Network Analysis of Recurring YouTube Spam Campaigns

TL;DR

This paper uses network motif profiling to analyze and track recurring spam campaigns on YouTube, revealing distinct strategies and identifying associated user accounts over time.

Contribution

It introduces a novel network motif profiling method to distinguish and monitor different YouTube spam campaign strategies.

Findings

Identified two distinct spam campaign strategies

Tracked active campaigns over time using motif profiling

Successfully associated user accounts with specific spam strategies

Abstract

As the popularity of content sharing websites such as YouTube and Flickr has increased, they have become targets for spam, phishing and the distribution of malware. On YouTube, the facility for users to post comments can be used by spam campaigns to direct unsuspecting users to bogus e-commerce websites. In this paper, we demonstrate how such campaigns can be tracked over time using network motif profiling, i.e. by tracking counts of indicative network motifs. By considering all motifs of up to five nodes, we identify discriminating motifs that reveal two distinctly different spam campaign strategies. One of these strategies uses a small number of spam user accounts to comment on a large number of videos, whereas a larger number of accounts is used with the other. We present an evaluation that uses motif profiling to track two active campaigns matching these strategies, and identify some of the associated user accounts.