Characterisation of web spambots using self organising maps

Abstract

The growth of spam in Web 2.0 environments not only reduces the quality and trust of the content but it also degrades the quality of search engine results. By means of web spambots, spammers are able to distribute spam content more efficiently to more targeted websites. Current anti-spam filtering solutions have not studied web spambots thoroughly and the characterisation of spambots remains an open area of research. In order to fill this research gap, this paper utilises Kohonen’s Self-Organising Map (SOM) to characterise web spambots. We analyse web usage data to profile web spambots based on three novel set of features i.e. action set, action frequency and action time. Our experimental results uncovered important characteristics of web spambots that 1) they focus on specific and limited actions compared with humans 2) they use multiple user accounts to spread spam content, hide their identity and bypass restrictions, 3) they bypass filling in submission forms and directly submit the content to the Web server in order to efficiently spread spam, 4) they can be categorise into 4 different categories based on their actions – content submitters, profile editors, content viewers and mixed behaviour, 5) they change their IP address based on different action to hide their tracks. Our results are promising and they suggest that our technique is capable of identifying spam in Web 2.0 applications.