A novel framework for internet of knowledge protection in social networking services

Highlights

• Spam activities on Social Networking Services (SNSs) are studied.

• A novel feature set is introduced to the task of spammer detection on SNSs.

• We propose a new Bagging Extreme Learning Machine approach to detect SNS spammers.

Abstract

With the increasing number of users on Social Networking Service (SNS), the Internet of knowledge shared on it is also increasing. Given such enhancement of Internet of knowledge on SNS, the probability of spreading spammers on it is also increasing day by day. Several traditional machine-learning methods, such as support vector machines and naïve Bayes, have been proposed to detect spammers on SNS. Note, however, that these methods are not efficient due to some issues, such as lower generalization performance and higher training time. An Extreme Learning Machine (ELM) is an efficient classification method that can provide good generalization performance at higher training speed. Nonetheless, it suffers from overfitting and ill-posed problem that can degrade its generalization performance. In this paper, we propose a Bagging ELM-based spammer detection framework that identifies spammers in SNSs with the help of multiple ELMs that we combined using the bagging method. We constructed a labeled dataset of the two most prominent SNSs -- Twitter and Facebook -- to evaluate the performance of our framework. The evaluation results show that our framework obtained higher generalization performance rate of 99.01% for the Twitter dataset and 99.02% for the Facebook datasets, while required a lower training time of 1.17 s and 1.10s, respectively.

Introduction

In the knowledge economy, knowledge is a primary resource. The internet is considered a power of its connectivity. It is used in the internet of things (IoT) to connect passive objects to exhibit their smart features. Similarly, the internet of knowledge is described as the connection of knowledge points originally spread over diverse places to represent them with high value. With the enhancement of the internet of knowledge, the knowledge is progressively found at the network level, such as SNSs. Recently, SNSs have been converted into an essential and prominent medium of communication and sharing knowledge. Typically, SNS users are liable for sharing knowledge in the network and are basic key elements in the network structure. The communities that consist of families, group of friends, and acquaintances are the next basic element in the network structure. In SNSs, users can share knowledge by posting links to their favorite webpages, files, photos, and videos. Furthermore, the structure of SNS communities generates a network of credibility and trust [1,2].

Facebook and Twitter are leading SNSs. According to a report from Statista [3], the total number of Facebook and Twitter users stood at 1968 million and 319 million, respectively, as of April 2017. With the escalating number of users, a huge amount of heterogeneous knowledge is also being produced every day on these two SNSs [4]. Mainly, multimedia knowledge (in the form of text, audio files, videos, and images) is produced, stored, and transferred in a huge amount. The multimedia knowledge posted on these SNSs is mostly accompanied by user likes, comments, tags, hashtags, and so on. Multimedia has become an essential part of SNSs. According to Zephoria Digital Marketing’s report [5], approximately 136,000 photos are shared, 293,000 statuses are updated, and 510,000 comments are posted every 60 s on Facebook. This report also reveals that the average content sharing rate on Facebook was 4.75 billion pieces of content per day as of May 2013, which was 94% more than the content sharing rate as of August 2012. The Statista report [6] states that Facebook and Twitter play a significant role in global content sharing activities, and that 57% and 18% of social content sharing activities occurred via Facebook and Twitter, respectively, as of the second quarter of 2016. The statistics above and our survey on SNS security [7] demonstrate that the amount of multimedia knowledge shared on Facebook and Twitter is increasing every single day. With this increase in multimedia, however, these two SNSs have become the desired target of spammers for spreading spam. A statistic from Nexgate’s report showed an estimated 355% escalation in social media spam during the first half of 2013 [8].

Spammers use numerous techniques for posting spam messages on these SNSs. The posted spam messages act as marketing advertisements and scams and help transmit malware via enclosed malicious URLs, or they are used to perform phishing attacks [9]. In addition to this, spammers can follow unknown users and send unwanted messages containing malicious URLs to obtain high exposure. The masquerade URLs can spread threats in the form of drive-by-download (install malware) and infect the host machine, allowing the installed malware to tap into the host’s confidential information [10]. Furthermore, the infected host machine may also participate in wicked botnet activities, such as operating during Distributed Denial of Service (DDOS) attacks, or become a source of email spam. Spammers may use embedded links to organize a phishing attack, wherein they target a legitimate user to collect his or her confidential information. Usually, spammers on Facebook and Twitter pose as legitimate users. Therefore, identifying and differentiating them from legitimate users make for a difficult task. In the past, spammers on these SNSs were typically simple, with a clear appearance that helped in differentiating them from legitimate users. Nevertheless, spammers can still use cheap automated methods for gaining credibility and trust and making themselves difficult to detect in the large population of SNS users.

Spammer detection in SNSs is a classification problem wherein legitimate users are distinguished from spammers based on their respective features. Note, however, that these classification problems are associated with various significant challenges when attempting to detect spammers. These challenges include the high dimensionality of features, biased and limited training sets, high computational classification complexities, and public unavailability of training sets. To overcome these challenges and carry out spammer classification effectively, several traditional machine-learning methods, such as Support Vector Machine [11,12], Decision Tree [13], Jrip [14], Bayesian Network [15], Random Forest [16], k-Nearest Neighbors [17], etc. have been proposed. Due to the high dimensionality of features, however, finding the optimum parameters for parametric supervised algorithms is very time-consuming and difficult [18]. Therefore, existing models suffer from numerous issues, such as poor generalization performance, longer training time, and higher false positive rates. Moreover, many approaches, such as [19], use biased dataset containing a much smaller number of spam profiles than legitimate ones and provide inaccurate classification results.

Recently, the Extreme Learning Machine (ELM) [20] has been introduced as one of the effective machine learning classifiers. It is considered to be an effective and promising classifier over the other traditional classifiers, such as the Support Vector Machine and Naïve Bayesian, due to the following reasons: 1) it has better computational efficiency; 2) it provides similar or better generalization performance compared with the traditional machine learning algorithms; 3) it does not require adjusting any additional parameters except the predefined network architecture; and 4) it can use all piecewise continuous functions as activation functions, such as radial basis functions, triangular basis functions, sigmoid functions, etc. A significant number of studies from the academe show the competences of ELM in accurate classification at high learning speed [[21], [22], [23]]. Nevertheless, ELM has certain limitations. For instance, the arbitrary selection of input bias and weights in ELM can create the problem of ill-posed wherein the classification returns more than one solution that further results in lower generalization performance [24]. Note, however, that spammer detection in SNSs requires better generalization performance and shorter training time. In particular, shorter training time can be obtained by ELM [18], and generalization performance can be enhanced using ensemble learning [24], wherein a strong learner can be created by combining multiple weak learners [25]. It has been used with many weak learners, such as Decision Tree and Neural Networks, to create a strong learner, and it gives better generalization performance. Thus, similar to other weak learners, an ELM can be used as a weak learner, and its limitations can be overcome by employing the strategy of ensemble learning wherein a strong ELM can be created by combining multiple ELMs.

In this paper, we propose a Bagging ELM-based spammer detection framework wherein multiple ELMs are employed to distinguish spammers from legitimate users on SNSs. Bagging [26] is used as an ensemble learning method to combine multiple ELMs. The main contributions of this paper are as follows:

• We analyze spam activities on the two most popular SNSs of Facebook and Twitter and propose novel feature sets to facilitate spammer detection for both SNSs. Compared with other existing feature sets [11,14], our proposed feature sets consist of recent and selective features that are responsible for spam on both SNSs.

• The novelty of this paper primarily lies in the fact that it offers a framework that uses a new Bagging ELM approach to detecting SNS spammers. This method provides higher generalization performance for spammer detection at shorter training time.

• Since Facebook and Twitter datasets are not publicly available, we constructed a labeled dataset of both SNSs to evaluate the performance of our framework.

• We also provide a comparative analysis of performance of our framework with other existing frameworks in order to validate the effectiveness of our framework in detecting SNS spammers.

The rest of this paper is organized as follows: Section 2 discusses various existing techniques to mitigate the issue of spam in SNSs and the ELM approach for classification. Section 3 describes our proposed framework and its components, including the features set, dataset construction, and bagging ELM. Section 4 provides an experimental evaluation of our proposed framework and our comparison of it with other existing techniques for detecting SNS spammers. Finally, we conclude our paper in Section 5.