TY - JOUR
T1 - Measuring, characterizing, and detecting facebook like farms
AU - Ikram, Muhammad
AU - Onwuzurike, Lucky
AU - Farooqi, Shehroze
AU - De Cristofaro, Emiliano
AU - Friedman, Arik
AU - Jourjon, Guillaume
AU - Kaafar, Mohammed Ali
AU - Shafiq, M. Zubair
PY - 2017/9/1
Y1 - 2017/9/1
N2 - Online social networks offer convenient ways to reach out to large audiences. In particular, Facebook pages are increasingly used by businesses, brands, and organizations to connect with multitudes of users worldwide. As the number of likes of a page has become a de-facto measure of its popularity and profitability, an underground market of services artificially inflating page likes ("like farms") has emerged alongside Facebook's official targeted advertising platform. Nonetheless, besides a fewmedia reports, there is littlework that systematically analyzes Facebook pages' promotion methods. Aiming to fill this gap, we present a honeypotbased comparative measurement study of page likes garnered via Facebook advertising and from popular like farms. First, we analyze likes based on demographic, temporal, and social characteristics and find that some farms seem to be operated by bots and do not really try to hide the nature of their operations, while others follow a stealthier approach, mimicking regular users' behavior. Next, we look at fraud detection algorithms currently deployed by Facebook and show that they do not work well to detect stealthy farms that spread likes over longer timespans and like popular pages to mimic regular users. To overcome their limitations, we investigate the feasibility of timeline-based detection of like farm accounts, focusing on characterizing content generated by Facebook accounts on their timelines as an indicator of genuine versus fake social activity. We analyze a wide range of features extracted from timeline posts, which we group into two main categories: lexical and non-lexical.We find that like farm accounts tend to re-share content more often, use fewer words and poorer vocabulary, and more often generate duplicate comments and likes compared to normal users. Using relevant lexical and non-lexical features, we build a classifier to detect like farms accounts that achieves a precision higher than 99% and a 93% recall.
AB - Online social networks offer convenient ways to reach out to large audiences. In particular, Facebook pages are increasingly used by businesses, brands, and organizations to connect with multitudes of users worldwide. As the number of likes of a page has become a de-facto measure of its popularity and profitability, an underground market of services artificially inflating page likes ("like farms") has emerged alongside Facebook's official targeted advertising platform. Nonetheless, besides a fewmedia reports, there is littlework that systematically analyzes Facebook pages' promotion methods. Aiming to fill this gap, we present a honeypotbased comparative measurement study of page likes garnered via Facebook advertising and from popular like farms. First, we analyze likes based on demographic, temporal, and social characteristics and find that some farms seem to be operated by bots and do not really try to hide the nature of their operations, while others follow a stealthier approach, mimicking regular users' behavior. Next, we look at fraud detection algorithms currently deployed by Facebook and show that they do not work well to detect stealthy farms that spread likes over longer timespans and like popular pages to mimic regular users. To overcome their limitations, we investigate the feasibility of timeline-based detection of like farm accounts, focusing on characterizing content generated by Facebook accounts on their timelines as an indicator of genuine versus fake social activity. We analyze a wide range of features extracted from timeline posts, which we group into two main categories: lexical and non-lexical.We find that like farm accounts tend to re-share content more often, use fewer words and poorer vocabulary, and more often generate duplicate comments and likes compared to normal users. Using relevant lexical and non-lexical features, we build a classifier to detect like farms accounts that achieves a precision higher than 99% and a 93% recall.
KW - measurement
KW - like farm detection
KW - social networks
KW - machine learning
UR - http://www.scopus.com/inward/record.url?scp=85030219882&partnerID=8YFLogxK
U2 - 10.1145/3121134
DO - 10.1145/3121134
M3 - Article
AN - SCOPUS:85030219882
SN - 2471-2566
VL - 20
SP - 1
EP - 28
JO - ACM Transactions on Privacy and Security
JF - ACM Transactions on Privacy and Security
IS - 4
M1 - 13
ER -