Enhancing Twitter spam accounts discovery using cross-account pattern mining

Twitter generates the majority of its revenue from advertising. Third parties usually pay to have their products advertised on Twitter through tweets, accounts and trends. However, spammers can use Sybil accounts (fake accounts) to advertise and avoid paying for it. Sybil accounts are highly active on Twitter performing advertising campaigns to serve their clients. They aggressively try to reach a large audience to maximize their influence. These accounts have similar behavior if controlled by the same master. Most of their spam tweets include a shortened URL to trick users into clicking on it. Also, since they share resources with each other, they tend to tweet similar trending topics to attract a larger audience. However, some Sybil accounts do not spam aggressively to avoid being detected, rendering it difficult for traditional spam detectors to be effective in detecting Sybil accounts with low spamming activities. In this paper, we investigate additional criteria - spam patterns, to measure the similarity across accounts on Twitter. We propose an algorithm to define the correlation among accounts by investigating their tweeting patterns and content. Our real data evaluation reveals that, given known some initially labelled spam tweets, this approach can detect additional spam tweets and spam accounts that are correlated to the initially labelled spam tweets, which are not detected by traditional spam detection approaches otherwise.