La relación de la Responsabilidad Social Corporativa con el Marketing

Account-based heuristics use features of user behaviour to derive decisions about tweets. The method facilitates the process of observing suspicious behaviour seen in fake or infected accounts in OSNs [56]. Researchers have to observe real spam

content to know what features and characteristics to depend on in order to differentiate suspicious accounts from normal ones [90]. Researchers assess observations to come up with the most relevant set of salient features. Fake accounts’ functions differ in OSNs, and these differences are reflected in their posting pattern and/or profile properties. Researchers have claimed to identify automated and suspicious behaviour through certain features [9] that are gathered from users’ profiles and/or their published content.

Table 2.2 shows the features researchers [90]–[93] used in their machine learning methods. The first column shows features collected from Twitter user accounts and the second column presents a group of properties that could be found in the tweets’ content.

Table 2.2 List of Twitter features adopted by previous studies [90]–[93] User features Studies Content features Studies

Length of profile name [94] Number of tweets posted per day [9][95] Length of profile description [90] [95] Number of tweets posted [9]

Number of followings [9] [95] Retweet count [92]

Number of followers [9] [95] Tweet content similarity [45][96] Account age (days) [9] [64] [92] Mentions [97][96][64] Ratio of number of

followings and followers [36] [9] Tweet language [95]

Real name [98] Number of hashtags [9][64]

User verified [99] Number of URL links [9][64]

All the characteristics mentioned in Table 2.2 can be collected using the Twitter stream API [100], which is provided by Twitter to allow researchers to access random portions of tweet feeds and profiles’ metadata. Researchers use subsets of the

mentioned features to build classifiers based on the selection algorithm they have used. Several studies [9][36][96] have agreed that fake accounts tend to follow more accounts than they have followers for their own account. The analysis of this noticeable difference due to fraudulent accounts does not attract the attention of genuine users, and to attract them, they follow, mention, and favourite them. The high ratio of URLs in user content is also an indicator of spamming activities. One of the features that has been focused on by researchers is content/URL similarity. It is obvious that spam campaigns are run by a large number of accounts; based on this fact, many researchers have attempted to detect similar content in OSNs [101][102][36]. Stringhini [45] employed similarity in users’ content and attached URLs to cluster users that might be deploying a spam campaign. Analysis was required to identify compromised accounts that are involved in this campaign. By building a behavioural profile of each suspected account, if the content is not consistent with the user’s behaviour, then the user is identified as having a compromised account. Although this method could be useful to cluster tweet text content, in terms of URLs, spammers could evade original URLs using multiple shortened URLs.

Cresci et al. [103] used 49 distinct features derived from Twitter-only lightweight features. Lightweight features are those that do not require complicated pre- processing operations or significant resources to be extracted, e.g. age of account and number of followers. Chen et al. [86] extracted 12 lightweight features and build six different classification algorithms – BayesNet, NB, DT (C4.5), k-NN, SVMs and RF – which are ordered here in terms of their F-measure scores. RF had the highest performance at 93.6 per cent in the F-measure using an evenly distributed dataset. In the case of highly imbalanced datasets, however, such as a 1:19 ratio for spam/non-

spam, the performance dropped to 56.6 per cent. Classifiers that have been trained on imbalanced data are more likely to be subject to bias by majority class results.

McCord et al. [104] used lightweight features to classify user content into spam or normal. The features were extracted from Twitter account information (e.g. number of followers/following) and tweet content information, such as the number of mentions and hashtags. Similar to previous studies, the authors used several machine learning algorithms to compare their performance. The algorithms used were RF, SVM, NB, and k-NN. The authors found that the RF algorithm achieved the highest precision (95.7 per cent) and F-measure (0.957).

Although this is a passive detection method, researchers were able to detect fake/infected accounts or spam tweets that had not been discovered before, providing an advantage over the blacklists technique. The spam detection process requires it to be near to real time to stop spam from spreading on real-time content-sharing platforms such as Twitter and Facebook. Time is necessary for this technique to study the characteristics of an account or build a profile of behaviour.

There are some potential obstacles to the effective implementation of this method; spammers have ways to disguise the features that would raise suspicion of their fraudulent accounts. For example, examining the ‘following ratio’ feature, which has been used with previous notable studies [36] [9], becomes ineffective. Spammers start unfollowing those who do not follow them back; this is how they sustain the following rate as average [105]. Alternatively, spammers overcome the ratio of following to followers by making their ‘fake’ accounts connect with other fake accounts, increasing the follower and following numbers [106]. URL ratio is another indicator that has been evaded by some smart social bots. By monitoring real spam accounts, it has been found

that spamming accounts tweeting content with links pointing to malicious pages are also tweeting genuine tweets at the same average rate to tamp down suspicion aroused due to a high URL ratio.

The HSpam14 [107] dataset contains 14 million tweets that are labelled as spam and ham. The dataset labelling was conducted using several methods (heuristics, clustering and manual). These methods generated approximately 3.3 million spam and 10.7 ham examples. The main features that can be extracted from this dataset are Twitter-based features such as tweet content (text, hashtags, mentions and URLs). The study focused on spam injection on hashtags, as spammers seek to gain a bigger audience by attaching popular hashtags to their content. Studies [107], [108] that rely on only text only and twitter metadata and does extract features from attached URLs (domain WHOIS and webpage content) have the advantage of a larger dataset can create, but in the same time, they could miss essential spam traits in the attached URLs. Compounding the difficulty of detecting anomalies in users’ behaviour and characteristics are social bots, which are becoming smarter over time, adapting, and continuing to improve in simulating genuine users. Spambots have helped to overcome many effective features in a spam detection classifier. For example, by analysing text content that researchers use to cluster the tweets and try to find the spam campaign, spammers now use some machine learning algorithms to produce and paraphrase text to bypass string matching/clustering and blacklists [109].