{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,28]],"date-time":"2026-04-28T10:16:16Z","timestamp":1777371376857,"version":"3.51.4"},"publisher-location":"Cham","reference-count":29,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030321000","type":"print"},{"value":"9783030321017","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-32101-7_33","type":"book-chapter","created":{"date-parts":[[2019,10,11]],"date-time":"2019-10-11T07:04:00Z","timestamp":1570777440000},"page":"569-587","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Forecasting Suspicious Account Activity at Large-Scale Online Service Providers"],"prefix":"10.1007","author":[{"given":"Hassan","family":"Halawa","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Konstantin","family":"Beznosov","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Baris","family":"Coskun","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Meizhu","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Matei","family":"Ripeanu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,9,30]]},"reference":[{"key":"33_CR1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"294","DOI":"10.1007\/3-540-39200-9_18","volume-title":"Advances in Cryptology \u2014 EUROCRYPT 2003","author":"L Ahn von","year":"2003","unstructured":"von Ahn, L., Blum, M., Hopper, N.J., Langford, J.: CAPTCHA: using hard AI problems for security. In: Biham, E. (ed.) EUROCRYPT 2003. LNCS, vol. 2656, pp. 294\u2013311. Springer, Heidelberg (2003). \n                      https:\/\/doi.org\/10.1007\/3-540-39200-9_18"},{"key":"33_CR2","unstructured":"Benevenuto, F., Magno, G., Rodrigues, T., Almeida, V.: Detecting spammers on twitter. In: Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference (CEAS), vol. 6, p. 12 (2010)"},{"key":"33_CR3","doi-asserted-by":"publisher","unstructured":"Bilge, L., Han, Y., Dell\u2019Amico, M.: Riskteller: predicting the risk of cyber incidents. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, pp. 1299\u20131311. ACM, New York, NY, USA (2017). \n                      https:\/\/doi.org\/10.1145\/3133956.3134022\n                      \n                    , \n                      https:\/\/doi.acm.org\/10.1145\/3133956.3134022","DOI":"10.1145\/3133956.3134022"},{"issue":"1","key":"33_CR4","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1007\/s10462-009-9109-6","volume":"29","author":"E Blanzieri","year":"2008","unstructured":"Blanzieri, E., Bryl, A.: A survey of learning-based techniques of email spam filtering. Artif. Intell. Rev. 29(1), 63\u201392 (2008). \n                      https:\/\/doi.org\/10.1007\/s10462-009-9109-6\n                      \n                    . \n                      https:\/\/dx.doi.org\/10.1007\/s10462-009-9109-6","journal-title":"Artif. Intell. Rev."},{"key":"33_CR5","doi-asserted-by":"crossref","unstructured":"Boshmaf, Y., et al.: Integro: leveraging victim prediction for robust fake account detection in OSNs. In: 22nd Annual Network and Distributed System Security Symposium (NDSS), San Diego, California, USA, 8\u201311 February 2015, pp. 1\u201315. \n                      http:\/\/www.internetsociety.org\/doc\/integro-leveraging-victim-prediction-robust-fake-account-detection-osns","DOI":"10.14722\/ndss.2015.23260"},{"key":"33_CR6","doi-asserted-by":"publisher","unstructured":"Canali, D., Bilge, L., Balzarotti, D.: On the effectiveness of risk prediction based on users browsing behavior. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS 2014, pp. 171\u2013182. ACM, New York, NY, USA (2014). \n                      https:\/\/doi.org\/10.1145\/2590296.2590347\n                      \n                    , \n                      https:\/\/doi.acm.org\/10.1145\/2590296.2590347","DOI":"10.1145\/2590296.2590347"},{"key":"33_CR7","doi-asserted-by":"publisher","unstructured":"Castillo, C., Donato, D., Gionis, A., Murdock, V., Silvestri, F.: Know your neighbors: web spam detection using the web topology. In: Proceedings of the 30th Annual International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR 2007, pp. 423\u2013430. ACM, New York, NY, USA (2007). \n                      https:\/\/doi.org\/10.1145\/1277741.1277814\n                      \n                    , \n                      https:\/\/doi.acm.org\/10.1145\/1277741.1277814","DOI":"10.1145\/1277741.1277814"},{"key":"33_CR8","unstructured":"Egele, M., Stringhini, G., Kruegel, C., Vigna, G.: COMPA: detecting compromised accounts on social networks. In: Proceedings of the Network & Distributed System Security Symposium, NDSS 2013, ISOC, February 2013"},{"issue":"1","key":"33_CR9","first-page":"3133","volume":"15","author":"M Fern\u00e1ndez-Delgado","year":"2014","unstructured":"Fern\u00e1ndez-Delgado, M., Cernadas, E., Barro, S., Amorim, D.: Do we need hundreds of classifiers to solve real world classification problems? J. Mach. Learn. Res. 15(1), 3133\u20133181 (2014). \n                      http:\/\/dl.acm.org\/citation.cfm?id=2627435.2697065","journal-title":"J. Mach. Learn. Res."},{"key":"33_CR10","doi-asserted-by":"publisher","unstructured":"Halawa, H., Beznosov, K., Boshmaf, Y., Coskun, B., Ripeanu, M., Santos-Neto, E.: Harvesting the low-hanging fruits: defending against automated large-scale cyber-intrusions by focusing on the vulnerable population. In: Proceedings of the 2016 New Security Paradigms Workshop, NSPW 2016, pp. 11\u201322. ACM, New York, NY, USA (2016). \n                      https:\/\/doi.org\/10.1145\/3011883.3011885\n                      \n                    , \n                      https:\/\/doi.acm.org\/10.1145\/3011883.3011885","DOI":"10.1145\/3011883.3011885"},{"key":"33_CR11","unstructured":"Halawa, H., Ripeanu, M., Beznosov, K., Coskun, B., Liu, M.: Forecasting suspicious account activity at large-scale online service providers. CoRR abs\/1801.08629 (2018). \n                      http:\/\/arxiv.org\/abs\/1801.08629"},{"issue":"9","key":"33_CR12","doi-asserted-by":"publisher","first-page":"1263","DOI":"10.1109\/TKDE.2008.239","volume":"21","author":"H He","year":"2009","unstructured":"He, H., Garcia, E.A.: Learning from imbalanced data. IEEE Trans. Knowl. Data Eng. 21(9), 1263\u20131284 (2009). \n                      https:\/\/doi.org\/10.1109\/TKDE.2008.239","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"33_CR13","unstructured":"Ho, G., Javed, A.S.M., Paxson, V., Wagner, D.: Detecting credential spearphishing attacks in enterprise settings. In: Proceedings of the 26rd USENIX Security Symposium, USENIX Security 2017, pp. 469\u2013485 (2017)"},{"issue":"10","key":"33_CR14","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1145\/1290958.1290968","volume":"50","author":"TN Jagatic","year":"2007","unstructured":"Jagatic, T.N., Johnson, N.A., Jakobsson, M., Menczer, F.: Social phishing. Commun. ACM 50(10), 94\u2013100 (2007)","journal-title":"Commun. ACM"},{"key":"33_CR15","doi-asserted-by":"publisher","unstructured":"Liu, G., Xiang, G., Pendleton, B.A., Hong, J.I., Liu, W.: Smartening the crowds: computational techniques for improving human verification to fight phishing scams. In: Proceedings of the Seventh Symposium on Usable Privacy and Security, SOUPS 2011, pp. 8:1\u20138:13. ACM, New York, NY, USA (2011). \n                      https:\/\/doi.org\/10.1145\/2078827.2078838\n                      \n                    , \n                      https:\/\/doi.acm.org\/10.1145\/2078827.2078838","DOI":"10.1145\/2078827.2078838"},{"key":"33_CR16","unstructured":"Liu, Y., et al.: Cloudy with a chance of breach: forecasting cyber security incidents. In: Proceedings of the 24th USENIX Security Symposium, USENIX Security 2015, pp. 1009\u20131024 (2015)"},{"issue":"2","key":"33_CR17","doi-asserted-by":"publisher","first-page":"16:1","DOI":"10.1145\/2431211.2431215","volume":"45","author":"S Lomax","year":"2013","unstructured":"Lomax, S., Vadera, S.: A survey of cost-sensitive decision tree induction algorithms. ACM Comput. Surv. 45(2), 16:1\u201316:35 (2013). \n                      https:\/\/doi.org\/10.1145\/2431211.2431215\n                      \n                    . \n                      https:\/\/doi.acm.org\/10.1145\/2431211.2431215","journal-title":"ACM Comput. Surv."},{"key":"33_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"20","DOI":"10.1007\/978-3-540-73614-1_2","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"C Ludl","year":"2007","unstructured":"Ludl, C., McAllister, S., Kirda, E., Kruegel, C.: On the effectiveness of techniques to detect phishing sites. In: M. H\u00e4mmerli, B., Sommer, R. (eds.) DIMVA 2007. LNCS, vol. 4579, pp. 20\u201339. Springer, Heidelberg (2007). \n                      https:\/\/doi.org\/10.1007\/978-3-540-73614-1_2"},{"issue":"3","key":"33_CR19","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1257\/jep.23.3.3","volume":"23","author":"T Moore","year":"2009","unstructured":"Moore, T., Clayton, R., Anderson, R.: The economics of online crime. J. Econ. Perspect. 23(3), 3\u201320 (2009). \n                      https:\/\/doi.org\/10.1257\/jep.23.3.3\n                      \n                    . \n                      https:\/\/www.aeaweb.org\/articles\/?doi=10.1257\/jep.23.3.3","journal-title":"J. Econ. Perspect."},{"issue":"3","key":"33_CR20","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1023\/A:1007601015854","volume":"42","author":"F Provost","year":"2001","unstructured":"Provost, F., Fawcett, T.: Robust classification for imprecise environments. Mach. Learn. 42(3), 203\u2013231 (2001). \n                      https:\/\/doi.org\/10.1023\/A:1007601015854\n                      \n                    . \n                      https:\/\/dx.doi.org\/10.1023\/A:1007601015854","journal-title":"Mach. Learn."},{"issue":"18","key":"33_CR21","doi-asserted-by":"publisher","first-page":"3799","DOI":"10.1016\/j.ins.2007.03.025","volume":"177","author":"T Shon","year":"2007","unstructured":"Shon, T., Moon, J.: A hybrid machine learning approach to network anomaly detection. Inf. Sci. 177(18), 3799\u20133821 (2007)","journal-title":"Inf. Sci."},{"key":"33_CR22","unstructured":"Soska, K., Christin, N.: Automatically detecting vulnerable websites before they turn malicious. In: Proceedings of the 23rd USENIX Security Symposium, USENIX Security 2014, pp. 625\u2013640 (2014)"},{"key":"33_CR23","doi-asserted-by":"publisher","unstructured":"Stein, T., Chen, E., Mangla, K.: Facebook immune system. In: Proceedings of the 4th Workshop on Social Network Systems, SNS 2011, pp. 8:1\u20138:8. ACM, New York, NY, USA (2011). \n                      https:\/\/doi.org\/10.1145\/1989656.1989664\n                      \n                    . \n                      https:\/\/doi.acm.org\/10.1145\/1989656.1989664","DOI":"10.1145\/1989656.1989664"},{"key":"33_CR24","doi-asserted-by":"publisher","unstructured":"Thomas, K., Li, F., Grier, C., Paxson, V.: Consequences of connectivity: characterizing account hijacking on twitter. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS 2014, pp. 489\u2013500. ACM, New York, NY, USA (2014). \n                      https:\/\/doi.org\/10.1145\/2660267.2660282\n                      \n                    . \n                      https:\/\/doi.acm.org\/10.1145\/2660267.2660282","DOI":"10.1145\/2660267.2660282"},{"key":"33_CR25","unstructured":"Wang, G., Konolige, T., Wilson, C., Wang, X., Zheng, H., Zhao, B.Y.: You are how you click: clickstream analysis for sybil detection. In: Proceedings of the 22Nd USENIX Conference on Security, SEC 2013, pp. 241\u2013256. USENIX Association, Berkeley, CA, USA (2013). \n                      http:\/\/dl.acm.org\/citation.cfm?id=2534766.2534788"},{"key":"33_CR26","unstructured":"Whittaker, C., Ryner, B., Nazif, M.: Large-scale automatic classification of phishing pages. In: Proceedings of the 17th Annual Network and Distributed System Security Symposium, NDSS Symposium 2010, San Diego, CA, USA (2010)"},{"key":"33_CR27","doi-asserted-by":"publisher","unstructured":"Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B.Y., Dai, Y.: Uncovering social network sybils in the wild. In: Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference, IMC 2011, pp. 259\u2013268. ACM, New York, NY, USA (2011). \n                      https:\/\/doi.org\/10.1145\/2068816.2068841\n                      \n                    . \n                      https:\/\/doi.acm.org\/10.1145\/2068816.2068841","DOI":"10.1145\/2068816.2068841"},{"key":"33_CR28","unstructured":"Zaharia, M., Chowdhury, M., Franklin, M.J., Shenker, S., Stoica, I.: Spark: cluster computing with working sets. In: Proceedings of the 2Nd USENIX Conference on Hot Topics in Cloud Computing, HotCloud 2010, p. 10. USENIX Association, Berkeley, CA, USA (2010). \n                      http:\/\/dl.acm.org\/citation.cfm?id=1863103.1863113"},{"key":"33_CR29","doi-asserted-by":"publisher","unstructured":"Zhang, J., et al.: Safeguarding academic accounts and resources with the university credential abuse auditing system. In: IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN 2012), pp. 1\u20138, June 2012. \n                      https:\/\/doi.org\/10.1109\/DSN.2012.6263961","DOI":"10.1109\/DSN.2012.6263961"}],"container-title":["Lecture Notes in Computer Science","Financial Cryptography and Data Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-32101-7_33","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,10,11]],"date-time":"2019-10-11T07:09:21Z","timestamp":1570777761000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-32101-7_33"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030321000","9783030321017"],"references-count":29,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-32101-7_33","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"30 September 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"FC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Financial Cryptography and Data Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"St. Kitts","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Saint Kitts and Nevis","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 February 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 February 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"fc2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/fc19.ifca.ai\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"HotCRP","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"178","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"32","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"7","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"18% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3,08","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"7,6","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}