Botnet command and control based on Short Message Service and human mobility

Many serious threats for PCs are spreading to the mobile environment. A mobile botnet, which is a collection of hijacked smartphones under the control of hackers, is one of them. With the quick development of the computing and communication abilities of smartphones, many command and control (C&C) techniques in PC botnets can be easily reused in mobile botnets. However, some particular functions and characteristics of smartphones may provide botmasters with additional means to control their mobile botnets. This paper presents two special C&C mechanisms that leverage Short Message Service and human mobility, respectively. The first one designs a SMS-based flooding algorithm to propagate commands. We theoretically prove that the uniform random graph is the optimal topology for this botnet, and demonstrate its high efficiency and stealth with various simulations. The second one utilizes Bluetooth to transmit botnet commands when hijacked smartphones encounter each other while in motion. We study its performance in a 100 m × 100 m square area with NS-2 simulations, and show that human-mobility characteristics facilitate the command propagation. Even if the infection rate is low, the command can still be effectively propagated provided that the mobility of devices is high. In the end, we propose effective defense strategies against these two special C&C mechanisms.     

A relation context oriented approach to identify strong ties in social networks

Strong ties play a crucial role in transmitting sensitive information in social networks, especially in the criminal justice domain. However, large social networks containing many entities and relations may also contain a large amount of noisy data. Thus, identifying strong ties accurately and efficiently within such a network poses a major challenge. This paper presents a novel approach to address the noise problem. We transform the original social network graph into a relation context-oriented edge-dual graph by adding new nodes to the original graph based on abstracting the relation contexts from the original edges (relations). Then we compute the local k-connectivity between two given nodes. This produces a measure of the robustness of the relations. To evaluate the correctness and the efficiency of this measure, we conducted an implementation of a system which integrated a total of 450 GB of data from several different data sources. The discovered social network contains 4,906,460 nodes (individuals) and 211,403,212 edges. Our experiments are based on 700 co-offenders involved in robbery crimes. The experimental results show that most strong ties are formed with k ? 2.     

Knowledge sharing and social media: Altruism,perceived online attachment motivation,and perceived online relationship commitment

Social media, such as Facebook and Twitter, have become extremely popular. Facebook, for example, has more than a billion registered users and thousands of millions of units of information are shared every day, including short phrases, articles, photos, and audio and video clips. However, only a tiny proportion of these sharing units trigger any type of knowledge exchange that is ultimately beneficial to the users. This study draws on the theory of belonging and the intrinsic motivation of altruism to explore the factors contributing to knowledge sharing behavior. Using a survey of 299 high school students applying for university after the release of the public examination results, we find that perceived online attachment motivation (β = 0.31, p < 0.001) and perceived online relationship commitment (β = 0.49, p < 0.001) have positive, direct, and significant effects on online knowledge sharing (R² 0.568). Moreover, when introduced into the model, altruism has a direct and significant effect on online knowledge sharing (β = 0.46, p < 0.001) and the total variance explained by the extended model increases to 64.9%. The implications of the findings are discussed.     

Efficient botnet herding within the Tor network

During 2013 the Tor network had a massive spike in new users as a botnet started using Tor hidden services to hide its C&C (Command and Control) servers. This resulted in network congestion and reduced performance for all users. Tor hidden services are attractive to botnet herders because they provide anonymity for both the C&C servers and the bots. The aim of this paper is to present a superior way that Tor hidden services can be used for botnet C&C which minimises harm to the Tor network while retaining all security benefits.     

The social sharing of emotion (SSE) in online social networks: A case study in Live Journal

Social Sharing of Emotion (SSE) occurs when one person shares an emotional experience with another and is considered potentially beneficial. Though social sharing has been shown prevalent in interpersonal communication, research on its occurrence and communication structure in online social networks is lacking. Based on a content analysis of blog posts (n = 540) in a blog social network site (Live Journal), we assess the occurrence of social sharing in blog posts, characterize different types of online SSE, and present a theoretical model of online SSE. A large proportion of initiation expressions were found to conform to full SSE, with negative emotion posts outnumbering bivalent and positive posts. Full emotional SSE posts were found to prevail, compared to partial feelings or situation posts. Furthermore, affective feedback predominated to cognitive and provided emotional support, empathy and admiration. The study found evidence that the process of social sharing occurs in Live Journal, replicating some features of face to face SSE. Instead of a superficial view of online social sharing, our results support a prosocial and beneficial character to online SSE.     

How political candidates use Twitter and the impact on votes

This study investigates the content characteristics of Twitter during an election campaign, and the relationship between candidates’ style of online campaigning (i.e., politically personalized and interactive communication) and electoral support for those candidates. Thereby, it provides a better understanding of the linkage between the use of Twitter by candidates and effects on preferential votes. Two data sources are used to examine this relationship: first, a quantitative computer-assisted as well as a manual content analysis of tweets posted by political candidates during the Dutch national elections of 2010 (N = 40,957) and second, a dataset containing the number of votes for electable political candidates during that period. The findings show that using Twitter has positive consequences for political candidates. Candidates who used Twitter during the course of the campaign received more votes than those who did not, and using Twitter in an interactive way had a positive impact as well.     

Perpetuating online sexism offline: Anonymity,interactivity, and the effects of sexist hashtags on social media

Sexism and sexual harassment are not uncommon in online environments such as social networking sites, forums, and video games. This experiment investigated whether users’ anonymity and level of interactivity with sexist content on social media influenced sexist attitudes and offline behavior. Participants (N = 172) used a Twitter account that was anonymous or had personally identifying details. They were asked to share (i.e., retweet) or write posts incorporating a sexist hashtag. After exposure, participants completed two purportedly unrelated tasks, a survey and a job hiring simulation in which they evaluated male and female candidates’ resumés. Anonymous participants reported greater hostile sexism after tweeting than nonanonymous participants. Participants who composed sexist tweets reported greater hostile sexism and ranked female job candidates as less competent than those who retweeted, although this did not significantly affect their likelihood to hire.     

Coping with information in social media: The effects of network structure and knowledge on perception of information value

The explosive growth of social media has intrigued many scholars to inquire into why people willingly share information with others. However, relatively little attention has been devoted to how people determine which information they share in the networked environment. In this study, a 2 (network density – dense vs. sparse) × 2 (knowledge – expert vs. novice) × 3 (information valence – negative vs. neutral vs. positive) online experiment was performed to examine how the three factors interact and cross over in shaping individuals’ perceptions of the value of information for themselves and for others in the network. Results show that individuals’ perceptions of information value are influenced not just by their level of knowledge, but also by how the network environment is structured. Implications for the findings are discussed.     

Resource monitoring for the detection of parasite P2P botnets

Detecting botnet behaviors in networks is a popular topic in the current research literature. The problem of detection of P2P botnets has been denounced as one of the most difficult ones, and this is even sounder when botnets use existing P2P networks infrastructure (parasite P2P botnets). The majority of the detection proposals available at present are based on monitoring network traffic to determine the potential existence of command-and-control communications (C&C) between the bots and the botmaster. As a different and novel approach, this paper introduces a detection scheme which is based on modeling the evolution of the number of peers sharing a resource in a P2P network over time. This allows to detect abnormal behaviors associated to parasite P2P botnet resources in this kind of environments. We perform extensive experiments on Mainline network, from which promising detection results are obtained while patterns of parasite botnets are tentatively discovered.     

Automatic protocol reverse-engineering: Message format extraction and field semantics inference

Understanding the command-and-control (C&C) protocol used by a botnet is crucial for anticipating its repertoire of nefarious activity. However, the C&C protocols of botnets, similar to many other application layer protocols, are undocumented. Automatic protocol reverse-engineering techniques enable understanding undocumented protocols and are important for many security applications, including the analysis and defense against botnets. For example, they enable active botnet infiltration, where a security analyst rewrites messages sent and received by a bot in order to contain malicious activity and to provide the botmaster with an illusion of successful and unhampered operation.In this work, we propose a novel approach to automatic protocol reverse engineering based on dynamic program binary analysis. Compared to previous work that examines the network traffic, we leverage the availability of a program that implements the protocol. Our approach extracts more accurate and complete protocol information and enables the analysis of encrypted protocols. Our automatic protocol reverse-engineering techniques extract the message format and field semantics of protocol messages sent and received by an application that implements an unknown protocol specification. We implement our techniques into a tool called Dispatcher and use it to analyze the previously undocumented C&C protocol of MegaD, a spam botnet that at its peak produced one third of the spam on the Internet.     

Analyzing MPI performance over 10-Gigabit ethernet

Recent work with 10-Gigabit (10 GbE) network adapters has demonstrated good performance in TCP/IP-based local- and wide-area networks (LANs and WANs). In the present work we present an evaluation of host-based 10 GbE adapters in a system-area network (SAN) in support of a cluster. This evaluation focuses on the performance of the message-passing interface (MPI) when running over a 10 GbE interconnect. We find that MPI over 10 GbE provides communications performance comparable to that of TCP alone and fairly competitive with more exotic technologies such as MPI over Quadrics. The optimization of MPI and MPI-based applications to make use of this performance, however, is a non-trivial task. Consequently, it is difficult for MPI-based applications to realize this performance when running current-generation 10 GbE hardware.     

Higher education scholars' participation and practices on Twitter

Scholars participate in online social networks for professional purposes. In such networks, learning takes the form of participation and identity formation through engagement in and contribution to networked practices. While current literature describes the possible benefits of online participation, empirical research on scholars' use of online social networks in the educational technology literature is negligible. The purpose of this paper is to understand scholars' naturalistic practices in social networks in general, and on Twitter in particular. Tweets from 45 scholars were analysed qualitatively to arrive at dominant themes describing online social network practice. Findings indicate that scholars participating on Twitter (1) shared information, resources, and media relating to their professional practice; (2) shared information about their classroom and their students; (3) requested assistance from and offered suggestions to others; (4) engaged in social commentary; (5) engaged in digital identity and impression management; (6) sought to network and make connections with others; and (7) highlighted their participation in online networks other than Twitter. These findings assist the field in understanding the emerging practice of scholarly participation in online networks.     

CoCoSpot: Clustering and recognizing botnet command and control channels using traffic analysis

We present CoCoSpot, a novel approach to recognize botnet command and control channels solely based on traffic analysis features, namely carrier protocol distinction, message length sequences and encoding differences. Thus, CoCoSpot can deal with obfuscated and encrypted C&C protocols and complements current methods to fingerprint and recognize botnet C&C channels. Using average-linkage hierarchical clustering of labeled C&C flows, we show that for more than 20 recent botnets and over 87,000 C&C flows, CoCoSpot can recognize more than 88% of the C&C flows at a false positive rate below 0.1%.     

Bivariate quality control using two-stage intelligent monitoring scheme

In manufacturing industries, it is well known that process variation is a major source of poor quality products. As such, monitoring and diagnosis of variation is essential towards continuous quality improvement. This becomes more challenging when involving two correlated variables (bivariate), whereby selection of statistical process control (SPC) scheme becomes more critical. Nevertheless, the existing traditional SPC schemes for bivariate quality control (BQC) were mainly designed for rapid detection of unnatural variation with limited capability in avoiding false alarm, that is, imbalanced monitoring performance. Another issue is the difficulty in identifying the source of unnatural variation, that is, lack of diagnosis, especially when dealing with small shifts. In this research, a scheme to address balanced monitoring and accurate diagnosis was investigated. Design consideration involved extensive simulation experiments to select input representation based on raw data and statistical features, artificial neural network recognizer design based on synergistic model, and monitoring–diagnosis approach based on two-stage technique. The study focused on bivariate process for cross correlation function, ρ = 0.1–0.9 and mean shifts, μ = ±0.75–3.00 standard deviations. The proposed two-stage intelligent monitoring scheme (2S-IMS) gave superior performance, namely, average run length, ARL₁ = 3.18–16.75 (for out-of-control process), ARL₀ = 335.01–543.93 (for in-control process) and recognition accuracy, RA = 89.5–98.5%. This scheme was validated in manufacturing of audio video device component. This research has provided a new perspective in realizing balanced monitoring and accurate diagnosis in BQC.     

Posting,commenting, and tagging: Effects of sharing news stories on Facebook

Social networking sites such as Facebook provide new ways of sharing news stories that allow users to act as opinion leaders in their networks, encourage discussion, and potentially increase their involvement in current events. This study identifies the particular features of Facebook that facilitate the discussion of news and tests their effects on involvement and feelings of influence. Participants (N = 265) in a 3 (Broadcast level: news feed vs. wall post vs. direct message) × 3 (Elaboration: opinion vs. question vs. no comment) × 2 (Involving-friends: tag vs. no tag) between-subjects factorial experiment were randomly assigned to share a story from a news website on Facebook. Results show that user involvement in the news content depends on the social affordances of the site, particularly those that allow for audience customization and those that drive network feedback. Asking the network’s opinions and targeting specific friends led to greater involvement in the news content. Discussion through comments led to a greater sense of influence and greater involvement for those sharing the news story. These findings highlight the importance of encouraging individuals to act as sources of information in their networks to drive engagement in current events in the changing news landscape.     

Well-being and problematic Facebook use

Social networking sites are getting more widespread online communication forms all over the world. Especially adolescents and emerging adults use these sites to make connection, and share something. Although, Facebook is one of the most popular sites, research is still in nascent phase on the excessive use of Facebook. Hence, it is fundamental to determine potential predictors of overuse of Facebook. The present study investigated the relationship between well-being and problematic Facebook use. Participants were 311 university students [179_(58%) female, 132_(42%) male, M_age = 20.86 years, SD = 1.61] who completed the questionnaire packet including the Bergen Facebook Addiction Scale (Andreassen, Torsheim, Brunborg, & Pallesen, 2012), the Satisfaction with Life Scale (Diener, Emmons, Larsen, & Griffin, 1985), the Subjective Vitality Scale (Ryan & Frederick, 1997), the Flourishing Scale (Diener et al., 2010), and the Subjective Happiness Scale (Lyubomirsky & Lepper, 1999). A stepwise regression analyses was used with four independent variables (life satisfaction, subjective vitality, flourishing, and subjective happiness) to explain variance in problematic Facebook use. The results showed that life satisfaction, subjective vitality, flourishing, and subjective happiness were significant negative predictors of problematic Facebook use. The significance and limitations of the results are discussed.     

Teens’ concern for privacy when using social networking sites: An analysis of socialization agents and relationships with privacy-protecting behaviors

U.S. teens are spending substantial time on social networking sites (SNSs). Yet, only a few studies have documented teens’ privacy-protecting behaviors on SNSs. Using data of Facebook teen users and their parents in the U.S. from the Pew Internet’s Teens & Privacy Management Survey (N = 622), this study investigated the socialization agents of teens’ level of online privacy concern, and the relationship between teens’ level of online privacy concern and their privacy-protecting behaviors on SNSs. Based on path analysis results, this study identified parents and SNS use as the two significant socialization agents. In particular, this study revealed the role of parents’ privacy concern and the role of SNS use in motivating teens to increase online privacy concern, which, in turn, drives teens to adopt various privacy-setting strategies on SNSs and to set their Facebook profiles to private. Implications for policymakers and educators were discussed.     

Investigating the moderating role of uncertainty avoidance cultural values on multidimensional online trust

Building online trust and understanding its relationship to online customer purchase decision making is important to e-commerce companies. We decided to investigate the moderating role of uncertainty avoidance on the relationship between subjective norms and online trust (integrity, ability, and benevolence) as well as purchase intention on a model we had developed. We generated a questionnaire and first pilot tested it (n = 116), and then modified it before performing the main test of our model (n = 209). Specifically, trust (cognition and affect based) was adapted to better understand social and cultural factors in online customer behavior. Uncertainty avoidance was found to moderate the relationships between subjective norms and two dimensions of cognition-based trust, (integrity and ability). Benevolence, however, was not found to have any relationship to cultural values or purchase intention. Normative influence on ability belief about the website was significant only when the online consumer had a high sense of uncertainty avoidance. Theoretical and practical implications of these findings are discussed.     

Facing scalability: Naming faces in an online social network

Automatically naming faces in online social networks enables us to search for photos and build user face models. We consider two common weakly supervised settings where: (1) users are linked to photos, not to faces and (2) photos are not labeled but part of a user's album. The focus is on algorithms that scale up to an entire online social network. We extensively evaluate different graph-based strategies to label faces in both settings and consider dependencies. We achieve results on a par with a recent multi-person approach, but with 60 times less computation time on a set of 300K weakly labeled faces and 1.4 M faces in user albums. A subset of the faces can be labeled with a speed-up of over three orders of magnitude.