Detecting and Understanding the Promotion of Illicit Goods and Services on Twitter

TL;DR

This paper uncovers extensive illicit promotion activities on Twitter and other social networks, utilizing machine learning tools to detect and analyze millions of posts, revealing the scale, categories, and evasion tactics of illicit promotion campaigns.

Contribution

It introduces novel machine learning methods for detecting and analyzing illicit promotion posts and campaigns across multiple social media platforms, with large-scale empirical findings.

Findings

12 million PIPs detected on Twitter over 6 months

90% of PIPs survive beyond two months due to evasion tactics

Illicit promotions span 5 languages and 10 categories

Abstract

In this study, we reveal, for the first time, popular online social networks (especially Twitter) are being extensively abused by miscreants to promote illicit goods and services of diverse categories. This study is made possible by multiple machine learning tools that are designed to detect and analyze Posts of Illicit Promotion (PIPs) as well as revealing their underlying promotion campaigns. Particularly, we observe that PIPs are prevalent on Twitter, along with extensive visibility on other three popular OSNs including YouTube, Facebook, and TikTok. For instance, applying our PIP hunter to the Twitter platform for 6 months has led to the discovery of 12 million distinct PIPs which are widely distributed in 5 major natural languages and 10 illicit categories, e.g., drugs, data leakage, gambling, and weapon sales. Along the discovery of PIPs are 580K Twitter accounts publishing PIPs as well as 37K distinct instant messaging accounts that are embedded in PIPs and serve as next hops of communication with prospective customers. Also, an arms race between Twitter and illicit promotion operators is also observed. Especially, 90% PIPs can survice the first two months since getting published on Twitter, which is likely due to the diverse evasion tactics adopted by miscreants to masquerade PIPs.