various languages. We evaluated Botcheck’s performance on a large set of labeled accounts and found that it outperforms other competitive methods, including deep learning-based methods. As a case study, we used Botcheck to analyze the 2021 Chilean Presidential elections and discovered evidence of bot account intervention during the electoral term. In addition, we conducted an external validation of the accounts detected by Botcheck in the case study and found our method to be highly effective. We have also observed differences in behavior among the bots that are following the social media accounts of official presidential candidates.

Experimental Evaluation: Can Humans Recognise Social Media Bots?

This paper aims to test the hypothesis that the quality of social media bot detection systems based on supervised machine learning may not be as accurate as researchers claim, given that bots have become increasingly sophisticated, making it difficult for human annotators to detect them better than random selection. As a result, obtaining a ground-truth dataset with human annotation is not possible, which leads to supervised machine-learning models inheriting annotation errors. To test this hypothesis, we conducted an experiment where humans were tasked with recognizing malicious bots on the VKontakte social network. We then compared the “human” answers with the “ground-truth” bot labels (‘a bot’/‘not a bot’). Based on the experiment, we evaluated the bot detection efficiency of annotators in three scenarios typical for cybersecurity but differing in their detection difficulty as follows: (1) detection among random accounts, (2) detection among accounts of a social network ‘community’, and (3) detection among verified accounts. The study showed that humans could only detect simple bots in all three scenarios but could not detect more sophisticated ones (p-value = 0.05). The study also evaluates the limits of hypothetical and existing bot detection systems that leverage non-expert-labelled datasets as follows: the balanced accuracy of such systems can drop to 0.5 and lower, depending on bot complexity and detection scenario. The paper also describes the experiment design, collected datasets, statistical evaluation, and machine learning accuracy measures applied to support the results. In the discussion, we raise the question of using human labelling in bot detection systems and its potential cybersecurity issues. We also provide open access to the datasets used, experiment results, and software code for evaluating statistical and machine learning accuracy metrics used in this paper on GitHub.

Ensuring security in the ecosystem of intelligent transport infrastructure using methods to combat malicious bots

In the context of the growing threat of cyber attacks on transport systems, it is becoming increasingly important to ensure security in the ecosystem of intelligent transport infrastructure (ITI). This article combines methods of combating malicious bots with methods of ensuring security in ITI, considering botmaster search methods and protection techniques in the context of transport systems. Network traffic analysis, the use of honeypots and data encryption technologies are considered as tools for detecting threats and protecting against cyber attacks, which contributes to the creation of a secure and sustainable transport infrastructure.

Towards Understanding and Characterizing the Arbitrage Bot Scam In the Wild

This paper presents the first comprehensive analysis of an emerging cryptocurrency scam named "arbitrage bot" disseminated on online social networks. The scam revolves around Decentralized Exchanges (DEX) arbitrage and aims to lure victims into executing a so-called "bot contract" to steal funds from them. To entice victims and convince them of this scheme, we found that scammers have flocked to publish YouTube videos to demonstrate plausible profits and provide detailed instructions and links to the bot contract. To collect the scam at a large scale, we developed a fully automated scam detection system namedCryptoScamHunter, which continuously collects YouTube videos and automatically detects scams. Meanwhile,CryptoScamHunter can download the source code of the bot contract from the provided links and extract the associated scam cryptocurrency address. Through deployingCryptoScamHunter from Jun. 2022 to Jun. 2023, we have detected 10,442 arbitrage bot scam videos published from thousands of YouTube accounts. Our analysis reveals that different strategies have been utilized in spreading the scam, including crafting popular accounts, registering spam accounts, and using obfuscation tricks to hide the real scam address in the bot contracts. Moreover, from the scam videos we have collected over 800 malicious bot contracts with source code and extracted 354 scam addresses. By further expanding the scam addresses with a similar contract matching technique, we have obtained a total of 1,697 scam addresses. Through tracing the transactions of all scam addresses on the Ethereum mainnet and Binance Smart Chain, we reveal that over 25,000 victims have fallen prey to this scam, resulting in a financial loss of up to 15 million USD. Overall, our work sheds light on the dissemination tactics and censorship evasion strategies adopted in the arbitrage bot scam, as well as on the scale and impact of such a scam on online social networks and blockchain platforms, emphasizing the urgent need for effective detection and prevention mechanisms against such fraudulent activity.

Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure

The proliferation of cloud and public legitimate services (CLS) on a global scale has resulted in increasingly sophisticated malware attacks that abuse these services as command-and-control (C&C) communication channels. Conventional security solutions are inadequate for detecting malicious C&C traffic because it blends with legitimate traffic. This motivates the development of advanced detection techniques. We make the following contributions: First, we introduce a novel labeled dataset. This dataset serves as a valuable resource for training and evaluating detection techniques aimed at identifying malicious bots that abuse CLS as C&C channels. Second, we tailor our feature engineering to behaviors indicative of CLS abuse, such as connections to known CLS domains and potential C&C API calls. Third, to identify the most relevant features, we introduced a custom feature elimination (CFE) method designed to determine the exact number of features needed for filter selection approaches. Fourth, our approach focuses on both static and derivative features of Portable Executable (PE) files. After evaluating various machine learning (ML) classifiers, the random forest emerges as the most effective classifier, achieving a 98.26% detection rate. Fifth, we introduce the “Replace Misclassified Parameter (RMCP)” adversarial attack. This white-box strategy is designed to evaluate our system’s detection robustness. The RMCP attack modifies feature values in malicious samples to make them appear as benign samples, thereby bypassing the ML model’s classification while maintaining the malware’s malicious capabilities. The results of the robustness evaluation demonstrate that our proposed method successfully maintains a high accuracy level of 84%. In sum, our comprehensive approach offers a robust solution to the growing threat of malware abusing CLS as C&C infrastructure.

Extended Research on the Security of Visual Reasoning CAPTCHA

CAPTCHA is an effective mechanism for protecting computers from malicious bots. With the development of deep learning techniques, current mainstream text-based and traditional image-based CAPTCHAs have been proven to be insecure. Therefore, a major effort has been directed toward developing new CAPTCHAs by utilizing some other hard Artificial Intelligence (AI) problems. Recently, some commercial companies (Tencent, NetEase, Geetest, etc.) have begun deploying a new type of CAPTCHA based on visual reasoning to defend against bots. As a newly proposed CAPTCHA, it is therefore natural to ask a fundamental question: are visual reasoning CAPTCHAs as secure as their designers expect? This paper explores the security of visual reasoning CAPTCHAs. We proposed a modular attack and evaluated it on six different real-world visual reasoning CAPTCHAs, which achieved overall success rates ranging from 79.2% to 98.6%. The results show that visual reasoning CAPTCHAs are not as secure as anticipated; this latest effort to use novel, hard AI problems for CAPTCHAs has not yet succeeded. Then, we summarize some guidelines for designing better visual-based CAPTCHAs, and based on the lessons we learned from our attacks, we propose a new CAPTCHA based on commonsense knowledge (CsCAPTCHA) and show its security and usability experimentally.

SOCIAL ENGINEERING IN MODERN MESSENGERS: APPLICATIONS FOR OFFENSIVE SECURITY

The work considers the problems of social engineering in modern messengers, and provides classification indicators for modern attacks. Attention is focused on the Telegram messenger, whose channel owners and visitors to these channels may suffer from the intervention of fraudsters who cannot always be identified in time. Fraudsters or malicious bots are exposed and removed as a result of certain user complaints, very often when the purpose of the malicious intervention has already been realized. This indicates the need to develop new proactive solutions. The purpose of this work is to enrich offensive security mechanisms for social messengers by using bots and artificial intelligence using specially created prompts. The novelty of the work. It is proposed to place a kind of honeypot analogues in the space of communication. The role of the decoy victim is given to a specially configured bot disguised as a user, capable of carrying out a conversation according to a given scenario. The bot’s algorithm has been developed. Methodology. Social engineering is seen as a proactive security tool aimed at identifying vulnerabilities that attackers can exploit, as well as a reverse defense by obtaining information from fraudsters that compromises them. Main results. The work successfully combined developed offensive security scenarios for real Ukrainian chats at the time of the research, with the capabilities of ChatGPT, which made it possible to implement a bot, with the ability to communicate according to the scenario specified by the security specialist. Testing of the bot and the corresponding application in the Telegram channel was carried out, with the consent of real users, which proved the workability of the solution. Conclusions. The modern level of artificial intelligence tools allows one to obtain valuable information about attackers in the information space, conduct automated security testing, and implement other offensive security scenarios. Channel administrators can use the solution as a channel subscribers filtering tool.

Properties of Malicious Social Bots

The paper considers the ability to describe malicious bots using their characteristics, which can be the basis for building models for recognising bot parameters and qualitatively analysing attack characteristics in social networks. The following metrics are proposed using the characteristics of VKontakte social network bots as an example: trust, survivability, price, seller type, speed, and expert quality. To extract these metrics, an approach is proposed that is based on the methods of test purchases and the Turing test. The main advantage of this approach is that it proposes to extract features from the data obtained experimentally, thereby obtaining a more reasonable estimation than the expert approach. Also, an experiment on extracting metrics from malicious bots of the VKontakte social network using the proposed approach is described, and an analysis of the metrics' dependence is carried out. The experiment demonstrates the possibility of metrics extracting and analysis. In general, the proposed metrics and the approach to their extraction can become the basis for the transition from binary attack detection in social networks to a qualitative description of the attacker and his capabilities, as well as an analysis of the evolution of bots.

Classifying social media bots as malicious or benign using semi-supervised machine learning

Abstract Users of online social network (OSN) platforms, e.g. Twitter, are not always humans, and social bots (referred to as bots) are highly prevalent. State-of-the-art research demonstrates that bots can be broadly categorized as either malicious or benign. From a cybersecurity perspective, the behaviors of malicious and benign bots differ. Malicious bots are often controlled by a botmaster who monitors their activities and can perform social engineering and web scraping attacks to collect user information. Consequently, it is imperative to classify bots as either malicious or benign on the basis of features found on OSNs. Most scholars have focused on identifying features that assist in distinguishing between humans and malicious bots; the research on differentiating malicious and benign bots is inadequate. In this study, we focus on identifying meaningful features indicative of anomalous behavior between benign and malicious bots. The effectiveness of our approach is demonstrated by evaluating various semi-supervised machine learning models on Twitter datasets. Among them, a semi-supervised support vector machine achieved the best results in classifying malicious and benign bots.

Machine learning-based social media bot detection: a comprehensive literature review

In today’s digitalized era, Online Social Networking platforms are growing to be a vital aspect of each individual’s daily life. The availability of the vast amount of information and their open nature attracts the interest of cybercriminals to create malicious bots. Malicious bots in these platforms are automated or semi-automated entities used in nefarious ways while simulating human behavior. Moreover, such bots pose serious cyber threats and security concerns to society and public opinion. They are used to exploit vulnerabilities for illicit benefits such as spamming, fake profiles, spreading inappropriate/false content, click farming, hashtag hijacking, and much more. Cybercriminals and researchers are always engaged in an arms race as new and updated bots are created to thwart ever-evolving detection technologies. This literature review attempts to compile and compare the most recent advancements in Machine Learning-based techniques for the detection and classification of bots on five primary social media platforms namely Facebook, Instagram, LinkedIn, Twitter, and Weibo. We bring forth a concise overview of all the supervised, semi-supervised, and unsupervised methods, along with the details of the datasets provided by the researchers. Additionally, we provide a thorough breakdown of the extracted feature categories. Furthermore, this study also showcases a brief rundown of the challenges and opportunities encountered in this field, along with prospective research directions and promising angles to explore.

Botnet Defense System: Observability, Controllability, and Basic Command and Control Strategy

This paper deals with the observability, controllability, and command and control strategy in the Botnet Defense System (BDS) that disinfects malicious botnets with white-hat botnets. The BDS defends an IoT system built over the Internet. The Internet is characterized by openness, but not all nodes are observable and controllable. We incorporated the concept of observability and controllability into the BDS design and theoretically clarified that the BDS can enhance its observability and controllability by utilizing its white-hat botnets. In addition, we proposed a Withdrawal strategy as a basic strategy to command and control white-hat botnets. Then, we modeled the BDS, adopted the Withdrawal strategy with agent-oriented Petri net PN2 and confirmed the effect through the simulation of the model. The result shows that even if considering observability and controllability, the BDS wiped out the malicious bots and reduced the white-hat bots to less than 1% as long as the white-hat worms were sufficiently infectious.

Top 12 layer-wise security challenges and a secure architectural solution for Internet of Things

Digitalization, intelligent virtual assistants, and smart consumer products prepare us for life at every stage. Smart IoT, Sensor nodes, software communicate with one another via voice and emotions, simplifying our lives. Smart IoT is becoming more prevalent in our daily lives. Even though the use of Smart IOTs has grown in Geometric progression, the security of these devices remains traditional. Technically, most security discussions revolve around the implementation of better Network Intrusion Prevention/Detection Systems (NIPS/NIDS), the installation of a traditional firewall, or the use of proxy scanners, which is the standard recommendation of security vendors. All architectures are rooted in the same zeal that drives cyber warfare. However, when considering the Narrowband Internet of Things, the packet size is too small, and the memory and processors are so small that they cannot hold the packets for inspections, and the lucrative protocols will not work. Malicious hackers, BOTs, Trozens, and Honeypots may tamper with and virtually control these smart Internet of Things (IoT) to steal/tamper sensitive information for filthy lucre, financial reward, or, to put it simply, money in this cyber warfare. All of these issues stem from a lack of proper security design controls, architectural security flaws, and a failure to apply Secure by Design principles. Fixing these security controls earlier in the process will save us a significant amount of time, energy, and money spent on repairing broken IoT security flaws and performance aesthetics. If we consider the Shift Left Secure by Design/Architecture Journey in the Internet of Things Security Architecture, these Architectural/Design flaws can be identified in earlier stages and will help the delivery teams to plan necessary security controls in the IoT use cases.In this paper, the author discusses Layer-wise Security Challenges, Attack Vectors, and Architectural Flaws, and proposes a secure architectural solution for the Internet of Things (IoT) that assists delivery teams in securely designing/architecting resource-intensive smart Internet of Things (IoT)/Narrowband (NIoT) use cases earlier in the Life cycle by employing the Secure Design Shift Left approach. In this smart digital IoT era, the author also suggests future research directions for future generations to increase security.