Skip to main content
SpringerLink
Log in

NetDER: An Architecture for Reasoning About Malicious Behavior

  • Published:
Information Systems Frontiers Aims and scope Submit manuscript

Abstract

Malicious behavior in social media has many faces, which for instance appear in the form of bots, sock puppets, creation and dissemination of fake news, Sybil attacks, and actors hiding behind multiple identities. In this paper, we propose the NetDER architecture, which takes its name from its two main modules: Net work D iffusion and ontological reasoning based on E xistential R ules), to address these issues. This initial proposal is meant to serve as a roadmap for research and development of tools to attack malicious behavior in social media, guiding the implementation of software in this domain, instead of a specific solution. Our working hypothesis is that these problems – and many others – can be effectively tackled by (i) combining multiple data sources that are constantly being updated, (ii) maintaining a knowledge base using logic-based formalisms capable of value invention to support generating hypotheses based on available data, and (iii) maintaining a related knowledge base with information regarding how actors are connected, and how information flows across their network. We show how these three basic tenets give rise to a general model that has the further capability of addressing multiple problems at once.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8

Similar content being viewed by others

Notes

  1. https://nvd.nist.gov/

  2. If one wishes to use an implementation provided by a Semantic Web standard, this can be done taking appropriate measures to first translate the Datalog syntax.

  3. https://nvd.nist.gov/vuln/data-feeds

  4. https://www.cyr3con.ai/

  5. Linux.Luabot is a malware discovered in late 2016 that infects Linux-based hosts via Trojan horse attacks; cf. https://www.symantec.com/security-center/writeup/2016-090915-3236-99

  6. For instance, the rule could have the form “if a user believes that certain software is dangerous with a degree of at least 0.5, then there exists another user who is related to the first, is an expert, and also has this belief with at least 0.5”.

References

  • Abokhodair, N., Yoo, D., McDonald, D.W. (2015). Dissecting a social botnet: growth, content and influence in Twitter. In Proceedings of the 18th ACM conference on computer supported cooperative work & social computing (pp. 839–851). ACM.

  • Baget, J.F., Mugnier, M.L., Rudolph S, Thomazo M. (2011a). Walking the complexity lines for generalized guarded existential rules. In 22nd international joint conference on artificial intelligence. AAAI Press.

  • Baget, J.F., Mugnier, M.L., Thomazo, M. (2011b). Towards farsighted dependencies for existential rules. In Web reasoning and rule systems (pp. 30–45). Berlin: Springer.

  • Bekiros, S., Nguyen, D.K., Junior, L.S., Uddin, G.S. (2017). Information diffusion, cluster formation and entropy-based network dynamics in equity and commodity markets. European Journal of Operational Research, 256 (3), 945–961.

    Article  Google Scholar 

  • Benigni, M., & Carley, K.M. (2016). From tweets to intelligence: Understanding the islamic jihad supporting community on twitter. In Xu, K.S., Reitter, D., Lee, D., Osgood, N. (Eds.) Social, cultural, and behavioral modeling (pp. 346–355). Cham: Springer International Publishing.

  • Benigni, M.C., Joseph, K., Carley, K.M. (2017). Online extremism and the communities that sustain it: Detecting the isis supporting community on twitter. PloS one, 12(12), e0181405.

    Article  Google Scholar 

  • Benigni, M.C., Joseph, K., Carley, K.M. (2019). Bot-ivistm: Assessing information manipulation in social media using network analytics, (pp. 19–42). Cham: Springer International Publishing.

    Google Scholar 

  • Bianconi, G. (2015). Interdisciplinary and physics challenges of network theory. EPL (Europhysics Letters), 111(5), 56001.

    Article  Google Scholar 

  • Calì, A., Gottlob, G., Lukasiewicz, T. (2012). A general Datalog-based framework for tractable query answering over ontologies. Web Semantics: Science, Services and Agents on the World Wide Web, 4, 57–83.

    Article  Google Scholar 

  • Cali, A., Gottlob, G., Pieris, A. (2012). Towards more expressive ontology languages: the query answering problem. Artificial Intelligence, 193, 87–128.

    Article  Google Scholar 

  • Calì, A., Gottlob, G., Kifer, M. (2013). Taming the infinite chase: Query answering under expressive relational constraints. Journal of Artificial Intelligence Research, 48, 115–174.

    Article  Google Scholar 

  • Centola, D. (2015). The social origins of networks and diffusion. American Journal of Sociology, 120(5), 1295–1338.

    Article  Google Scholar 

  • Conroy, N.J., Rubin, V.L., Chen, Y. (2015). Automatic deception detection: Methods for finding fake news. Proceedings of the association for information science and technology, 52(1), 1–4.

    Article  Google Scholar 

  • Davis, C.A., Varol, O., Ferrara, E., Flammini, A., Menczer, F. (2016). BotOrNot: A system to evaluate social bots. In Proceedings of the 25th international conference companion on World Wide Web. (pp. 273–274). International World Wide Web Conferences Steering Committee.

  • Deagustini, C.A.D., Martinez, M.V., Falappa, M.A., Simari, G.R. (2016). Datalog+/– ontology consolidation. Journal of Artificial Intelligence Research, 56, 613–656.

    Article  Google Scholar 

  • Deagustini, C.A.D., Martinez, M.V., Falappa, M.A., Simari, G.R. (2018). How does incoherence affect inconsistency-tolerant semantics for Datalog+/–? Annals of Mathematics and Artificial Intelligence, 82(1-3), 43–68.

    Article  Google Scholar 

  • Della Valle, E., Ceri, S., van Harmelen, F., Fensel, D. (2009). It’s a streaming world! reasoning upon rapidly changing information. IEEE Intelligent Systems, 24(6), 83–89.

    Article  Google Scholar 

  • Falappa, M.A., Kern-Isberner, G., Reis, M.D.L., Simari, G.R. (2012). Prioritized and non-prioritized multiple change on belief bases. J Philosophical Log, 41(1), 77–113.

    Article  Google Scholar 

  • Falappa, M.A., García, A.J., Kern-Isberner, G., Simari, G.R. (2013). Stratified belief bases revision with argumentative inference. Journal of Philosophical Logic, 42(1), 161–193.

    Article  Google Scholar 

  • Ferrara, E., Varol, O., Davis, C., Menczer, F., Flammini, A. (2016). The rise of social bots. Communications of the ACM, 59(7), 96–104.

    Article  Google Scholar 

  • Gallo, F.R., Simari, G.I., Martinez, M.V., Falappa, M.A., Santos, N.A. (2017). Reasoning about sentiment and knowledge diffusion in social networks. IEEE Internet Computing, 21(6), 8–17.

    Article  Google Scholar 

  • Gallo, F.R., Simari, G.I., Martinez, M.V., Falappa, M.A. (2019). Predicting user reactions to twitter feed content based on personality type and social cues. Future Generation Computer Systems (In Press).

  • Jain, P., Kumaraguru, P., Joshi A. (2013). @ i seek ‘fb. me’: Identifying users across multiple online social networks. In Proceedings of the 22nd International Conference on World Wide Web, (pp. 1259–1268). ACM.

  • Jalili, M., & Perc, M. (2017). Information cascades in complex networks. Journal of Complex Networks, 5(5), 665–693.

    Google Scholar 

  • Kolaitism, P.G. (2018). Reflections on schema mappings, data exchange, and metadata management. In Proc.ACM SIGMOD/PODS, (pp. 107–109). ACM.

  • Konieczny, S., & Pino Pérez, R. (2002). Merging information under constraints: A logical framework. Journal of Logic And Computation, 12(5), 773–808.

    Article  Google Scholar 

  • Konieczny, S., & Pino Pérez, R. (2011). Logic based merging. Journal of Philosophical Logic, 40(2), 239–270.

    Article  Google Scholar 

  • Kumar, A., Garg, D., Singh, P. (2017a). Clustering approach to detect profile injection attacks in recommender system. International Journal Of Computer Applications, 166(6), 7–11.

    Article  Google Scholar 

  • Kumar, S., Cheng, J., Leskovec, J., Subrahmanian, V. (2017b). An army of me: Sockpuppets in online discussion communities. In Proceedings of WWW, International World Wide Web conferences steering committee. (pp. 857–866).

  • Leone, N., Manna, M., Terracina, G., Veltri, P. (2012). Efficiently computable datalog∃ programs. In Thirteenth international conference on the principles of knowledge representation and reasoning. (AAAI Press).

  • Lukasiewicz, T., Martinez, M.V., Simari, G.I. (2012). Inconsistency handling in datalog+/– ontologies. In Proc. ECAI, (pp. 558–563).

  • Malhotra, A., Totti, L., Meira, W. Jr, Kumaraguru, P., Almeida, V. (2012). Studying user footprints in different online social networks. In Proc. ASONAM, IEEE computer society, (pp. 1065–1070).

  • Malliaros, F.D., Rossi, M.E.G., Vazirgiannis, M. (2016). Locating influential nodes in complex networks. Scientific reports, 6, 19307.

    Article  Google Scholar 

  • Marin, E., Diab, A., Shakarian, P. (2016). Product offerings in malicious hacker markets. In 2016 IEEE conference on intelligence and security informatics (ISI). (IEEE) (pp. 187– 189).

  • Miller, R.J. (2018). Open data integration. Proceedings of the VLDB Endowment, 11(12), 2130–2139.

    Article  Google Scholar 

  • Noh, G., Ym, Kang, Oh, H., Ck, Kim. (2014). Robust sybil attack defense with information level in online recommender systems. Expert Systems with Applications, 41(4), 1781–1791.

    Article  Google Scholar 

  • Nunes, E., Shakarian, P., Simari, G.I. (2018). At-risk system identification via analysis of discussions on the darkweb. In 2018 APWG symposium on electronic crime research (eCrime), (pp 1–12). IEEE.

  • Paredes, J.N., Martinez, M.V., Simari, G.I., Falappa, M.A. (2018a). Leveraging probabilistic existential rules for adversarial deduplication. In Proceedings of PRUV@IJCAR 2018 CEUR-WS.

  • Paredes, J.N., Simari, G.I., Martinez, M.V., Falappa, M.A. (2018b). First steps towards data-driven adversarial deduplication. Information, 9(8), 189.

    Article  Google Scholar 

  • Pavlopoulos, G.A., Secrier, M., Moschopoulos, C.N., Soldatos, T.G., Kossida, S., Aerts, J., Schneider, R., Bagos, P.G. (2011). Using graph theory to analyze biological networks. BioData Mining, 4(1), 10.

    Article  Google Scholar 

  • Robson, D. (2019). Why smart people are more likely to believe fake news. https://www.theguardian.com/books/2019/apr/01/why-smart-people-are-more-likely-to-believe-fake-news, (Accessed June 12, 2019).

  • Sarkar, S., Almukaynizi, M., Shakarian, J., Shakarian, P. (2018). Predicting enterprise cyber incidents using social network analysis on the darkweb hacker forums. CoRR arXiv:1811.06537.

  • Shakarian, P., Simari, G.I., Callahan, D. (2013). Reasoning about complex networks: A logic programming approach. Theory and Practice of Logic Programming, 13. 4-5-Online-Supplement.

  • Shao, C., Ciampaglia, G.L., Varol, O., Flammini, A., Menczer, F. (2017). The spread of fake news by social bots, (pp 96–104). arXiv:170707592.

  • Shu, K., Sliva, A., Wang, S., Tang, J., Liu, H. (2017). Fake news detection on social media: A data mining perspective. ACM SIGKDD Explorations Newsletter, 19(1), 22–36.

    Article  Google Scholar 

  • Simari, G.I., Molinaro, C., Martinez, M.V., Lukasiewicz, L, Predoiu, L. (2017). Ontology-based data access leveraging subjective reports, 1st edn.: Springer Publishing Company, Inc.

  • Subrahmanian, V.S., Azaria, A., Durst, S., Kagan, V., Galstyan, A., Lerman, K., Zhu, L., Ferrara, E., Flammini, A., Menczer, F. (2016). The DARPA twitter bot challenge. IEEE Computer, 49(6), 38–46.

    Article  Google Scholar 

  • Tavabi, N., Goyal, P., Almukaynizi, M., Shakarian, P., Lerman, K. (2018). Darkembed: Exploit prediction with neural language models. In 32nd AAAI conference on artificial intelligence. (AAAI Press).

  • Yamak, Z., Saunier, J., Vercouter, L. (2018). Sockscatch: Automatic detection and grouping of sockpuppets in social media. Knowledge-Based Systems, 149, 124–142.

    Article  Google Scholar 

  • Zheng, X., Lai, Y.M., Chow, K.P., Hui, L.C., Yiu, S.M. (2011). Sockpuppet detection in online discussion forums. In Proc. international conference on intelligent information hiding and multimedia signal processing, (pp 374–377). IEEE.

Download references

Acknowledgments

This work was funded in part by Universidad Nacional del Sur (UNS) under grants PGI 24/N046 and PGI 24/ZN34, and CONICET under grant PIP 11220170100871CO, Argentina, and the EU H2020 Research and Innovation Programme under the Marie Sklodowska-Curie grant agreement No. 690974 for the project “MIREL”.

Author information

Authors and Affiliations

  1. Department of Computer Science and Engineering Universidad Nacional del Sur (UNS) and Institute for Computer Science and Engineering, UNS–CONICET, San Andres 800, Campus Palihue, 8000, Bahia Blanca, Argentina

    Jose N. Paredes, Gerardo I. Simari & Marcelo A. Falappa

  2. School of Computing, Informatics, and Decision Systems Engineering (CIDSE), Arizona State University Tempe, Tempe, AZ 85281, USA

    Gerardo I. Simari

  3. Department of Computer Science, Universidad de Buenos Aires (UBA), and Institute for Computer Science Research, UBA–CONICET, Ciudad Autonoma de Buenos Aires, Buenos Aires, C1428EGA, Argentina

    Maria Vanina Martinez

Authors
  1. Jose N. Paredes
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Gerardo I. Simari
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Maria Vanina Martinez
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Marcelo A. Falappa
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Gerardo I. Simari.

Additional information

Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Paredes, J.N., Simari, G.I., Martinez, M.V. et al. NetDER: An Architecture for Reasoning About Malicious Behavior. Inf Syst Front 23, 185–201 (2021). https://doi.org/10.1007/s10796-020-10003-w

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10796-020-10003-w

Keywords

Search

Navigation