arXiv subjects

Ponnurangam Kumaraguru

Publications and source records attributed to Ponnurangam Kumaraguru.

At least 145 records · Page 8Linked to original sources

arXiv2015

Characterising Behavior and Emotions on Social Media for Safety: Exploring Online Communication between Police and Citizens

Increased use of social media by police to connect with citizens has encouraged researchers to study different aspects of information exchange (e.g. type of information, credibility and propagation) during emergency and crisis situation. Research studies lack understanding of human behavior such as engagement, emotions and social interaction between citizen and police department on social media. Several social media studies explore and show technological implications of human behavioral aspects in various contexts such as workplace interaction and depression in young mothers. In this paper, we study online interactions between citizens and Indian police in context of day-to-day policing, including safety concerns, advisories, etc. Indian police departments use Facebook to issue advisories, send alerts and receive citizen complaints and suggestions regarding safety issues and day-to-day policing. We explore how citizens express their emotions and social support on Facebook. Our work discusses technological implications of behavioral aspects on social well being of citizens.

cs.CY↗

arXiv2015

TweetCred: Real-Time Credibility Assessment of Content on Twitter

During sudden onset crisis events, the presence of spam, rumors and fake content on Twitter reduces the value of information contained on its messages (or "tweets"). A possible solution to this problem is to use machine learning to automatically evaluate the credibility of a tweet, i.e. whether a person would deem the tweet believable or trustworthy. This has been often framed and studied as a supervised classification problem in an off-line (post-hoc) setting. In this paper, we present a semi-supervised ranking model for scoring tweets according to their credibility. This model is used in TweetCred, a real-time system that assigns a credibility score to tweets in a user's timeline. TweetCred, available as a browser plug-in, was installed and used by 1,127 Twitter users within a span of three months. During this period, the credibility score for about 5.4 million tweets was computed, allowing us to evaluate TweetCred in terms of response time, effectiveness and usability. To the best of our knowledge, this is the first research work to develop a real-time system for credibility on Twitter, and to evaluate it on a user base of this size.

cs.CR↗

arXiv2015

Detecting Malicious Content on Facebook

Online Social Networks (OSNs) witness a rise in user activity whenever an event takes place. Malicious entities exploit this spur in user-engagement levels to spread malicious content that compromises system reputation and degrades user experience. It also generates revenue from advertisements, clicks, etc. for the malicious entities. Facebook, the world's biggest social network, is no exception and has recently been reported to face much abuse through scams and other type of malicious content, especially during news making events. Recent studies have reported that spammers earn $200 million just by posting malicious links on Facebook. In this paper, we characterize malicious content posted on Facebook during 17 events, and discover that existing efforts to counter malicious content by Facebook are not able to stop all malicious content from entering the social graph. Our findings revealed that malicious entities tend to post content through web and third party applications while legitimate entities prefer mobile platforms to post content. In addition, we discovered a substantial amount of malicious content generated by Facebook pages. Through our observations, we propose an extensive feature set based on entity profile, textual content, metadata, and URL features to identify malicious content on Facebook in real time and at zero-hour. This feature set was used to train multiple machine learning models and achieved an accuracy of 86.9%. The intent is to catch malicious content that is currently evading Facebook's detection techniques. Our machine learning model was able to detect more than double the number of malicious posts as compared to existing malicious content detection techniques. Finally, we built a real world solution in the form of a REST based API and a browser plug-in to identify malicious Facebook posts in real time.

cs.SI↗

arXiv2014

What They Do in Shadows: Twitter Underground Follower Market

Internet users and businesses are increasingly using online social networks (OSN) to drive audience traffic and increase their popularity. In order to boost social presence, OSN users need to increase the visibility and reach of their online profile, like - Facebook likes, Twitter followers, Instagram comments and Yelp reviews. For example, an increase in Twitter followers not only improves the audience reach of the user but also boosts the perceived social reputation and popularity. This has led to a scope for an underground market that provides followers, likes, comments, etc. via a network of fraudulent and compromised accounts and various collusion techniques. In this paper, we landscape the underground markets that provide Twitter followers by studying their basic building blocks - merchants, customers and phony followers. We charecterize the services provided by merchants to understand their operational structure and market hierarchy. Twitter underground markets can operationalize using a premium monetary scheme or other incentivized freemium schemes. We find out that freemium market has an oligopoly structure with few merchants being the market leaders. We also show that merchant popularity does not have any correlation with the quality of service provided by the merchant to its customers. Our findings also shed light on the characteristics and quality of market customers and the phony followers provided. We draw comparison between legitimate users and phony followers, and find out key identifiers to separate such users. With the help of these differentiating features, we build a supervised learning model to predict suspicious following behaviour with an accuracy of 89.2%.

cs.SI↗

arXiv2014

Privacy4ICTD in India: Exploring Perceptions, Attitudes and Awareness about ICT Use

Several ICT studies give anecdotal evidences showing privacy to be an area of concern that can influence adoption of technology in the developing world. However, in-depth understanding of end users' privacy attitudes and awareness is largely unexplored in developing countries such as India. We conducted a survey with 10,427 Indian citizens to bring forth various insights on privacy expectations and perceptions of end users. Our study explores end-users' privacy expectations on three ICT platforms - mobile phones, OSN (Online Social Network), and government projects. Our results, though preliminary, show that users disproportionately consider financial details as personal information in comparison to medical records. Users heavily use mobile phones to store personal details and show high trust in mobile service providers for protecting the private data. However, users show concerns that mobile service provider may allow improper access of their personal information to third parties and government. We also find that female participants in the study were marginally more conscious of their privacy than males. To the best of our knowledge, this work presents the largest privacy study which benchmarks privacy perceptions among Indian citizens. Understanding users' privacy perceptions can help improve technology adoption and develop policies and laws for improving technology experience and enabling development for a better life in India.

cs.CY↗

arXiv2014

Followers or Phantoms? An Anatomy of Purchased Twitter Followers

Online Social Media (OSM) is extensively used by contemporary Internet users to communicate, socialize and disseminate information. This has led to the creation of a distinct online social identity which in turn has created the need of online social reputation management techniques. A significant percentage of OSM users utilize various methods to drive and manage their reputation on OSM. This has given rise to underground markets which buy/sell fraudulent accounts, `likes', `comments' (Facebook, Instagram) and `followers' (Twitter) to artificially boost their social reputation. In this study, we present an anatomy of purchased followers on Twitter and their behaviour. We illustrate in detail the profile characteristics, content sharing and behavioural patterns of purchased follower accounts. Previous studies have analyzed the purchased follower markets and customers. Ours is the first study which analyzes the anatomy of purchased followers accounts. Some of the key insights of our study show that purchased followers have a very high unfollow entropy rate and low social engagement with their friends. In addition, we noticed that purchased follower accounts have significant difference in their interaction and content sharing patterns in comparison to random Twitter users. We also found that underground markets do not follow their service policies and guarantees they provide to customer. Our study highlights the key identifiers for suspicious follow behaviour. We then built a supervised learning mechanism to predict suspicious follower behaviour with 88.2% accuracy. We believe that understanding the anatomy and characteristics of purchased followers can help detect suspicious follower behaviour and fraudulent accounts to a larger extent.

cs.SI↗

arXiv2014

Broker Bots: Analyzing automated activity during High Impact Events on Twitter

Twitter is now an established and a widely popular news medium. Be it normal banter or a discussion on high impact events like Boston marathon blasts, February 2014 US Icestorm, etc., people use Twitter to get updates. Twitter bots have today become very common and acceptable. People are using them to get updates about emergencies like natural disasters, terrorist strikes, etc. Twitter bots provide these users a means to perform certain tasks on Twitter that are both simple and structurally repetitive. During high impact events these Twitter bots tend to provide time critical and comprehensive information. We present how bots participate in discussions and augment them during high impact events. We identify bots in high impact events for 2013: Boston blasts, February 2014 US Icestorm, Washington Navy Yard Shooting, Oklahoma tornado, and Cyclone Phailin. We identify bots among top tweeters by getting all such accounts manually annotated. We then study their activity and present many important insights. We determine the impact bots have on information diffusion during these events and how they tend to aggregate and broker information from various sources to different users. We also analyzed their tweets, list down important differentiating features between bots and non bots (normal or human accounts) during high impact events. We also show how bots are slowly moving away from traditional API based posts towards web automation platforms like IFTTT, dlvr.it, etc. Using standard machine learning, we proposed a methodology to identify bots/non bots in real time during high impact events. This study also looks into how the bot scenario has changed by comparing data from high impact events from 2013 with data from similar type of events from 2011. Lastly, we also go through an in-depth analysis of Twitter bots who were active during 2013 Boston Marathon Blast.

cs.SI↗

arXiv2014

Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing Page

Each month, more attacks are launched with the aim of making web users believe that they are communicating with a trusted entity which compels them to share their personal, financial information. Phishing costs Internet users billions of dollars every year. Researchers at Carnegie Mellon University (CMU) created an anti-phishing landing page supported by Anti-Phishing Working Group (APWG) with the aim to train users on how to prevent themselves from phishing attacks. It is used by financial institutions, phish site take down vendors, government organizations, and online merchants. When a potential victim clicks on a phishing link that has been taken down, he / she is redirected to the landing page. In this paper, we present the comparative analysis on two datasets that we obtained from APWG's landing page log files; one, from September 7, 2008 - November 11, 2009, and other from January 1, 2014 - April 30, 2014. We found that the landing page has been successful in training users against phishing. Forty six percent users clicked lesser number of phishing URLs from January 2014 to April 2014 which shows that training from the landing page helped users not to fall for phishing attacks. Our analysis shows that phishers have started to modify their techniques by creating more legitimate looking URLs and buying large number of domains to increase their activity. We observed that phishers are exploiting ICANN accredited registrars to launch their attacks even after strict surveillance. We saw that phishers are trying to exploit free subdomain registration services to carry out attacks. In this paper, we also compared the phishing e-mails used by phishers to lure victims in 2008 and 2014. We found that the phishing e-mails have changed considerably over time. Phishers have adopted new techniques like sending promotional e-mails and emotionally targeting users in clicking phishing URLs.

cs.CY↗

arXiv2014

bit.ly/malicious: Deep Dive into Short URL based e-Crime Detection

Existence of spam URLs over emails and Online Social Media (OSM) has become a massive e-crime. To counter the dissemination of long complex URLs in emails and character limit imposed on various OSM (like Twitter), the concept of URL shortening has gained a lot of traction. URL shorteners take as input a long URL and output a short URL with the same landing page (as in the long URL) in return. With their immense popularity over time, URL shorteners have become a prime target for the attackers giving them an advantage to conceal malicious content. Bitly, a leading service among all shortening services is being exploited heavily to carry out phishing attacks, work-from-home scams, pornographic content propagation, etc. This imposes additional performance pressure on Bitly and other URL shorteners to be able to detect and take a timely action against the illegitimate content. In this study, we analyzed a dataset of 763,160 short URLs marked suspicious by Bitly in the month of October 2013. Our results reveal that Bitly is not using its claimed spam detection services very effectively. We also show how a suspicious Bitly account goes unnoticed despite of a prolonged recurrent illegitimate activity. Bitly displays a warning page on identification of suspicious links, but we observed this approach to be weak in controlling the overall propagation of spam. We also identified some short URL based features and coupled them with two domain specific features to classify a Bitly URL as malicious or benign and achieved an accuracy of 86.41%. The feature set identified can be generalized to other URL shortening services as well. To the best of our knowledge, this is the first large scale study to highlight the issues with the implementation of Bitly's spam detection policies and proposing suitable countermeasures.

cs.CR↗

arXiv2014

Analyzing Social and Stylometric Features to Identify Spear phishing Emails

Spear phishing is a complex targeted attack in which, an attacker harvests information about the victim prior to the attack. This information is then used to create sophisticated, genuine-looking attack vectors, drawing the victim to compromise confidential information. What makes spear phishing different, and more powerful than normal phishing, is this contextual information about the victim. Online social media services can be one such source for gathering vital information about an individual. In this paper, we characterize and examine a true positive dataset of spear phishing, spam, and normal phishing emails from Symantec's enterprise email scanning service. We then present a model to detect spear phishing emails sent to employees of 14 international organizations, by using social features extracted from LinkedIn. Our dataset consists of 4,742 targeted attack emails sent to 2,434 victims, and 9,353 non targeted attack emails sent to 5,912 non victims; and publicly available information from their LinkedIn profiles. We applied various machine learning algorithms to this labeled data, and achieved an overall maximum accuracy of 97.76% in identifying spear phishing emails. We used a combination of social features from LinkedIn profiles, and stylometric features extracted from email subjects, bodies, and attachments. However, we achieved a slightly better accuracy of 98.28% without the social features. Our analysis revealed that social features extracted from LinkedIn do not help in identifying spear phishing emails. To the best of our knowledge, this is one of the first attempts to make use of a combination of stylometric features extracted from emails, and social features extracted from an online social network to detect targeted spear phishing emails.

cs.CY↗

arXiv2014

@I to @Me: An Anatomy of Username Changing Behavior on Twitter

An identity of a user on an online social network (OSN) is defined by her profile, content and network attributes. OSNs allow users to change their online attributes with time, to reflect changes in their real-life. Temporal changes in users' content and network attributes have been well studied in literature, however little research has explored temporal changes in profile attributes of online users. This work makes the first attempt to study changes to a unique profile attribute of a user - username and on a popular OSN which allows users to change usernames multiple times - Twitter. We collect, monitor and analyze 8.7 million Twitter users at macroscopic level and 10,000 users at microscopic level to understand username changing behavior. We find that around 10% of monitored Twitter users opt to change usernames for possible reasons such as space gain, followers gain, and username promotion. Few users switch back to any of their past usernames, however prefer recently dropped usernames to switch back to. Users who change usernames are more active and popular than users who don't. In-degree, activity and account creation year of users are weakly correlated with their frequency of username change. We believe that past usernames of a user and their associated benefits inferred from the past, can help Twitter to suggest its users a set of suitable usernames to change to. Past usernames may also help in other applications such as searching and linking multiple OSN accounts of a user and correlating multiple Twitter profiles to a single user.

cs.SI↗

arXiv2014

Indian Premier League (IPL), Cricket, Online Social Media

In recent past online social media has played a pivotal role in sharing of information and opinions on real time events. Events in physical space are reflected in digital world through online social networks. Event based studies for such content have been widely done on Twitter in the computer science community. In this report, we performed a detailed analysis of a sports event called the Indian Premier League (IPL'13) for both Facebook and Twitter. IPL is the most popular cricket league in India with players from across the world. We analysed more than 2.6 million tweets and 700 thousand Facebook posts for temporal activity, text quality, geography of users and the spot-fixing scandal which came up during the league. We were able to draw strong correlations between the brand value of teams and how much they were talked about on social media across Facebook and Twitter. Analysis of geo-tagged data showed major activity from metropolitan suburbs however activity was not restricted to the regions geographically associated with each team. We present a decay calculation methodology, using which we derive that activity died down on both Twitter and Facebook in a very similar manner. Such analysis can be used to model events and study their penetration in social networks. We analysed text for spot-fixing and found that user response to allegations about matches being fixed was cold. The complete analysis presented in this report, can be particularly useful for studying events involving crisis or events of political importance having similar structure.

cs.SI↗

arXiv2014

It Doesn't Break Just on Twitter. Characterizing Facebook content During Real World Events

Multiple studies in the past have analyzed the role and dynamics of the Twitter social network during real world events. However, little work has explored the content of other social media services, or compared content across two networks during real world events. We believe that social media platforms like Facebook also play a vital role in disseminating information on the Internet during real world events. In this work, we study and characterize the content posted on the world's biggest social network, Facebook, and present a comparative analysis of Facebook and Twitter content posted during 16 real world events. Contrary to existing notion that Facebook is used mostly as a private network, our findings reveal that more than 30% of public content that was present on Facebook during these events, was also present on Twitter. We then performed qualitative analysis on the content spread by the most active users during these events, and found that over 10% of the most active users on both networks post spam content. We used stylometric features from Facebook posts and tweet text to classify this spam content, and were able to achieve an accuracy of over 99% for Facebook, and over 98% for Twitter. This work is aimed at providing researchers with an overview of Facebook content during real world events, and serve as basis for more in-depth exploration of its various aspects like information quality, and credibility during real world events.

cs.SI↗

arXiv2014

Exploration of gaps in Bitly's spam detection and relevant counter measures

Existence of spam URLs over emails and Online Social Media (OSM) has become a growing phenomenon. To counter the dissemination issues associated with long complex URLs in emails and character limit imposed on various OSM (like Twitter), the concept of URL shortening gained a lot of traction. URL shorteners take as input a long URL and give a short URL with the same landing page in return. With its immense popularity over time, it has become a prime target for the attackers giving them an advantage to conceal malicious content. Bitly, a leading service in this domain is being exploited heavily to carry out phishing attacks, work from home scams, pornographic content propagation, etc. This imposes additional performance pressure on Bitly and other URL shorteners to be able to detect and take a timely action against the illegitimate content. In this study, we analyzed a dataset marked as suspicious by Bitly in the month of October 2013 to highlight some ground issues in their spam detection mechanism. In addition, we identified some short URL based features and coupled them with two domain specific features to classify a Bitly URL as malicious / benign and achieved a maximum accuracy of 86.41%. To the best of our knowledge, this is the first large scale study to highlight the issues with Bitly's spam detection policies and proposing a suitable countermeasure.

cs.SI↗

arXiv2014

Online Social Media and Police in India: Behavior, Perceptions, Challenges

Police agencies across the globe are increasingly using Online Social Media (OSM) to acquire intelligence and connect with citizens. Developed nations have well thought of strategies to use OSM for policing. However, developing nations like India are exploring and evolving OSM as a policing solution. India, in recent years, experienced many events where rumors and fake content on OSM instigated communal violence. In contrast to traditional media (e.g. television and print media) used by Indian police departments, OSM offers velocity, variety, veracity and large volume of information. These introduce new challenges for police like platforms selection, secure usage strategy, developing trust, handling offensive comments, and security / privacy implication of information shared through OSM. Success of police initiatives on OSM to maintain law and order depends both on their understanding of OSM and citizen's acceptance / participation on these platforms. This study provides multidimensional understanding of behavior, perceptions, interactions, and expectation regarding policing through OSM. First, we examined recent updates from four different police pages- Delhi, Bangalore, Uttar Pradesh and Chennai to comprehend various dimensions of police interaction with citizens on OSM. Second, we conducted 20 interviews with IPS officers (Indian Police Service) and 17 interviews with citizens to understand decision rationales and expectation gaps between two stakeholders (police and citizens); this was followed up with 445 policemen surveys and 204 citizen surveys. We also present differences between police expectations of Indian and police departments in developed countries.

cs.CY↗

arXiv2013

Call Me MayBe: Understanding Nature and Risks of Sharing Mobile Numbers on Online Social Networks

There is a great concern about the potential for people to leak private information on OSNs, but few quantitative studies on this. This research explores the activity of sharing mobile numbers on OSNs, via public profiles and posts. We attempt to understand the characteristics and risks of mobile numbers sharing behaviour on OSNs and focus on Indian mobile numbers. We collected 76,347 unique mobile numbers posted by 85905 users on Twitter and Facebook and analysed 2997 numbers, prefixed with +91. We observed, most users shared their own mobile numbers to spread urgent information; and to market products and escort business. Fewer female users shared mobile numbers on OSNs. Users utilized other OSN platforms and third party applications like Twitterfeed, to post mobile numbers on multiple OSNs. In contrast to the user's perception of numbers spreading quickly on OSN, we observed that except for emergency, most numbers did not diffuse deep. To assess risks associated with mobile numbers exposed on OSNs, we used numbers to gain sensitive information about their owners (e.g. name, Voter ID) by collating publicly available data from OSNs, Truecaller, OCEAN. On using the numbers on WhatApp, we obtained a myriad of sensitive details (relationship status, BBM pins) of the number owner. We communicated the observed risks to the owners by calling. Few users were surprised to know about the online presence of their number, while a few others intentionally posted it online for business purposes. We observed, 38.3% of users who were unaware of the online presence of their number have posted their number themselves on the social network. With these observations, we highlight that there is a need to monitor leakage of mobile numbers via profile and public posts. To the best of our knowledge, this is the first exploratory study to critically investigate the exposure of Indian mobile numbers on OSNs.

cs.SI↗

arXiv2013

OCEAN: Open-source Collation of eGovernment data And Networks - Understanding Privacy Leaks in Open Government Data

The awareness and sense of privacy has increased in the minds of people over the past few years. Earlier, people were not very restrictive in sharing their personal information, but now they are more cautious in sharing it with strangers, either in person or online. With such privacy expectations and attitude of people, it is difficult to embrace the fact that a lot of information is publicly available on the web. Information portals in the form of the e-governance websites run by Delhi Government in India provide access to such PII without any anonymization. Several databases e.g., Voterrolls, Driving Licence number, MTNL phone directory, PAN card serve as repositories of personal information of Delhi residents. This large amount of available personal information can be exploited due to the absence of proper written law on privacy in India. PII can also be collected from various social networking sites like Facebook, Twitter, GooglePlus etc. where the users share some information about them. Since users themselves put this information, it may not be considered as a privacy breach, but if the information is aggregated, it may give out much more information resulting in a bigger threat. To bring such issues to public notice, we developed Open-source Collation of eGovernment data And Networks (OCEAN), a system where the user enters little information (e.g. Name) about a person and gets large amount of personal information about him / her like name, age, address, date of birth, mother's name, father's name, voter ID, driving licence number, PAN.

cs.CY↗

arXiv2013

Three-Way Dissection of a Game-CAPTCHA: Automated Attacks, Relay Attacks, and Usability

Existing captcha solutions on the Internet are a major source of user frustration. Game captchas are an interesting and, to date, little-studied approach claiming to make captcha solving a fun activity for the users. One broad form of such captchas -- called Dynamic Cognitive Game (DCG) captchas -- challenge the user to perform a game-like cognitive task interacting with a series of dynamic images. We pursue a comprehensive analysis of a representative category of DCG captchas. We formalize, design and implement such captchas, and dissect them across: (1) fully automated attacks, (2) human-solver relay attacks, and (3) usability. Our results suggest that the studied DCG captchas exhibit high usability and, unlike other known captchas, offer some resistance to relay attacks, but they are also vulnerable to our novel dictionary-based automated attack.

cs.CR↗