HyperMan: detecting misbehavior in online forums based on hyperlink posting behavior

• Published in: Social network analysis and mining Vol. 12; no. 1; p. 111
• Main Authors: Islam, Risul, Treves, Ben, Rokon, Md Omar Faruk, Faloutsos, Michalis
• Format: Journal Article
• Language: English
• Published: Vienna Springer Vienna 01.12.2022; Springer Nature B.V
• Subjects: Algorithms; Applications of Graph Theory and Complex Networks; Behavior; Collaboration; Computer Science; Cybercrime; Data Mining and Knowledge Discovery; Datasets; Economics; Ethics; Game Theory; Hackers; Humanities; Jargon; Law; Malware; Methodology of the Social Sciences; Original Article; Ransomware; Security; Social and Behav. Sciences; Spamming; Special Issue on Deviant Behaviors on Social Media; Statistics for Social Sciences; URLs; User generated content; Misbehavior detection; URL extraction; Phishing detection; Security forums
• ISSN: 1869-5450; 1869-5469
• DOI: 10.1007/s13278-022-00943-3

How can we detect and analyze hyperlink-driven misbehavior in online forums? Online forums contain enormous amounts of user-generated contents, with threads and comments frequently supplemented by hyperlinks. These hyperlinks are often posted with malicious intention and we refer to this as ‘hyperlink-driven misbehavior.’ We present HyperMan, a systematic suite of capabilities, to detect and analyze hyperlink-driven misbehavior in online forums. We take a unique perspective focusing on hyperlink sharing practices of the users to spot misbehavior. HyperMan can categorize these hyperlinks as (a) phishing, (b) spamming, and (b) promoting malicious products. Our approach consists of three high-level phases: (a) extracting hyperlinks from the textual data, (b) identifying misbehaving hyperlinks, and (c) modeling the behavioral patterns of hyperlink sharing, where we identify key hyperlinks and analyze the collaboration dynamics of hyperlink sharing. In addition, we implement our approach as a powerful and easy-to-use open platform for practitioners. We apply HyperMan to spot misbehavior from three online security forums, where we expect the users to be more security-aware. We show that our approach works very well in terms of retrieving and classifying hyperlinks compared to previous solutions. Furthermore, we find non-trivial and often systematic misbehavior: (a) we find a total of 2703 misbehaving hyperlinks, and (b) we identify 94 colluding groups of users in terms of promoting hyperlinks. Our work is a significant step toward mining online forums and detecting misbehaving users comprehensively.