Multiple Account Identity Deception Detection in Social Media Using Nonverbal Behavior

Identity deception has become an increasingly important issue in the social media environment. The case of blocked users initiating new accounts, often called sockpuppetry, is widely known and past efforts, which have attempted to detect such users, have been primarily based on verbal behavior (e.g., using profile data or lexic al features in text). Although these methods yield a high detection accuracy rate, they are computationally inefficient for the social media environment, which often involves databases with large volumes of data. To date, little attention has been paid to detecting online decep- tion using nonverbal behavior. We present a detection method based on nonverbal behavior for identity deception, which can be applied to many types of social media. Using Wikipedia as an experimental case, we demonstrate that our proposed method results in high detection accuracy over previous methods pro- posed while being computationally efficient for the social media environment. We also demonstrate the potential of nonverbal behavior data that exists in social media and how designers and developers can leverage such nonverbal information in detecting deception to safeguard their online communities

Online Deception in Social Media

The unknown and the invisible exploit the unwary and the uninformed for illicit financial gain and reputation damage

Vulnerabilities to Online Social Network Identity Deception Detection Research and Recommendations for Mitigation

Identity deception in online social networks is a pervasive problem. Ongoing research is developing methods for identity deception detection. However, the real-world efficacy of these methods is currently unknown because they have been evaluated largely through laboratory experiments. We present a review of representative state-of-the-art results on identity deception detection. Based on this analysis, we identify common methodological weaknesses for these approaches, and we propose recommendations that can increase their effectiveness for when they are applied in real-world environments

Hourly Network Anomaly Detection on HTTP Using Exponential Random Graph Models and Autoregressive Moving Average

Network anomaly detection solutions can analyze a network’s data volume by protocol over time and can detect many kinds of cyberattacks such as exfiltration. We use exponential random graph models (ERGMs) in order to flatten hourly network topological characteristics into a time series, and Autoregressive Moving Average (ARMA) to analyze that time series and to detect potential attacks. In particular, we extend our previous method in not only demonstrating detection over hourly data but also through labeling of nodes and over the HTTP protocol. We demonstrate the effectiveness of our method using real-world data for creating exfiltration scenarios. We highlight how our method has the potential to provide a useful description of what is happening in the network structure and how this can assist cybersecurity analysts in making better decisions in conjunction with existing intrusion detection systems. Finally, we describe some strengths of our method, its accuracy based on the right selection of parameters, as well as its low computational requirements