Detecting social media mobile botnets using user activity correlation and artificial immune system

With the rapidly growing development of cellular networks and powerful smartphones, botnets have invaded the mobile domain. Social media, like Twitter, Facebook, and YouTube have created a new communication channel for attackers. Recently, bot masters started to exploit social media for different malicious activity, such as sending spam, recruitment of new bots, and botnet command and control. In this paper we propose a detection technique for social mediabased mobile botnets using Twitter. The proposed method combines the correlation between tweeting and user activity, such as clicks or taps, and an Artificial Immune System detector, to detect tweets caused by bots and differentiate them from tweets generated by user or by user-approved applications. This detector creates a signature of the tweet and compares it with a dynamically updated signature library of bot behavior signatures. The proposed system has been fully implemented on Android platform and tested under several sets of generated tweets. The test results show that the proposed method has a very high accuracy in detecting bot tweets with about 95% detection ratio.