Javed Amir, Ikwu Ruth, Burnap Pete, Giommoni Luca, Williams Matthew L
School of Computer Science and Informatics, Cardiff University, Cardiff, UK.
School of Social Sciences, Cardiff University, Cardiff, UK.
Soc Netw Anal Min. 2022;12(1):117. doi: 10.1007/s13278-022-00944-2. Epub 2022 Aug 20.
This paper tests disruption strategies in Twitter networks containing malicious URLs used in drive-by download attacks. Cybercriminals use popular events that attract a large number of Twitter users to infect and propagate malware by using trending hashtags and creating misleading tweets to lure users to malicious webpages. Due to Twitter's 280 character restriction and automatic shortening of URLs, it is particularly susceptible to the propagation of malware involved in drive-by download attacks. Considering the number of online users and the network formed by retweeting a tweet, a cybercriminal can infect millions of users in a short period. Policymakers and researchers have struggled to develop an efficient network disruption strategy to stop malware propagation effectively. We define an efficient strategy as one that considers network topology and dependency on network resilience, where resilience is the ability of the network to continue to disseminate information even when users are removed from it. One of the challenges faced while curbing malware propagation on online social platforms is understanding the cybercriminal network spreading the malware. Combining computational modelling and social network analysis, we identify the most effective strategy for disrupting networks of malicious URLs. Our results emphasise the importance of specific network disruption parameters such as network and emotion features, which have proved to be more effective in disrupting malicious networks compared to random strategies. In conclusion, disruption strategies force cybercriminal networks to become more vulnerable by strategically removing malicious users, which causes successful network disruption to become a long-term effort.
本文测试了包含用于驱动下载攻击的恶意URL的推特网络中的破坏策略。网络犯罪分子利用吸引大量推特用户的热门事件，通过使用热门话题标签和创建误导性推文来诱使用户访问恶意网页，从而感染并传播恶意软件。由于推特280字符的限制以及URL的自动缩短，它特别容易受到驱动下载攻击中所涉及的恶意软件传播的影响。考虑到在线用户数量以及转发推文所形成的网络，网络犯罪分子能够在短时间内感染数百万用户。政策制定者和研究人员一直在努力制定一种有效的网络破坏策略，以有效阻止恶意软件的传播。我们将一种有效的策略定义为一种考虑网络拓扑结构以及对网络弹性的依赖性的策略，其中弹性是指即使从网络中移除用户，网络仍能继续传播信息的能力。在遏制在线社交平台上的恶意软件传播时所面临的挑战之一是了解传播恶意软件的网络犯罪分子网络。通过结合计算建模和社交网络分析，我们确定了破坏恶意URL网络的最有效策略。我们的结果强调了特定网络破坏参数（如网络和情感特征）的重要性，事实证明，与随机策略相比，这些参数在破坏恶意网络方面更有效。总之，破坏策略通过战略性地移除恶意用户，迫使网络犯罪分子网络变得更加脆弱，这使得成功的网络破坏成为一项长期努力。
