Anti-Reconnaissance Tools: Detecting Targeted Socialbots

Attackers employ artificial, machine-operated, social network profiles called socialbots to connect to real members of an organization, thus greatly increasing the amount of information the attacker can collect. To connect socialbots, attackers employ several strategies. The authors' approach detects socialbots by intelligently selecting organization member profiles and monitoring their activity. Their study demonstrates their method's efficacy specifically, that when an attacker knows the defense strategy being deployed, the most effective attack is randomly sprayed friend requests, which eventually lead to a low number of connections.