JuanEcheverria,ChristophBesel,ShiZhouDepartmentofComputerScienceUniversityCollegeLondon(UCL)

DiscoveryoftheBurstyBotnetbyunusualtweeting

behaviours

DiscoveryoftheBurstyBotnetbyunusualtweeting

behaviours

Twitterbotsandbotnet

Threats:Fakenews;spam;phishing;opinionmanipulation;streamingAPIcontamination;advertisementfraud...

Twitterbotdetection

• Manymethodsbasedon‘commonfeatures’ofbots• Onlysmallnumbersofbotsdetected

• Lackofgroundtruth

Outlineofthistalk

•RecentdiscoveryofStarWarsBotnet• 350,000bots

•OurdiscoveryoftheBurstyBotnet• 500,000bots• Unusualtweetingbehaviours• Directlinkwithaspammingattack

•ReflectiononTwitterbotdetection

Distributionofthelocationtagsoftweetsby1%Twitterusers

FirstclueoftheStarWarsbotnet

Uniformdistributionintworectanglezones?Evenonseaanddesert?

TweetsofrandomquotationsfromStarWarsnovels

Alltweets

Thesuspicioustweets

TheStarWarsBotnet• OnlytweetedrandomquotationsfromSWnovels.• OnlytweetedfromthesourceofWindowsphone

• Windowsphoneaccountsforonly0.02%ofalltweets.

• <10followers,<32friends,<11tweets....• >350,000Botsareidentified.

Nicestory...And?

0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.294

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Twitter ID (0 ~ 232)

Perc

en

tag

e

Twitter Users

ID Range containing Star−Wars Bots

Billions

1500 1510 1520 1530 1540 1550 1560 1570 1580 1590 1600

1%

5%

10%

30%

Twitter ID

Pe

rce

nta

ge

of

ID s

pa

ce

us

ed

Random Users

StarWars Bots

SWbotswerecreatedinburst!

SWbotsalsotweetedinburst!

• Alltheirtweetsweregeneratedimmediatelyaftertheircreation.

• Definitionof‘burstyusers’:• Usersthattweetedatleast3timesintheirfirsthour• Thentheynevertweetedagain

0 0.5 1.0 1.5 2.0 2.5 3.0 3.50

25%

50%

75%

100%

Twitter user ID space

Perc

en

tag

e o

f us

er ID

s

All users Bursty users

Star Wars bots

x10^9

Bursty bots

0 0.5 1.0 1.5 2.0 2.5 3.0 3.50

20,000

40,000

60,000

80,000

100,000

120,000

140,000

Twitter user ID space

Num

ber o

f bu

rsty

users

x10^9

Bursty bots

Star Wars bots

July 2013March 2012Feb 2012

June 2013

DiscoveryoftheBurstyBotnet

TheBurstyBotnet

• BurstyBotsonlytweetedintheirfirst2minutes.• TheywerecreatedinFebruaryandMarch2012.• TheyonlytweetedfromthesourceofMobileWeb.• Theymostlytweeted(i)aURL;and/or(ii)amention.

0 2 4 6 8 100

0.2

0.4

0.6

0.8

1

Minutes from creation to last tweet

Dis

trib

uti

on

Bursty bots

Star Wars bots

TheBurstyBotnet

• >500,000BurstyBotsareidentified.• StillaliveinTwitter.

• MostburstyusersareBurstyBots!

500 505 510 515 520 525 530 5350

2

4

6

8

10

12x 10

4

Twitter user IDs (x10^6)

Nu

mb

er

of

use

rs

Bursty users Bursty bots Difference

500 505 510 515 520 525 530 5350

5

10

15x 10

4

Twitter user IDs (x10^6)

Nu

mb

er

of

users

September 2015

September 2016

Disappeared Bursty bots

The‘disappeared’BurstyBots

• Another300,000BurstyBotshavebeenremovedbyTwitterbetweenSept.2015andSept.2016.• AvotefromTwitterthattheseareindeedbadbots?• ItseemsTwitterdoesnotknowwhatweknow?

• MostBurstyBotshavenofriendorfollower.• TheymostlytweetedonlyaURLand/oramention.

• Spammingattack?

TheBurstyBotnetproperties

TheBurstyBotnetspammingattack• 99.9%(2.8m)URLsareunique• ComplexURLshortenersandredirects.•MostURLspointtotwospamcampaigns.• Awebpageblockedbytinyurl.com• Aknownphishingwebpage

• www.facebook-goodies.com

Acarefullydesignedspammingattack

• 500,000botswerecreatedinburst,andtheytweetedinburst-- toevadebotdetection.• 2.8millionsuniqueURLsusingshortenersandredirects– tofoolspamdetection.• 1.3distinctTwitteruserswerementioned-- toincreasevisibilityandchanceofbeingclicked.• Success:61%ofURLswereactuallyclicked!• Aremarkablerevenue?

TheBurstyBotnet

•Nodoubtitisabotnet,anditwasforspammingattacks.•Furtherstudycanevenrevealtheallegedbotmaster.•Fullanalysisofthespammingattackwillbepublishedelsewhere.J• withalotofinterestingdetails...

ReflectiononTwitterbotsdetection•Existingmethodsfailtodetectlargebotnets•Theassumed“commonfeatures”arenotneccessarilycommon.•Understandable:lackofgroundtruth;evolvingbotnets

Along-termbattle• Thetwobotnetswerediscoveredbytheirunusualtweetingbehaviours.•Wecannotexpecttorepeatourluck.

•Botmasterswilllearnlessons.• Newbotnetswillavoidanyknownfeatures,especiallythecommonfeatures.

• Isa‘general’approachrealistic?• Todetectcommonorunusualfeatures?

ThankYou!

Dr.ShiZhouUniversityCollegeLondon(UCL)

ThankYou!

Dr.ShiZhouUniversityCollegeLondon(UCL)