User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

Jurišić, M.; Tomičić, I.; Grd, P.

doi:10.2478/cait-2023-0027

Abstract

The rise of online transactions has led to a corresponding increase in online criminal activities. Account takeover attacks, in particular, are challenging to detect, and novel approaches utilize machine learning to identify compromised accounts. This paper aims to conduct a literature review on account takeover detection and user behavior analysis within the cybersecurity domain. By exploring these areas, the goal is to combat account takeovers and other fraudulent attempts effectively.

References

Kemp, S., D. Buil-Gil, A. Moneva, F. Miro-Llinares, N. Dıaz-Castano. Empty Streets, Busy Internet: A Time-Series Analysis of Cybercrime and Fraud Trends During COVID-19. – Journal of Contemporary Criminal Justice, Vol. 37, 2021, No 4, pp. 480-501.
Search in Google Scholar Back to article
Kawase, R., F. Diana, M. Czeladka, M. Schuler, M. Faust. Internet Fraud: The Case of Account Takeover in Online Marketplace. – In: Proc. of 30th ACM Conference on Hypertext and Social Media, 2019, pp. 181-190.
Search in Google Scholar Back to article
Dekou, R., S. Savo, S. Kufeld, D. Francesca, R. Kawase. Machine Learning Methods for Detecting Fraud in Online Marketplaces. – In: Proc. of CIKM Workshops, 2021.
Search in Google Scholar Back to article
Keele, S., et al. Guidelines for Performing Systematic Literature Reviews in Software Engineering. 2007.
Search in Google Scholar Back to article
Martın, G. A., A. Fernandez-Isabel, I. Martın de Diego, M. Beltran. A Survey for User Behavior Analysis Based on Machine Learning Techniques: Current Models and Applications. – In Applied Intelligence, Vol. 51, 2021, No 8, pp. 6029-6055.
Search in Google Scholar Back to article
Xin, Y., C. Zhao, H. Zhu, M. Gao. A Survey of Malicious Accounts Detection in Large-Scale Online Social Networks. – In: Proc. of 4th IEEE International Conference on Big Data Security on Cloud, Big Data Security, 2018, pp. 155-158.
Search in Google Scholar Back to article
Zangerle, E., G. Specht. “Sorry, I Was Hacked” a Classification of Compromised Twitter Accounts. – In: Proc. of ACM Symposium on Applied Computing, 2014, pp. 587-593.
Search in Google Scholar Back to article
Singh, M., D. Bansal, S. Sofat. Who is Who on Twitter-Spammer, Fake or Compromised Account? A Tool to Reveal True Identity in Real-Time. – Cybernetics and Systems, Vol. 49, 2018, No 1, pp. 1-25.
Search in Google Scholar Back to article
Kaur, R., S. Singh, H. Kumar. TB-CoAuth: Text Based Continuous Authentication for Detecting Compromised Accounts in Social Networks. – Applied Soft Computing Journal, Vol. 97, 2020.
Search in Google Scholar Back to article
Boahen, E., B. Bouya-Moko, F. Qamar, C. Wang. A Deep Learning Approach to Online Social Network Account Compromisation. – In: IEEE Transactions on Computational Social Systems, 2022, pp. 1-13.
Search in Google Scholar Back to article
VanDam, C., F. Masrour, P.-N. Tan, T. Wilson. You Have Been Caute! Early Detection of Compromised Accounts on Social Media. – In: Proc. of 2019 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, ASONAM 2019, pp. 25-32.
Search in Google Scholar Back to article
Karimi, H., C. Vandam, L. Ye, J. Tang. End-to-End Compromised Account Detection. – In: Proc. of 2018 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, ASONAM, 2018, pp. 314-321.
Search in Google Scholar Back to article
Hooi, B., K. Shin, H. A. Song, A. Beutel, N. Shah, C. Faloutsos. Graph-Based Fraud Detection in the Face of Camouflage. – ACM Transactions on Knowledge Discovery from Data (TKDD), Vol. 11, 2017, No 4, pp. 1-26.
Search in Google Scholar Back to article
Egele, M., G. Stringhini, C. Kruegel, G. Vigna. Towards Detecting Compromised Accounts on Social Networks. – IEEE Transactions on Dependable and Secure Computing, Vol. 14, 2015, No 4, pp. 447-460.
Search in Google Scholar Back to article
Singh, M., B. Mehtre, S. Sangeetha. Insider Threat Detection Based on User Behaviour Analysis. – In: Communications in Computer and Information Science. Vol. 1241. 2020, CCIS, pp. 559-574.
Search in Google Scholar Back to article
Glasser, J., B. Lindauer. Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data. – In: Proc. of 2013 IEEE Security and Privacy Workshops, 2013, pp. 98-104. DOI:10.1109/SPW.2013.37.
Search in Google Scholar Back to article
Singh, M., B. Mehtre, S. Sangeetha. User Behavior Based Insider Threat Detection Using a Multi Fuzzy Classifier. – Multimedia Tools and Applications, Vol. 81, 2022, No 16, pp. 22953-22983.
Search in Google Scholar Back to article
Singh, M., B. Mehtre, S. Sangeetha. User Behaviour Based Insider Threat Detection in Critical Infrastructures.– In: Proc. of International Conference on Secure Cyber Computing and Communications (ICSCCC’2021), 2021, pp. 489-494.
Search in Google Scholar Back to article
Alshehri, A., N. Khan, A. Alowayr, M. Alghamdi. Cyberattack Detection Framework Using Machine Learning and User Behavior Analytics. – Computer Systems Science and Engineering, Vol. 44, 2023, No 2, pp. 1679-1689.
Search in Google Scholar Back to article
Wu, H.-C., S.-H. Huang. User Behavior Analysis in Masquerade Detection Using Principal Component Analysis. – In: Proc. of 8th International Conference on Intelligent Systems Design and Applications, ISDA 2008, Vol. 1, pp. 201-206.
Search in Google Scholar Back to article
Boahen, E., W. Changda, B.-M. Brunel Elvire. Detection of Compromised Online Social Network Account with an Enhanced Knn. – In: Applied Artificial Intelligence. 2020, pp. 777-791.
Search in Google Scholar Back to article
Eren, M., J. Moore, B. Alexandro. Multi-Dimensional Anomalous Entity Detection via Poisson Tensor Factorization. – In: Proc. of 2020 IEEE International Conference on Intelligence and Security Informatics (ISI’2020), 2020.
Search in Google Scholar Back to article
Xie, R., L. Wang, X. Tao. A Secure VM Allocation Strategy Based on Tenant Behavior Analysis and Anomaly Identification. – In: Proc. of IEEE Military Communications Conference MILCOM, Vol. 2021-November, pp. 721-726.
Search in Google Scholar Back to article
Zhang, S., F. Jiang, M. Qin. Application of System Calls in Abnormal User Behavioral Detection in Social Networks. – In: Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 11434. 2019, LNCS, pp. 89-101.
Search in Google Scholar Back to article
Tao, J., H. Wang, T. Xiong. Selective Graph Attention Networks for Account Takeover Detection. – In: Proc. of IEEE International Conference on Data Mining Workshops, ICDMW, Vol. 2018-November, pp. 49-54.
Search in Google Scholar Back to article
Boahen, E., S. Frimpong, M. Ujakpa, R. Sosu, O. Larbi-Siaw, E. Owusu, J. Appati, E. Acheampong. A Deep Multi-Architectural Approach for Online Social Network Intrusion Detection System. – In: Proc. of 2022 IEEE World Conference on Applied Intelligence and Computing (AIC’2022), 2022, pp. 919-924.
Search in Google Scholar Back to article
McCormick, A., W. Eberle. Discovering Fraud in Online Classified Ads. – In: Proc. of 26th International Florida Artificial Intelligence Research Society Conference (FLAIRS’2013), 2013, pp. 450-455.
Search in Google Scholar Back to article
Singh, K., P. Singh, K. Kumar. User Behavior Analytics-Based Classification of Application Layer HTTP-GET Flood Attacks. – Journal of Network and Computer Applications, Vol. 112, 2018, pp. 97-114.
Search in Google Scholar Back to article
Jawed, H., Z. Ziad, M. Khan, M. Asrar. Anomaly Detection through Keystroke and Tap Dynamics Implemented via Machine Learning Algorithms. – Turkish Journal of Electrical Engineering and Computer Sciences, Vol. 26, 2018, No 4, pp. 1698-1709.
Search in Google Scholar Back to article
Ranjan, R., S. Kumar. User Behaviour Analysis Using Data Analytics and Machine Learning to Predict Malicious User Versus Legitimate User. – High-Confidence Computing, Vol. 2, 2022, No 1.
Search in Google Scholar Back to article
Somasundaram, A., S. Reddy. Parallel and Incremental Credit Card Fraud Detection Model to Handle Concept Drift and Data Imbalance. – Neural Computing and Applications, Vol. 31, 2019, pp. 3-14.
Search in Google Scholar Back to article
Jiang, W., Y. Tian, W. Liu, W. Liu. An Insider Threat Detection Method Based on User Behavior Analysis. – In: IFIP Advances in Information and Communication Technology. Vol. 538. 2018, pp. 421-429.
Search in Google Scholar Back to article
Kasa, N., A. Dahbura, C. Ravoori, S. Adams. Improving Credit Card Fraud Detection by Profiling and Clustering Accounts. – In: Proc. of 2019 Systems and Information Engineering Design Symposium (SIEDS’19), IEEE, 2019, pp. 1-6.
Search in Google Scholar Back to article
Shao, P., J. Lu, R. Wong, W. Yang. A Transparent Learning Approach for Attack Prediction Based on User Behavior Analysis. – In: Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 9977. LNCS, 2016, pp. 159-172.
Search in Google Scholar Back to article
Alimolaei, S. An Intelligent System for User Behavior Detection in Internet Banking. – In: Proc. of 2015 4th Iranian Joint Congress on Fuzzy and Intelligent Systems (CFIS’15), IEEE, 2015, pp. 1-5.
Search in Google Scholar Back to article
Kang, A., J. Woo, J. Park, H. Kim. Online Game Bot Detection Based on Party-Play Log Analysis. – Computers and Mathematics with Applications, Vol. 65, 2013, No 9, pp. 1384-1395.
Search in Google Scholar Back to article
Iliou, C., T. Kostoulas, T. Tsikrika, V. Katos, S. Vrochidis, Y. Kompatsiaris. Towards a Framework for Detecting Advanced Web Bots. – In: Proc. of 14th International Conference on Availability, Reliability and Security, 2019, pp. 1-10.
Search in Google Scholar Back to article
Nguyen, P., R. Henkin, S. Chen, N. Andrienko, G. Andrienko, O. Thonnard, C. Turkay. VASABI: Hierarchical User Profiles for Interactive Visual User Behaviour Analytics. – IEEE Transactions on Visualization and Computer Graphics, Vol. 26, 2020, No 1, pp. 77-86.
Search in Google Scholar Back to article
Gunavathi, C., R. Swarna Priya, S. Aarthy. Big Data Analysis for Anomaly Detection in Telecommunication Using Clustering Techniques. – In: Advances in Intelligent Systems and Computing. Vol. 862. 2019, pp. 111-121.
Search in Google Scholar Back to article
Gao, M., B. Li, C. Wang, L. Ma, J. Xu. User Behavior Clustering Scheme with Automatic Tagging over Encrypted Data. – IEEE Access, Vol. 7, 2019, pp. 170648-170657.
Search in Google Scholar Back to article
Wang, Y., Z. Zhang, L. Chi. User Account Risk Identification Model for Web Applications. – In: ACM International Conference Proceeding Series, Vol. Part F148262, 2019, pp. 30-34.
Search in Google Scholar Back to article
Raza, S., S. Haider. Suspicious Activity Reporting Using Dynamic Bayesian Networks. – Procedia Computer Science, Vol. 3, 2011, pp. 987-991.
Search in Google Scholar Back to article
Shen, H., F. Ma, X. Zhang, L. Zong, X. Liu, W. Liang. Discovering Social Spammers from Multiple Views. – Neurocomputing, Vol. 225, 2017, pp. 49-57.
Search in Google Scholar Back to article
Luzbashev, A., A. Filippov, K. Kogos. Continuous User Authentication in Mobile Phone Browser Based on Gesture Characteristics. – In: Proc. of 2nd World Conference on Smart Trends in Systems, Security and Sustainability (WorldS4’2018), 2019, pp. 313-316.
Search in Google Scholar Back to article
Zhang, X., Y. Han, W. Xu, Q. Wang. HOBA: A Novel Feature Engineering Methodology for Credit Card Fraud Detection with a Deep Learning Architecture. – Information Sciences, Vol. 557, 2021, pp. 302-316.
Search in Google Scholar Back to article
Li, Z., H. Zhang, M. Masum, H. Shahriar, H. Haddad. Cyber Fraud Prediction with Supervised Machine Learning Techniques. – In: Proc. of 2020 ACM Southeast Conference (ACMSE’2020), 2020, pp. 176-180.
Search in Google Scholar Back to article
Dia, D., G. Kahn, F. Labernia, Y. Loiseau, O. Raynaud. A Closed Sets Based Learning Classifier for Implicit Authentication in Web Browsing. – Discrete Applied Mathematics, Vol. 273, 2020, pp. 65-80.
Search in Google Scholar Back to article
Yang, H. Research on Classification Algorithm for Civil Aviation Internal Network Intrusion Detection Based on Machine Learning. – In: Proc. of 2020 IEEE 2nd International Conference on Civil Aviation Safety and Information Technology (ICCASIT’2020), 2020, pp. 1-4.
Search in Google Scholar Back to article
ur Rahman, A., S. Dash, A. Luhach, N. Chilamkurti, S. Baek, Y. Nam. A Neuro-Fuzzy Approach for User Behaviour Classification and Prediction. – Journal of Cloud Computing, Vol. 8, 2019, No 1.
Search in Google Scholar Back to article
Nocera, F., S. Demilito, P. Ladisa, M. Mongiello, A. Shah, J. Ahmad, E. di Sciascio. A User Behavior Analytics (UBA)-Based Solution Using LSTM Neural Network to Mitigate DDoS Attack in Fog and Cloud Environment. – In: Proc. of 2022 2nd International Conference of Smart Systems and Emerging Technologies (SMARTTECH’22), 2022, pp. 74-79.
Search in Google Scholar Back to article
Sharma, B., P. Pokharel, B. Joshi. User Behavior Analytics for Anomaly Detection Using LSTM Autoencoder-Insider Threat Detection. – In: ACM International Conference Proceeding Series. 2020.
Search in Google Scholar Back to article
Ganfure, G., C.-F. Wu, Y.-H. Chang, W.-K. Shih. DeepGuard: Deep Generative User-Behavior Analytics for Ransomware Detection. – In: Proc. of 2020 IEEE International Conference on Intelligence and Security Informatics (ISI’2020), 2020.
Search in Google Scholar Back to article
Budiarto, R., A. Alqarni, M. Alzahrani, M. Pasha, M. Firdhous, D. Stiawan. User Behavior Traffic Analysis Using a Simplified Memory-Prediction Framework. – Computers, Materials and Continua, Vol. 70, 2022, No 2, pp. 2679-2698.
Search in Google Scholar Back to article
Hilas, C. S., P. A. Mastorocostas. An Application of Supervised and Unsupervised Learning Approaches to Telecommunications Fraud Detection. – Knowledge-Based Systems, Vol. 21, 2008, No 7, pp. 721-726.
Search in Google Scholar Back to article
Wu, Z., L. Tian, Y. Zhang, Z. Wang. Web User Trust Evaluation: A Novel Approach Using Fuzzy Petri Net and Behavior Analysis. – Symmetry, Vol. 13, 2021, No 8.
Search in Google Scholar Back to article
Lian, J. Implementation of Computer Network User Behavior Forensic Analysis System Based on Speech Data System Log. – International Journal of Speech Technology, Vol. 23, 2020, No 3, pp. 559-567.
Search in Google Scholar Back to article
Ai, J., J. Wang, S. Chen, H. Guan, C. Liang, L. Chen. Intelligent Analysis of Database Users Based on a Dynamic Model. – In: Proc. of 2017 2nd International Conference on Machinery, Electronics and Control Simulation (MECS’2017), Atlantis Press, 2016, pp. 146-150.
Search in Google Scholar Back to article
Pv, S., S. Bhanu. UbCadet: Detection of Compromised Accounts in Twitter Based on User Behavioural Profiling. – Multimedia Tools and Applications, Vol. 79, 2020, No 27-28, pp. 19349-19385.
Search in Google Scholar Back to article
Ussath, M., D. Jaeger, F. Cheng, C. Meinel. Identifying Suspicious User Behavior with Neural Networks. – In: Proc. of 4th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud’2017) and 3rd IEEE International Conference of Scalable and Smart Cloud (SSC’2017), 2017, pp. 255-263.
Search in Google Scholar Back to article
Halawa, H., M. Ripeanu, K. Beznosov, B. Coskun, M. Liu. An Early Warning System for Suspicious Accounts. – In: Proc. of 10th ACM Workshop on Artificial Intelligence and Security (AISec’2017), Co-Located with CCS, 2017, pp. 51-52.
Search in Google Scholar Back to article
Wang, Y., L. Wang. Bot-Like Behavior Detection in Online Banking. – In: ACM International Conference Proceeding Series. 2019, pp. 140-144.
Search in Google Scholar Back to article
Oh, J., Z. Borbora, J. Srivastava. Automatic Detection of Compromised Accounts in MMORPGs. – In: Proc. of 2012 ASE International Conference on Social Informatics, Social Informatics, 2012, pp. 222-227.
Search in Google Scholar Back to article
Kim, H., S. Yang, H. Kim. Crime Scene Re-Investigation: A Postmortem Analysis of Game Account Stealers’ Behaviors. – In: Proc. of Annual Workshop on Network and Systems Support for Games, 2017, pp. 1-6.
Search in Google Scholar Back to article
Halawa, H., K. Beznosov, B. Coskun, M. Liu, M. Ripeanu. Forecasting Suspicious Account Activity at Large-Scale Online Service Providers. – In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 11598. 2019, LNCS, pp. 569-587.
Search in Google Scholar Back to article
Hu, Q., B. Tang, D. Lin. Anomalous User Activity Detection in Enterprise Multi-Source Logs. – In: IEEE International Conference on Data Mining Workshops, ICDMW, Vol. 2017-November, 2017, pp. 797-803.
Search in Google Scholar Back to article
Tang, B., Q. Hu, D. Lin. Reducing False Positives of User-to-Entity First-Access Alerts for User Behavior Analytics. – In: Proc. of IEEE International Conference on Data Mining Workshops, ICDMW, Vol. 2017-November, 2017, pp. 804-811.
Search in Google Scholar Back to article
Matsushita, H., R. Uda. Detection of Change of Users in SNS by Two Dimensional CNN. – In: Proc. of 2020 IEEE 44th Annual Computers, Software, and Applications Conference, (COMPSAC’2020), 2020, pp. 839-844.
Search in Google Scholar Back to article
Bohacik, J., A. Fuchs, M. Benedikovic. Detecting Compromised Accounts on the Pokec Online Social Network. – In: Proc. of 2017 International Conference on Information and Digital Technologies (IDT’17), IEEE, 2017, pp. 56-60.
Search in Google Scholar Back to article
Zhang, C., Y. Hu, X. Zhu, Z. Guo, J. Huang. Anomaly Detection for User Behavior in Wireless Network Based on Cross Entropy. – In: Proc. of 2015 IEEE 12th International Conference on Ubiquitous Intelligence and Computing, 2016, pp. 1258-1263.
Search in Google Scholar Back to article
Lee, S.-C., C. Faloutsos, D.-K. Chae, S.-W. Kim. Fraud Detection in Comparison-Shopping Services: Patterns and Anomalies in User Click Behaviors. – IEICE Transactions on Information and Systems, Vol. E100D, 2017, No 10, pp. 2659-2663.
Search in Google Scholar Back to article
Darwish, S. A Bio-Inspired Credit Card Fraud Detection Model Based on User Behavior Analysis Suitable for Business Management in Electronic Banking. – Journal of Ambient Intelligence and Humanized Computing, Vol. 11, 2020, No 11, pp. 4873-4887.
Search in Google Scholar Back to article
Dasu, L. S., M. Dhamija, G. Dishitha, A. Vivekanandan, V. Sarasvathi. Defending Against Identity Threats Using Risk-Based Authentication. – Cybernetics and Information Technologies, Vol. 23, 2023, No 2, pp. 105-123.
Search in Google Scholar Back to article
Alhenawi, E. A., H. Alazzam, R. Al-Sayyed, O. AbuAlghanam, O. Adwan. Hybrid Feature Selection Method for Intrusion Detection Systems Based on an Improved Intelligent Water Drop Algorithm. – Cybernetics and Information Technologies, Vol. 22, 2022, No 4, pp. 73-90.
Search in Google Scholar Back to article
Lazarov, A. D. Mathematical Modelling of Malware Intrusion in Computer Networks. – Cybernetics and Information Technologies, Vol. 22, 2022, No 3, pp. 29-47.
Search in Google Scholar Back to article
Imam, N. H., V. G. Vassilakis, D. Kolovos. An Empirical Analysis of Health-Related Campaigns on Twitter Arabic Hashtags. – In: Proc. of 7th International Conference on Data Science and Machine Learning Applications (CDMA’2022), 1 March 2022, pp. 29-41.
Search in Google Scholar Back to article
Grzenda, M., S. Kaźmierczak, M. Luckner, G. Borowik, J. Mańdziuk. Evaluation of Machine Learning Methods for Impostor Detection in Web Applications. – Expert Systems with Applications, Vol. 7, Juni 2023, 120736.
Search in Google Scholar Back to article
Bharne, S., P. Bhaladhare. An Enhanced Scammer Detection Model for Online Social Network Frauds Using Machine Learning – International Journal on Recent and Innovation Trends in Computing and Communication, Vol. 11, 2023, pp. 239-249,
Search in Google Scholar Back to article
Eren, M. E., J. S. Moore, E. Skau, E. Moore, M. Bhattarai, G. Chennupati, B. S. Alexandrov. General-Purpose Unsupervised Cyber Anomaly Detection via Non-Negative Tensor Factorization. – Digital Threats: Research and Practice, Vol. 4, 7 Mar 2023, No 1, pp. 1-28.
Search in Google Scholar Back to article
Singh, M., B. M. Mehtre, S. Sangeetha, V. Govindaraju. User Behaviour Based Insider Threat Detection Using a Hybrid Learning Approach. – Journal of Ambient Intelligence and Humanized Computing, Vol. 14, April 2023, No 4, pp. 4573-4593.
Search in Google Scholar Back to article

User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

Abstract

Paradigm

My account