Open Access CS-1-SVM: Improved One-class SVM for Detecting API Abuse on Open Network Service

Transcription

1 Send Orders for Reprints to The Open Automation and Contro Systems Journa, 2015, 7, Open Access CS-1-SVM: Improved One-cass SVM for Detecting API Abuse on Open Network Service Chen Hai-ting * Coege of Network Communication, Zhejiang Yuexiu University of Foreign Languages, Shaoxin, China Abstract: Open network service is threatened by API abusers such as spammers, phishes, compromised users, etc., because of their open API for any user and third-party deveopers. In order to preserve the service resource and security, we proposed an approach caed CS-1-SVM based on cosine simiarity and 1-SVM to detect anomaous accounts who abused API in open network service. Two of the key processes of the method are account modeing and cassifier soving. In account modeing, we vectorized every sampe user by extracting the dynamic features and cacuating the cosine simiarity between static features. In cassifier soving, we improved 1-SVM in reguarization parameter optimization efficiency with cosine simiarity too. Based on the proposed method, we deveoped an experiment to demonstrate that CS-1-SVM has the abiity to detect both maicious and compromised account and simpify the process of parameter optimization without reducing the accuracy of 1-SVM. Keywords: API Abusing, Cosine Simiarity, One-cass SVM, Open Network Service. 1. INTRODUCTION Compared to traditiona network service, open network service (ONS), such as socia network service, coud storage service or eectronic commerce service, is facing more serious security threats. In the traditiona environment where a accounts are under strict contro, a users are ony imited to access the service via their own identities and carry out their business in their assigned range. Therefore abusing is under contro and happens rarey in traditiona network service. Whie in the open environment, a accounts receive fewer restrictions on network access and API usage. In this condition, one might seectivey trusts those third-party appications that rey on open API provided by ONS. Thus, maicious behaviors (spamming and phishing) become more frequent and arge-scae, due to the programmabiity of not ony attack data but aso attack actions. Besides, attackers can easiy access users private data and make unwanted operation by vunerabiities of authorization protoco (such as CSRF or phishing on OAuth) or the open API sef [1, 2]. Those maicious or compromised accounts can then be used for a variety of iega activities, such as sending phishing or spamming messages to other accounts on contact ists. Previous work has shown that abusing API for spam, phishing, and maware are rea threats on open network service [3]. What s more, maicious and compromised accounts on ONS are aready being sod onine in underground markets [4, 5]. To sove the growing probem, researchers have proposed different detection approaches. Earier studies focus on anaysis of static information (e.g. text, URL and IP) *Address correspondence to this author at the Coege of Network Communication, Zhejiang Yuexiu University of Foreign Languages, Shaoxin, China; Te: ; E-mai: chenht80@163.com ike traditiona detection on E-mai spam [3, 6-10], which can be easiy impemented by the mature technoogy on E-mai spam detection. But nowadays, toos and techniques used by attackers are more compicated. Sometimes attack behaviors are not fuy refected in the pubished content, but in getting permission to privacy data or other posted actions through open API. For the new scenario, behavior modeing is proposed. M. Egee et a. provide an idea to extract behavior mode features associated with the actions of pubishing content and cassify norma or compromised account by supervised cassification methods [11]. Unfortunatey, supervised machine earning requires a arge number of abeed sampes so that it needs a ot of pre-processing work and cannot catch the 0-day threats. Besides, they fai to detect a maicious account. G. Wang et a. identify the anomaous account by taking advantage of the cickstream modes [12]. They caim that they have deveoped a detection system on server-side, which can group simiar user cickstreams into behaviora custers through distances between cickstream sequences and then cassified a new cick sequence into norma or Sybi. However, they cannot reay reaize unsupervised custering because of the use of so-caed seed abeed manuay. Besides, the server-side detection does not have patform generaity. In this paper, we presented a new approach caed CS-1- SVM (One-cass Support Vector Machine Improved with Cosine Simiarity) to detect open API abuse incuding not ony compromised but aso maicious accounts based on cosine simiarity [13] and 1-SVM (one-cass SVM, an unsupervised Support Vector Machine [14]). It was worth noting that we aso integrated a vectorization mode in the method, which can combine both dynamic and static user features. With this mode, we can accuratey describe the user's eve of changes, which can refect the eve of abnormaity. Our approach offers four outstanding advantages. First, it does / Bentham Open

2 1294 The Open Automation and Contro Systems Journa, 2015, Voume 7 Chen Hai-ting not depend on open network service provider s patform. Second, rea unsupervised machine earning simpifies the mode training in compared with taking cumbersome task of abeing sampes. Third, it can detect both maicious and compromised accounts. The ast but not the east, individua behaviora features and overa distribution of sampes are combined to improve the accuracy of cassification with twice use of cosine simiarity. 2. ACCOUNT MODELING Like a automatic detection methods based on machine earning, we need to abstract the users states and behaviors into a set of vectors first. This process is caed account modeing, which has a very significant effect on the detection resuts. A strong account modeing has to capture the rea ways in which a user empoyed his ONS account as competey as possibe. Otherwise, a weak account modeing might ead to incorrect cassification (e.g. identify a egitimate user as anomaous, and vice versa). To buid a patform-independent system, we adopted the pubic stream on ONS from users posting instead of back-end statistics. Once obtained the user s stream, we extracted a set of feature vaues caed static features from each posted message as static features vector (SFV). And then, a vector caed dynamic features vector (DFV) that can describe important changes of static features with cosine simiarity and abstract other features associated with the time sequence was computed. The fina account mode can be described as DFV, a Hibert space vector used to represent a user Extracting Static Features In order to abstract the characteristics that can provide avaiabe reference vaues for dynamic features, a proper static features group must meet the foowing requirements: Vectorizabe: Vectorizing users static features is the basis of not ony dynamic feature abstracting but aso CS-1- SVM mode. Vectorizabe means that those used features must be numeric and directiona. If a feature such as image content cannot be described as a number (numeric), it is not easy to refect the feature to Hibert space. Besides, if you cannot distinguish between each feature in different dimensions (directiona), the features number group wi not form a vector. For exampe, the number of sentences and the number of punctuation, in most conditions, represent the same dimension as the content structure. They cannot form a group of feature vectors. Intent-reated: Intuitivey, a user abusing open API wi achieve a specific purpose in a great probabiity. Therefore, an appropriate static feature is required to describe the user's purpose. When a user purposes are abstracted into numbers, we can catch the purpose non-manuay. For instance, in a socia network, the intent of spreading, which the spam accounts reease information with, can be measured by the counts of interactions counts, forwarding counts etc.). Changeabe: An unchangeabe feature wi make the mode insensitive to users action, because dynamic features vector depends on the fuctuations in static features vaues, and the more accuratey the dynamic features match user s action sequence, the better CS-1-SVM works. Those static features without changing trend are meaningess for the mode presented in this paper. Take user name or user password as an exampe, it changes rarey, so a vector composed by it makes no sense. We denote user s SFV as S. Here is the recommended S using one pubishing in the conventiona open network service. Socia network: Take anguage as u (u {1,1, 2}, when 1 means oca anguage, 2 means Engish and -1 means other anguages), incuding inks number as n (n N and n number as n a (n a N and n a 0), pubished time as t (t N and 0 t < 24). In socia network service, S = (u, n, n a, t). Coud storage: Take anguage of fie name as u ( u {1,1, 2}, when 1 means oca anguage, 2 means Engish and -1 means other anguages), fie type as f ( f {1,1}, when 1 means norma fie type and -1 means executabe binary fie type), shared or not as s ( s {1,1} ), upoading time as t (t N and 0 t < 24). In coud storage service, S = (u, f, s, t). Eectronic commerce: Take order numbers once as n o (n o N and n o > 0), simiar or not for order comments as s ( s {1,1} ), order paced time as t (t N and 0 t < 24). In eectronic commerce service, S = (n o, s, t). 2.2 Extracting Dynamic Features If we have extracted avaiabe static features of one account into a series of muti-dimensiona vectors, we can construct the dynamic features vector that can accuratey refect the changing eve of this account s actions by cosine simiarity and other statistica methods. Considering the user s inear actions, we described dynamic features on time sequence Cosine Simiarity of static Features The most important dimension in DFV is the change eve of user s historica actions through which anomaous sudden changes can be found. So we need a quantitative metric to describe the change eve of SFVs, which is caed Change Rate Index (CRI) in this paper. An effective and easy way to compute CRI is the variance of cosine simiarity. Cosine simiarity is a measurement of simiarity between two vectors of an inner product space that measures the cosine of the ange between them. Comparing two SFVs by cosine simiarity can capture the change eve between user s two actions accuratey. And then take the variance of these cosine simiarity vaues as CRI. Considering the user s inear actions and imited computing resources, we do not need to cacuate the cosine simiarity between each pair of static features, but between a basic SFV and other one. That means we need choose a SFV (e.g. first SFV) for basic vector, and compute cosine simiarity for other SFV with basic one in accordance with the time

3 CS-1-SVM: Improved One-cass SVM for The Open Automation and Contro Systems Journa, 2015, Voume sequence. In this process, we need to define a constant g (- 1<g<1) as sudden change threshod. If the cosine simiarity is beow g, we say this situation coud be a sudden change and take the new SFV as the basic one with which the rest SFV wi be compared. This is a trick that can make simiarity vaues more discrete to stand out fuctuations of sudden change. For exampe, we can take the first SFV as initia basic SFV, and compute cosine simiarity with other SFV in according with time sequence. When the cosine simiarity beow g, we know that the user make a sudden change and change the basic SFV to the new one. If the SFV after is simiar, this method wi not make the sum of simiarity vaue become too ow to effectivey distinguish. If the SFV after is become norma, this method can stand out the sudden change SFV because the cosine simiarity beow g are compute twice. Fig. (1) shows the differences between changeabe and unchangeabe basic SFV on cosine simiarity vaue distributions and the vaue of g is The part of SFV matric M is Fig. (1). Different distributions between changeabe and unchangeabe basic SFV. We can see from Fig. (1) obviousy that an norma SFV (M [4] ) produced a significant fuctuation and an abnorma SFV (M [8] ) was not sensitive to sudden changes in the method of unchangeabe basic SFV. Conversey, the changeabe basic SFV performed we on trade-off between sudden change and norma change. If we define L as a user s CRI, function D(x i ) as variance fuction, n as number of user s SFV, S i (i N and 0 i n-1) as the ith SFV according to the order of time, S b as the basic SFV and sim i (i N and 0 i n-1) as cosine simiarity between S i and S b, then Equation (1) shows how to compute the user s CRI. L = D(sim i ) = 1 n1 2 1 sim i ( n 1 n Other Dynamic Features Besides CRI, some other dimensions are needed to form the DFV. These dimensions must meet the requirements of SFV-reated and statisticay significant to stand out the suspect features of user s actions sequence. That means we must form a vector, which can capture the action features of anomaies or outiers. Content repeatabiity (R) and action frequency (T) are two dimensions recommended on most ONS for commonaity. Content repeatabiity means that to compare consecutive posting (text on socia network, md5 of fie on coud storage or order comments on eectronic commerce) different or not. Action frequency means to get the interva time of consecutive posting because an anomaous account may submit with open API frequenty. In order to reduce the impact of ong interva time, we took those interva times more than one day as one day (86400 seconds) for the sake of simpicity. If we denote a user s DFV as D, posting number as n, content repeatabiity of consecutive posting as r i (r i {1,1}, i N and 1 i n-1), interva time of consecutive posting as t i (t i (0,86400], i N and 1 i n-1), the function to take the first y minimum numbers in x i as fmin(x i, y), the average function of x i as E(x i ), then we can get Equation (2) where the vaue of L has been computed in Equation (1). D = (L, R,T ) (2) where. R = E(r i ) = 1 n1 r i n 1 T = E( fmin(t i,cei((n 1) c))), 0 < c 1 The vector D is the fina mode for one user; cei means rounding up and c is a constant to contro the number range of t i. For exampe, if n is 100, c is 0.1, the vaue of T can be cacuated as foowing steps: 1) chose the first 10 (cei(990.1)=10) minimum numbers in t i ; 2) take the average of this 10 numbers. 3. DESCRIPTION OF CS-1-SVM = 1 S bis n1 i ( n 1 S b i S 1 ) 2 ( i n 1 initia condition. S b := S 0 and then. sim i < g S b := S i sim i ) 2 When a user is abstracted into a specific vector D, cassification methods on vectors in Hibert space can be used to detect the abnorma account. Because of D can describe how a user use a network service API, an appropriate cassification method wi produce an exceent resut to find out those API abuse accounts. In a common ONS system, most of vectors D are norma and difficut to be abeed if we get sampes through n1 n1 S bis i S b i S i ) 2 (1)

4 1296 The Open Automation and Contro Systems Journa, 2015, Voume 7 Chen Hai-ting simpe random samping (ike web crawing). So here, the data do not contain any abeing information and ony a sma fraction of the data is abnorma, but the outiers exhibit a significanty different behavior than the norma records. Theoreticay, the 1-SVM coud aso be empoyed in an unsupervised anomay detection setup, where no prior training is needed [15]. That is the reason we choose 1-SVM as the basic agorithm in this paper. Based on this, we made some improvements on the estimate of v vaue with the cosine simiarity and overa dynamic features to propose an improved agorithm caed CS-1-SVM Introduction of 1-SVM In contrast to traditiona SVMs, 1-SVM attempts to earn a decision boundary that achieves the maximum separation between the points and the origin [16]. It is predicated on the assumption that the origin in the transformed space beongs to outiers and then separates most of the sampes from the origin by a hyperpane with maximum margin which is as far away from the origin as possibe. Suppose that {x i } N is the target dataset, and noninear transformation function is used to map the target dataset from N into a higher dimensiona Hibert feature space. To determine the hyperpane, we need to deduce its norma vector w and bias term by soving the foowing optimization probem: 1 min w,, 2 w i v s.t. w,(x i ) i, i 0 Here, i caed sack variabes are introduced to dea with the outying sampes. The parameter (0,1] is a specia parameter for 1-SVM. It represents an upper bound on the fraction of outiers and a ower bound on the number of support vectors. Varying contros the trade-off between and. An effective vauation method to v wi be proposed in next section. Equation (3) caed prima probem can be soved by its Lagrange dua probem and avoid cacuating the inner product of non-inear mapping function by defining a kerne function K(x i, x j )=(x i ), (x j that fufis Mercer s conditions. The dua probem is ike Equation (4): 1 min 2 i, j=1 i j K(x i, x j ) s. t. 0 i 1 v, i = 1 where are the Lagrange mutipiers. After soving the dua probem, the decision function for any test vector x t is given by Equation (5): f (x) = sign i K(x i, x t ) (3) (4) (5) 3.2. Estimation of v by Cosine Simiarity In section 3.1 we notice that the parameter is an upper bound on the fraction of outiers and a ower bound on the fraction of support vectors. In most practice, the vaue of is decided by artificia ways depending on the experience to features of training sampes. Unfortunatey, this approach is difficut to impement for ONS because of the users uncertainty and diversity. Nevertheess, we can sti estimate the vaue of v by the simiarity reations of sampe users DFVs. Before setting forth the methods of estimating, we show two properties of ONS: Proposition 1. Suppose A={ D } is a sampe set of users DFVs from ONS, M(A) (0,1) is the metric function for overa simiarity of DFVs, and O (0,1) is the ratio of anomaous users among a sampes, then O changes aong with M(A). In other words, if more users have high simiarity of DFVs in the case of the appropriate features to be extracted, then there is a high probabiity that more API abusing attacks happened in this ONS. Because those attackers are bound to post the simiar action, in order to achieve a cear purpose. This proposition has been iustrated effectivey by experiments in M. Egee s work [11]. Proposition 2. Suppose E(A) (0,1] is the average of cosine simiarity of sampes DFVs between each other, constant μ (0,1) is the threshod near 1 to determine the extremey simiar vectors, then O E(A)/ μ. To prove proposition 2, we introduced as the average of cosine simiarity of DFVs whose cosine simiarity with any other DFV is ower than μ. Then we supposed that m is the number of DFVs in high simiar custer, p is the average of cosine simiarity of them. Finay, the deduction of proposition 2 was ike Equation (6): E(A) = p m + 1 m E(A) = p m + m E(A) = ( p ) m + E(A) p = m p μ, m O, 0 E(A) μ O Since v is an estimated vaue and represent the upper bound of outiers rate, we can cacuate a reference vaue O as v according to proposition 2 and make adjustments for vaue of μ to fine-tune the process. This can significanty reduce the amount of computation to find out v. Furthermore, the singe user s behaviora features and overa distribution of sampes were effectivey inked together Objective of CS-1-SVM Foowing the above propositions, we can generaize the CS-1-SVM method to the probem of API abuse detection in (6)

5 CS-1-SVM: Improved One-cass SVM for The Open Automation and Contro Systems Journa, 2015, Voume ONS. The objective of the proposed CS-1-SVM is stated in Equation (7). Here, the reguarization parameter v was dropped from the minimization objective. Instead, we cacuated the average of cosine simiarities between any two users DFVs and divided it by μ to represent the upper bound on the fraction of outiers and a ower bound on the fraction of support vectors. a 2-dimensiona ce for struct incuding 1500 rows by Matab. Each row was a ce incuding a posted information of one user, and each eement in row ce was a struct that represents one posting. The data in struct ooks ike Fig. (2). 1 min w,, 2 w 2 + μ i s.t. w,(x i ) i, i 0 The threshod μ is an adjustabe vaue very cose to 1. Those users, whose cosine simiarity with each other higher than μ, were considered as suspect group. After Lagrange mutipiers and kerne function introduced, the dua objective of CS-1-SVM can be summarized as Equation (8): 1 min 2 i, j=1 i j K(x i, x j ) s. t. 0 i μ, i = 1 It can be seen that it is ony a minor modification to the objective of the origina 1-SVM in Equation (3) and (4). Hence, it can be soved easiy with the origina methods or toos ike SMO [17], LibSVM [18] and so on. 4. EXPERIMENTS In order to evauate the effectiveness of the proposed detecting API abusing method, we compared our CS-1-SVM with the traditiona 1-SVM. In our experiments, the kerne of the two methods was a Gaussian kerne ike Equation (9), where > 0 is kerne radius. The optimum vaue for the parameter was determined by cross vaidation. K(x i, x j ) = e x i x j Another important comparison among content anaysis method ike those proposed by reference [6-10], COMPA [11] and the proposed CS-1-SVM shows different appication efficiency Sampe Set We randomy samped 1500 users posted data from Weibo.com (the predominant socia network service in China which is akin to a hybrid of Twitter and Facebook) by crawing with the open API that Weibo provides. The dataset contained 26 anomaous accounts incuding 10 spammers, 10 phishers and 6 compromised users (which were abeed by us to compare with experiment resuts) and a historica posted information of these 1500 users before 12:40:00 PM, 14 November In addition, we pre-processed these data to eiminate dirty data such as system error messages, empty response, invaid URL and so on. Because of the imitations of provided open API, the origina data was JSON format. We reorganized the data into (7) (8) (9) Fig. (2). Data in one posting. For the sake of simpicity and reiabiity, we randomy drew 5 sampes in both anomaous and egitimate sampes as 10 test data each time. Every method was tested 20 times. The goa of our experiment was to check whether a test sampe was miscassified and the resut for a tests was averaged as the comparison basis Account Modeing As shown in Fig. (2), the struct data was very easy to be extracted because of the key-vaue pair structure. Considering the probabiity of change anguage was minima in Weibo, we abandoned the anguage feature. Finay, We chose the foowing keys to form SFV. content : This fied stored the text content in one posting, which contained ots of important features. Despite the semantic anaysis for a text was difficut, there were sti some specia symbos can be used to extract features (e.g. text between two # represents the hot topic means intention to interact with another user). In our experiment, we extracted the number of hot topic as n h, the number as n a, the number of URL (excuding the ocation share) as n. creattime : The vaue of this key was the Unix timestamp when the posting was pubished. We converted it into oca standard time and took the number of hour as t. source : This fied indicated the appications (e.g. web browser, phone app, third-part app) that the posting was submitted with. This is aso an important feature. Those compromised account can be caught cause of the sudden change of this fied. We took this fied as s. musicur, pic_ist and videour : We can consider these ce type fieds as mutimedia attachments. Due to space constraints, we wi discuss the detection of these attachments in other papers. In this paper, we temporay ignored these fieds. So one SFV can be represented by S = (n h, n a, n, t, s). Then we cacuated the CRI L for these 1500 users by the

6 1298 The Open Automation and Contro Systems Journa, 2015, Voume 7 Chen Hai-ting method mentioned in section and formed the fina DFV with other features. In this process, we set the threshod of sudden change g to be Meanwhie, the other dimensions were cacuated by Equation (2) where c equas 0.1. Finay, D =(L, R, T). R represented repeating degree of content text and T meant abnorma degree of submitting frequency Resuts To measure the effectiveness, we denoted anomaous accounts as positive sampes and norma accounts as negative ones, and used the standard metrics such as accuracy (ACC), fase positive rate (FPR) and true positive rate (TPR) [19]. Accuracy is the proportion of the tota number of the experiment resuts that were correct. Fase positive rate is the ratio of incorrecty cassified positive sampes to tota actua negative sampes. True positive rate is the ratio of correcty cassified positive sampes to tota actua positive sampes. With Tabe 1, these metrics can be described as foows: the accuracy is (n t +p t ) / (n t +n f +p t +p f ), the fase positive rate is p f / (n t +p f ) and the true positive rate is p t / (p t +n f ). Tabe 1. Metric reference tabe. Experiment Actua Negative Positive negative n t p f positive n f p t n t means the number of correcty cassified negative sampes, whie n f means the number of incorrecty. p t means the number of correcty cassified positive sampes, whie p f means the number of incorrecty. To compare the discrimination between CS-1-SVM and origina 1-SVM, we generated a Receiver Operating Characteristics (ROC) curve in (Fig. 3). The curves pot FPR on the X-axis and TPR on the Y-axis. Since the proposed improvement is the vauation of v, Tabe 2 shows the advantage in the reguarization parameter optimization of CS-1-SVM. The resuts in (Fig. 3) and Tabe 2 obtained by independent experiments were the comparison of accuracy and tria times between 1-SVM and CS-1-SVM. With Fig. (3) and Tabe 2, we can concude that our proposed method can improve the efficiency of reguarization parameter optimization without reducing the discrimination. In more detai, the overa resuts for our experiments were presented in Fig. (4). We can find that in the change of μ differenty impacted on different anomaous groups detections. The detection capabiity of spammers and phishers tended to change with μ, whie the capabiity of detecting compromised accounts was insensitive to variations of μ. However, due to the proper account modeing, the detection resuts of compromised accounts were sti exceent. 5. DISCUSSION Fig. (3). ROC comparison between 1-SVM and CS-1-SVM. Tabe 2. Comparison of reguarization parameter optimization times between 1-SVM and CS-1-SVM. Method ACC (±0.005) The experiments showed that the proposed CS-1-SVM is we suited for the unsupervised API abuse detection probem. There were two key factors that determine the performance of CS-1-SVM. One was the design for SFV and DFV and another was the optimization of parameter μ. The former described singe user s behavior whie the atter embodied out the overa simiar features of sampes. Thus, proper account mode and vaue of μ can make the detection resuts more idea. Fig. (4). Detaied ACC of anomaous accounts SVM (v) CS-1-SVM (μ) When comparing with other anomaous accounts detection methods, CS-1-SVM can be the more promising one on ONS. In detais, Most of those text based detection [6-10] methods just focused on text anayze but ignored the user s behaviors, and then induced the high FNR (fase negative rate) and ow TPR. Likewise most behavior mode based

7 CS-1-SVM: Improved One-cass SVM for The Open Automation and Contro Systems Journa, 2015, Voume Tabe 3. Comparison of features between CS-1-SVM and other works. Spammer Detection Phisher Detection Compromised Users Detection Unsupervised Cross-patform methods [11, 12] performed not so idea in terms of AUC because of their ack of we-designed extraction method for account modes and consideration of overa sampes features. Besides, the unsupervised cassification method this paper based on make the 0-day detection become possibe. With these anayze of experiments resuts and comparison with other methods proposed by previous papers, we can find the different appication scenarios between them to form the Tabe 3. CONCLUSION CS-1-SVM Text based detection [6-10] COMPA [11] Cick Stream [12] In this paper, we designed and evauated CS-1-SVM, a feature modeing simiarity and 1-SVM based approach for detecting both maicious and compromised account in Open Network Service. We firsty extracted users static features into SFV, and formed DFV by cosine simiarity of SFV and other dynamic features. Then, we trained a cassifier with these DFV sampes by proposed CS-1-SVM. Finay, we used the cassifier to detect anomaous accounts. The fina experiments proved that our proposed method coud improve the efficiency of reguarization parameter optimization without reducing the discrimination of origina 1-SVM. Furthermore, the abiity to capture both maicious and compromised account in 0-day and the patform- generaization was highighted by comparing with other previous works. Due to increasingy stringent restrictions on open API provided by ONS, sampe data coection has become more and more difficut especiay in coud storage service and eectronic commerce service. Our future work wi focus on the detection of API abuse by means of interna cooperation with some ONS in. Through the study of proper custering methods and anaysis of a arge number of sampe data, we are expected to be abe to find a method to group account into refined category and dea with coordinated attacks and Sybi attacks on ONS. CONFLICT OF INTEREST The author confirms that this artice content has no confict of interest. ACKNOWLEDGEMENTS Decared none. REFERENCES [1] D. Hardt, The OAuth 2.0 authorization framework, Avaiabe: [2] T. Lodderstedt, M. McGoin, and P. Hunt, OAuth 2.0 threat mode and security considerations, Avaiabe: ietf. org/htm/rfc6819 [3] H. Gao, J. Hu, C. Wison, Z. Li, Y. Chen, and B. Zhao, Detecting and Characterizing Socia Spam Campaigns, In: Internet Measurement Conference (IMC), [4] G. Stringhini, M. Egee, C. Kruege, and G. Vigna, Poutry markets: On the underground economy of Twitter foowers, In: Proceedings of the 2012 ACM workshop on Workshop on onine socia networks, 2012 [5] Eweek staff Verisign, 1.5m facebook accounts for sae in web forum, PC Magazine, [6] A. Pitsiidis, K. Levchenko, C. Kreibich, C. Kanich, M. Voeker, V. Paxson, N. Weaver, and S. Savage, Botnet Judo: Fighting Spam with Itsef, In: Proceedings of the 17 th Annua Network and Distributed System Security Symposium (NDSS), [7] C. Grier, K. Thomas, V. Paxson, and M. the underground on 140 characters or ess, In: ACM Conference on Computer and Communications Security (CCS), [8] H. Gao, Y. Chen, K. Lee, D. Pasetia, and A. Choudhary, Towards onine spam fitering in socia networks, In: Symposium on Network and Distributed System Security (NDSS), [9] S. Lee and J. Kim, WarningBird: Detecting suspicious URLs in twitter stream, In: Symposium on Network and Distributed System Security (NDSS), [10] K. Thomas, C. Grier, J. Ma, V. Paxson, and D. Song, Design and Evauation of a Rea-Time URL Spam Fitering Service, IEEE Symposium on Security and Privacy, [11] M. Egee, G. Stringhini, C. Kruege, and G. Vigna, COMPA: detecting compromised accounts on socia networks, In: ISOC Network and Distributed System Security Symposium (NDSS), [12] G. Wang, T. Konoige, C. Wison, X. Wang, H. Zheng, and B. Y. Zhao, You are how you cick: Cickstream anaysis for sybi detection, Symposium on USENIX Security, [13] A. Singha, Modern information retrieva: A brief overview, Buetin of the IEEE Computer Society Technica Committee on Data Engineering, vo. 24, no. 4, pp , [14] B. Schökopf, R.C. Wiiamson, A.J. Smoa, J. Shawe-Tayor, and J.C. Patt, Support vector method for novety detection, NIPS, vo. 12, pp , [15] M. Amer, M. Godstein, and S. Abdennadher, Enhancing onecass support vector machines for unsupervised anomay detection, In: Proceedings of the ACM SIGKDD Workshop on Outier Detection and Description, 2013, pp [16] B. Schökopf, J. C. Patt, J. Shawe-Tayor, A. J. Smoa, and R. C. Wiiamson, Estimating the support of a high-dimensiona distribution, Neura Computation, vo. 13, no. 7, pp , [17] J. Patt, Sequentia Minima Optimization: A Fast Agorithm for Training Support Vector Machines, TechReport, MSR-TR-98-14, 1998.

8 1300 The Open Automation and Contro Systems Journa, 2015, Voume 7 Chen Hai-ting [18] C.C. Chang, and C.J. Lin, LIBSVM: a ibrary for support vector machines, ACM Transactions on Inteigent Systems and Technoogy (TIST) vo. 2, no. 3, pp. 1-27, [19] K. Lee, J. Caveree, and S. Webb, Uncovering socia spammers: socia honeypots+ machine earning, In: Proceedings of the 33 rd Internationa ACM SIGIR Conference on Research and Deveopment in Information Retrieva, 2010, pp Received: February 23, 2015 Revised: Apri 20, 2015 Accepted: May 24, 2015 Chen Hai-ting; Licensee Bentham Open. This is an open access artice icensed under the terms of the Creative Commons Attribution Non-Commercia License ( icenses/by-nc/3.0/) which permits unrestricted, non-commercia use, distribution and reproduction in any medium, provided the work is propery cited.