{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T14:44:28Z","timestamp":1740149068078,"version":"3.37.3"},"reference-count":38,"publisher":"Wiley","issue":"13","license":[{"start":{"date-parts":[[2016,2,24]],"date-time":"2016-02-24T00:00:00Z","timestamp":1456272000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation","doi-asserted-by":"crossref","award":["61170265"],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security Comm Networks"],"published-print":{"date-parts":[[2016,9,10]]},"abstract":"Abstract<\/jats:title>The security implications of social bots are evident in consideration of the fact that data sharing and propagation functionality are well integrated with social media sites. Existing social bots primarily use Really Simple Syndication and OSN (online social network) application program interface to communicate with OSN servers. Researchers have profiled their behaviors well and have proposed various mechanisms to defend against them. We predict that a web test automation rootkit (WTAR) is a prospective approach for designing malicious social bots. In this paper, we first present the principles of designing WTAR\u2010based social bots. Second, we implement three WTAR\u2010based bot prototypes on Facebook, Twitter, and Weibo. Third, we validate this new threat by analyzing behaviors of the prototypes in a lab environment and on the Internet, and analyzing reports from widely\u2010used antivirus software. Our analyses show that WTAR\u2010based social bots have the following features: (i) they do not connect to OSN directly, and therefore produce few network flows; (ii) they can log in to OSNs easily and perform a variety of social activities; (iii) they can mimic the behaviors of a human user on an OSN. Finally, we propose several possible mechanisms in order to defend against WTAR\u2010based social bots. Copyright \u00a9 2016 John Wiley & Sons, Ltd.<\/jats:p>","DOI":"10.1002\/sec.1475","type":"journal-article","created":{"date-parts":[[2016,2,26]],"date-time":"2016-02-26T03:36:29Z","timestamp":1456457789000},"page":"2157-2172","source":"Crossref","is-referenced-by-count":4,"title":["Understanding a prospective approach to designing malicious social bots"],"prefix":"10.1002","volume":"9","author":[{"given":"Yukun","family":"He","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology Jilin University Changchun 130012 China"},{"name":"Knowledge Engineer of Ministry of Education Jilin University Changchun 130012 China"}]},{"given":"Guangyan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology Tsinghua University Beijing 100084 China"}]},{"given":"Jie","family":"Wu","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Sciences Temple University Philadelphia 19122 PA U.S.A."}]},{"given":"Qiang","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology Jilin University Changchun 130012 China"},{"name":"Knowledge Engineer of Ministry of Education Jilin University Changchun 130012 China"}]}],"member":"311","published-online":{"date-parts":[[2016,2,24]]},"reference":[{"issue":"4","key":"e_1_2_10_2_1","first-page":"18","article-title":"Understanding latent interactions in online social networks","volume":"7","author":"Jiang J","year":"2013","journal-title":"ACM Transactions on the Web (TWEB)"},{"key":"e_1_2_10_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.06.006"},{"key":"e_1_2_10_4_1","doi-asserted-by":"crossref","unstructured":"ThomasK NicolDM.The Koobface botnet and the rise of social malware.In2010 5th International Conference on Malicious and Unwanted Software (MALWARE).IEEE:Nancy France 2010;63\u201370.","DOI":"10.1109\/MALWARE.2010.5665793"},{"key":"e_1_2_10_5_1","doi-asserted-by":"crossref","unstructured":"KartaltepeEJ MoralesJA XuS SandhuR.Social network\u2010based botnet command\u2010and\u2010control: emerging threats and countermeasures.InIn Applied Cryptography and Network Security.Springer:Beijing China 2010;511\u2013528.","DOI":"10.1007\/978-3-642-13708-2_30"},{"key":"e_1_2_10_6_1","doi-asserted-by":"crossref","unstructured":"NagarajaS HoumansadrA PiyawongwisalP SinghV AgarwalP BorisovN.Stegobot: a covert social network botnet.InIn Information Hiding.Springer:Prague Czech Republic 2011;299\u2013313.","DOI":"10.1007\/978-3-642-24178-9_21"},{"volume-title":"Facebot: An Undiscoverable Botnet Based on Treasure Hunting Social Networks","author":"Verkamp J\u2010P","key":"e_1_2_10_7_1"},{"key":"e_1_2_10_8_1","doi-asserted-by":"publisher","DOI":"10.5815\/ijcnis.2013.06.02"},{"key":"e_1_2_10_9_1","doi-asserted-by":"crossref","unstructured":"DallmeierV PohlB BurgerM MiroldM ZellerA.Webmate: web application test generation in the real world.InIn 2014 IEEE Seventh International Conference on Software Testing Verification and Validation Workshops (ICSTW).IEEE:Cleveland Ohio 2014;413\u2013418.","DOI":"10.1109\/ICSTW.2014.65"},{"key":"e_1_2_10_10_1","doi-asserted-by":"crossref","unstructured":"ThummalapentaS DevakiP SinhaS ChandraS GnanasundaramS NagarajDD SathishkumarS.Efficient and change\u2010resilient test automation: an industrial case study.InIn Proceedings of the 2013 International Conference on Software Engineering.IEEE Press:San Francisco CA 2013;1002\u20131011.","DOI":"10.1109\/ICSE.2013.6606650"},{"key":"e_1_2_10_11_1","unstructured":"LeeTH LookG ZhangH AhmedD SinghP.Automatically testing a web application that has independent display trees: U.S. Patent 8 572 505[P]. 2013\u201010\u201029."},{"key":"e_1_2_10_12_1","doi-asserted-by":"crossref","unstructured":"KingST ChenPM.Subvirt: implementing malware with virtual machines.InIn 2006 IEEE Symposium on Security and Privacy.IEEE:Berkeley California 2006;314\u2013327.","DOI":"10.1109\/SP.2006.38"},{"key":"e_1_2_10_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.pmcj.2006.07.008"},{"key":"e_1_2_10_14_1","doi-asserted-by":"publisher","DOI":"10.1002\/sec.166"},{"key":"e_1_2_10_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2008.35"},{"key":"e_1_2_10_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.06.007"},{"key":"e_1_2_10_17_1","doi-asserted-by":"crossref","unstructured":"ZengY ShinKG HuX.Design of sms commanded\u2010and\u2010controlled and p2p\u2010structured mobile botnets.InIn Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks.ACM:Tucson Arizona 2012;137\u2013148.","DOI":"10.1145\/2185448.2185467"},{"key":"e_1_2_10_18_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.04.003"},{"key":"e_1_2_10_19_1","unstructured":"BoshmafY MuslukhovI BeznosovK RipeanuM.Key challenges in defending against malicious socialbots. InIn Proceedings of the 5th USENIX Conference on Large\u2010scale Exploits and Emergent Threats LEET Vol. 12 :San Jose California 2012; p.\u00a012."},{"key":"e_1_2_10_20_1","first-page":"2","article-title":"When social bots attack: Modeling susceptibility of users in online social networks","author":"Wagner C","year":"2012","journal-title":"Making Sense of Microposts (MSM2012)"},{"key":"e_1_2_10_21_1","series-title":"Information Systems Security","first-page":"131","volume-title":"Towards Detection of Botnet Communication Through Social Media by Monitoring User Activity","author":"Burghouwt P","year":"2011"},{"key":"e_1_2_10_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.10.005"},{"key":"e_1_2_10_23_1","doi-asserted-by":"crossref","unstructured":"SteinT ChenE ManglaK.Facebook immune system.InProceedings of the 4th Workshop on Social Network Systems.ACM:Ambleside United Kingdom 2011; p.\u00a08.","DOI":"10.1145\/1989656.1989664"},{"key":"e_1_2_10_24_1","doi-asserted-by":"crossref","unstructured":"CaoQ YangX YuJ PalowC.Uncovering large groups of active malicious accounts in online social networks.InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications security (CCS).ACM:Scottsdale Arizona 2014;477\u2013488.","DOI":"10.1145\/2660267.2660269"},{"key":"e_1_2_10_25_1","doi-asserted-by":"crossref","unstructured":"BoshmafY LogothetisD SiganosG Ler\u00edaxJ LorenzoxJ RipeanuM BeznosovK.Integro: leveraging victim prediction for robust fake account detection in OSNs.InProceedings of Network and Distributed System Security Symposium (NDSS15):San Diego CA 2015;8\u201311.","DOI":"10.14722\/ndss.2015.23260"},{"key":"e_1_2_10_26_1","doi-asserted-by":"crossref","unstructured":"StringhiniG KruegelC VignaG.Detecting spammers on social networks[c]\/\/.InProceedings of the 26th Annual Computer Security Applications Conference.ACM:Austin Texas 2010;1\u20139.","DOI":"10.1145\/1920261.1920263"},{"key":"e_1_2_10_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2556609"},{"key":"e_1_2_10_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.06.019"},{"issue":"4","key":"e_1_2_10_29_1","doi-asserted-by":"crossref","first-page":"363","DOI":"10.1145\/1851275.1851226","article-title":", et al. An analysis of social network\u2010based sybil defenses","volume":"41","author":"Viswanath B","year":"2011","journal-title":"ACM SIGCOMM Computer Communication Review"},{"key":"e_1_2_10_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.physrep.2009.11.002"},{"key":"e_1_2_10_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.07.016"},{"key":"e_1_2_10_32_1","doi-asserted-by":"crossref","unstructured":"XueJ YangZ YangX et al..Votetrust: leveraging friend invitation graph to defend against social network sybils.InINFOCOM 2013 Proceedings IEEE.IEEE:Turin Italy 2013;2400\u20132408.","DOI":"10.1109\/INFCOM.2013.6567045"},{"key":"e_1_2_10_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2014.2312547"},{"key":"e_1_2_10_34_1","unstructured":"MotoyamaM LevchenkoK KanichC McCoyD VoelkerGM SavageS.Re: Captchasunderstanding captcha\u2010solving services in an economic context.InIn USENIX Security Symposium vol.\u00a010. vol. 10 2010 p. 3."},{"key":"e_1_2_10_35_1","unstructured":"BurszteinE BethardS.Decaptcha: breaking 75% of ebay audio captchas.InIn Proceedings of the 3rd USENIX conference on Offensive technologies USENIX Association:Montreal Canada. 2009 p. 8."},{"key":"e_1_2_10_36_1","doi-asserted-by":"crossref","unstructured":"BurszteinE BeauxisR PaskovH PeritoD FabryC MitchellJ.The failure of noise\u2010based noncontinuous audio captchas.InIn 2011 IEEE Symposium on Security and Privacy (SP).IEEE:Oakland California 2011;19\u201331.","DOI":"10.1109\/SP.2011.14"},{"key":"e_1_2_10_37_1","doi-asserted-by":"crossref","unstructured":"GolleP.Machine learning attacks against the asirra captcha.InIn Proceedings of the 15th ACM Conference on Computer and Communications Security.ACM:Alexandria Virginia 2008;535\u2013542.","DOI":"10.1145\/1455770.1455838"},{"key":"e_1_2_10_38_1","doi-asserted-by":"publisher","DOI":"10.1147\/rd.383.0243"},{"key":"e_1_2_10_39_1","unstructured":"WangT LuK LuL ChungS LeeW.Jekyll on Ios: when benign apps become evil.Inin Usenix Security vol.\u00a013:Washington D.C. 2013;559\u2013572."}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fsec.1475","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fsec.1475","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/sec.1475","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,3]],"date-time":"2023-09-03T00:32:37Z","timestamp":1693701157000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/sec.1475"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,2,24]]},"references-count":38,"journal-issue":{"issue":"13","published-print":{"date-parts":[[2016,9,10]]}},"alternative-id":["10.1002\/sec.1475"],"URL":"https:\/\/doi.org\/10.1002\/sec.1475","archive":["Portico"],"relation":{},"ISSN":["1939-0114","1939-0122"],"issn-type":[{"type":"print","value":"1939-0114"},{"type":"electronic","value":"1939-0122"}],"subject":[],"published":{"date-parts":[[2016,2,24]]}}}