UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

EvilCohort: Detecting Communities of Malicious Accounts on Online Services

Stringhini, G; Mourlanne, P; Jacob, G; Egele, M; Kruegel, C; Vigna, G; (2015) EvilCohort: Detecting Communities of Malicious Accounts on Online Services. In: Proceedings of the 24th USENIX Security Symposium. (pp. pp. 563-578). USENIX: Washington, D.C., USA. Green open access

[thumbnail of Stringhini_sec15-paper-stringhini.pdf]
Preview
Text
Stringhini_sec15-paper-stringhini.pdf - Published version

Download (2MB) | Preview

Abstract

Cybercriminals misuse accounts on online services (e.g., webmails and online social networks) to perform malicious activity, such as spreading malicious content or stealing sensitive information. In this paper, we show that accounts that are accessed by botnets are a popular choice by cybercriminals. Since botnets are composed of a finite number of infected computers, we observe that cybercriminals tend to have their bots connect to multiple online accounts to perform malicious activity. We present EVILCOHORT, a system that detects online accounts that are accessed by a common set of infected machines. EVILCOHORT only needs the mapping between an online account and an IP address to operate, and can therefore detect malicious accounts on any online service (webmail services, online social networks, storage services) regardless of the type of malicious activity that these accounts perform. Unlike previous work, our system can identify malicious accounts that are controlled by botnets but do not post any malicious content (e.g., spam) on the service. We evaluated EVILCOHORT on multiple online services of different types (a webmail service and four online social networks), and show that it accurately identifies malicious accounts.

Type: Proceedings paper
Title: EvilCohort: Detecting Communities of Malicious Accounts on Online Services
Event: 24th USENIX Security Symposium
Location: Washington, DC, USA
Dates: 12 August 2015 - 14 August 2015
ISBN-13: 9781931971232
Open access status: An open access version is available from UCL Discovery
Publisher version: https://www.usenix.org/system/files/conference/use...
Language: English
UCL classification: UCL
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
URI: https://discovery.ucl.ac.uk/id/eprint/1469445
Downloads since deposit
14Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item