{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,12]],"date-time":"2026-03-12T07:43:56Z","timestamp":1773301436894,"version":"3.50.1"},"reference-count":72,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2020,8,25]],"date-time":"2020-08-25T00:00:00Z","timestamp":1598313600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Open Data Analytics in Social Research","award":["ES\/P008755\/1"],"award-info":[{"award-number":["ES\/P008755\/1"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Web"],"published-print":{"date-parts":[[2020,11,30]]},"abstract":"<jats:p>Twitter has emerged as one of the most popular platforms to get updates on entertainment and current events. However, due to its 280-character restriction and automatic shortening of URLs, it is continuously targeted by cybercriminals to carry out drive-by download attacks, where a user\u2019s system is infected by merely visiting a Web page. Popular events that attract a large number of users are used by cybercriminals to infect and propagate malware by using popular hashtags and creating misleading tweets to lure users to malicious Web pages. A drive-by download attack is carried out by obfuscating a malicious URL in an enticing tweet and used as clickbait to lure users to a malicious Web page. In this article, we answer the following two questions: Why are certain malicious tweets retweeted more than others? Do emotions reflecting in a tweet drive virality? We gathered tweets from seven different sporting events over 3 years and identified those tweets that were used to carry to out a drive-by download attack. From the malicious (<jats:italic>N<\/jats:italic>= 105, 642) and benign (<jats:italic>N<\/jats:italic>= 169, 178) data sample identified, we built models to predict information flow size and survival. We define size as the number of retweets of an original tweet, and survival as the duration of the original tweet\u2019s presence in the study window. We selected the zero-truncated negative binomial (ZTNB) regression method for our analysis based on the distribution exhibited by our dependent size measure and the comparison of results with other predictive models. We used the Cox regression technique to model the survival of information flows as it estimates proportional hazard rates for independent measures. Our results show that both social and content factors are statistically significant for the size and survival of information flows for both malicious and benign tweets. In the benign data sample, positive emotions and positive sentiment reflected in the tweet significantly predict size and survival. In contrast, for the malicious data sample, negative emotions, especially fear, are associated with both size and survival of information flows.<\/jats:p>","DOI":"10.1145\/3408894","type":"journal-article","created":{"date-parts":[[2020,8,26]],"date-time":"2020-08-26T04:13:48Z","timestamp":1598415228000},"page":"1-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Emotions Behind Drive-by Download Propagation on Twitter"],"prefix":"10.1145","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9761-0945","authenticated-orcid":false,"given":"Amir","family":"Javed","sequence":"first","affiliation":[{"name":"School of Computer Science and Informatics, Wales"}]},{"given":"Pete","family":"Burnap","sequence":"additional","affiliation":[{"name":"School of Computer Science and Informatics, Wales"}]},{"given":"Matthew L.","family":"Williams","sequence":"additional","affiliation":[{"name":"School of Social Science, Wales"}]},{"given":"Omer F.","family":"Rana","sequence":"additional","affiliation":[{"name":"School of Computer Science and Informatics, Wales"}]}],"member":"320","published-online":{"date-parts":[[2020,8,25]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(13)70072-1"},{"key":"e_1_2_1_2_1","unstructured":"Per Kragh Andersen and Richard David Gill. 1982. Cox\u2019s regression model for counting processes: A large sample study. Ann. Stat. (1982) 1100--1120. Per Kragh Andersen and Richard David Gill. 1982. Cox\u2019s regression model for counting processes: A large sample study. Ann. Stat. (1982) 1100--1120."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2433396.2433401"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1509\/jmr.10.0353"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.2478\/gfkmir-2014-0022"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/s13278-014-0206-4"},{"key":"e_1_2_1_7_1","unstructured":"R. Steenson and C. Seifert. 2017. Capture-HPC. Retrieved from https:\/\/projects.honeynet.org\/capture-hpc. R. Steenson and C. Seifert. 2017. Capture-HPC. Retrieved from https:\/\/projects.honeynet.org\/capture-hpc."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10766-014-0330-9"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCT.2017.8359857"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2010.01.100830"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3289600.3291010"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASONAM.2018.8508801"},{"key":"e_1_2_1_13_1","unstructured":"Edgefluence. 2019. Like4Like\u2014Get FREE real Instagram likes! Retrieved from https:\/\/like4like.com. Edgefluence. 2019. Like4Like\u2014Get FREE real Instagram likes! Retrieved from https:\/\/like4like.com."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1080\/02699939208411068"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.physa.2010.09.034"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1314389.1314402"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1136\/bmj.a2338"},{"key":"e_1_2_1_18_1","volume-title":"Hackers hide cyber attacks in social media posts. N.Y. Times (May","author":"Frenkel Sheera","year":"2017"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2005.1498374"},{"key":"e_1_2_1_20_1","volume-title":"Super Bowl XLIX smashes twitter records. CNBC (Feb","author":"Gibbs Alexandra","year":"2015"},{"key":"e_1_2_1_21_1","volume-title":"Super bowl underperforms in TV audience and social media chatter. Forbes (Feb","author":"Granados Nelson","year":"2016"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1007\/s13198-015-0376-0"},{"key":"e_1_2_1_23_1","doi-asserted-by":"crossref","first-page":"215","DOI":"10.1080\/07350015.1991.10509847","article-title":"Tests for detecting overdispersion in the positive poisson regression model","volume":"9","author":"Gurmu Shiferaw","year":"1991","journal-title":"J. Bus. Econ. Stat."},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1111\/1467-8721.ep10770953"},{"key":"e_1_2_1_25_1","volume-title":"Negative Binomial Regression","author":"Hilbe Joseph M."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2014.141"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.visres.2008.09.007"},{"key":"e_1_2_1_28_1","unstructured":"Amir Javed Pete Burnap and Omer Rana. 2018. Prediction of drive-by download attacks on Twitter. Info. Process. Manage. (2018). Amir Javed Pete Burnap and Omer Rana. 2018. Prediction of drive-by download attacks on Twitter. Info. Process. Manage. (2018)."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3110025.3119398"},{"key":"e_1_2_1_30_1","volume-title":"Twitter reveals the top tweeted events of 2016\u2014Dec. 6","author":"Kottasova Ivana","year":"2016"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1320040111"},{"key":"e_1_2_1_32_1","volume-title":"Ddos on dyn impacts twitter, spotify, reddit. Krebs Security (Oct","author":"Krebs Brian","year":"2016"},{"key":"e_1_2_1_33_1","volume-title":"The top 15 sporting events that blew up Twitter","author":"Laird Sam","year":"2015"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.3"},{"key":"e_1_2_1_35_1","first-page":"1","article-title":"Malware propagations in wireless ad hoc networks","volume":"1","author":"Liu Bo","year":"2016","journal-title":"IEEE Trans. Depend. Secure Comput."},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2800740"},{"key":"e_1_2_1_37_1","unstructured":"J. Scott Long. 1997. Regression models for categorical and limited dependent variables (Vol. 7). Adv. Quant. Techn. Soc. Sci. (1997) 219. J. Scott Long. 1997. Regression models for categorical and limited dependent variables (Vol. 7). Adv. Quant. Techn. Soc. Sci. (1997) 219."},{"key":"e_1_2_1_38_1","first-page":"4","article-title":"Behind phishing: An examination of phisher modi operandi","volume":"8","author":"McGrath D. Kevin","year":"2008","journal-title":"LEET"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-8640.2012.00460.x"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.17"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2469253"},{"key":"e_1_2_1_42_1","unstructured":"Danny Palmer. 2016. Is your Android phone being controlled by a rogue Twitter account? Botnet is first to receive commands via tweets | ZDNet. Retrieved from https:\/\/tinyurl.com\/y4wbmyor. Danny Palmer. 2016. Is your Android phone being controlled by a rogue Twitter account? Botnet is first to receive commands via tweets | ZDNet. Retrieved from https:\/\/tinyurl.com\/y4wbmyor."},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevLett.86.3200"},{"key":"e_1_2_1_44_1","volume-title":"Emotions and Life: Perspectives from Psychology, Biology, and Evolution","author":"Plutchik Robert"},{"key":"e_1_2_1_45_1","unstructured":"PorcelainSky LLC. 2019. Get Twitter Followers YouTube Views Subscribers\u2014YouLikeHits. Retrieved from https:\/\/www.youlikehits.com. PorcelainSky LLC. 2019. Get Twitter Followers YouTube Views Subscribers\u2014YouLikeHits. Retrieved from https:\/\/www.youlikehits.com."},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2659651.2659717"},{"key":"e_1_2_1_47_1","unstructured":"Cl\u00e9ment Ren\u00e9. 2019. Instagram Engagement Report 2019: The more hashtags the less engagement. Retrieved from https:\/\/mention.com\/blog\/hashtags-engagement-instagram. Cl\u00e9ment Ren\u00e9. 2019. Instagram Engagement Report 2019: The more hashtags the less engagement. Retrieved from https:\/\/mention.com\/blog\/hashtags-engagement-instagram."},{"key":"e_1_2_1_48_1","unstructured":"M. G. Roberts and J. A. P. Heesterbeek. 2003. Mathematical Models in Epidemiology. EOLSS. M. G. Roberts and J. A. P. Heesterbeek. 2003. Mathematical Models in Epidemiology. EOLSS."},{"key":"e_1_2_1_49_1","unstructured":"Joshua Roesslein. [n.d.]. Tweepy. Retrieved from http:\/\/www.tweepy.org\/. Joshua Roesslein. [n.d.]. Tweepy. Retrieved from http:\/\/www.tweepy.org\/."},{"key":"e_1_2_1_50_1","unstructured":"Charlotte Rogers. 2016. Euro 2016 most tweeted TV of the year. Retrieved from https:\/\/www.marketingweek.com\/2016\/12\/14\/euros-tweeted-tv-2016. Charlotte Rogers. 2016. Euro 2016 most tweeted TV of the year. Retrieved from https:\/\/www.marketingweek.com\/2016\/12\/14\/euros-tweeted-tv-2016."},{"key":"e_1_2_1_51_1","unstructured":"SANS Institue. 2017. 2017 Threat Landscape Survey: Users on the Front Line. Retrieved from https:\/\/www.sans.org\/reading-room\/whitepapers\/threats\/2017-threat-landscape-survey-users-front-line-37910. SANS Institue. 2017. 2017 Threat Landscape Survey: Users on the Front Line. Retrieved from https:\/\/www.sans.org\/reading-room\/whitepapers\/threats\/2017-threat-landscape-survey-users-front-line-37910."},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2012.06.090"},{"key":"e_1_2_1_53_1","volume-title":"The Number of tweets per day","author":"Sayce David","year":"2019"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2016.11.013"},{"key":"e_1_2_1_55_1","unstructured":"smfrogers. 2019. Insights into the #WorldCup conversation on Twitter. Retrieved from https:\/\/blog.twitter.com\/en_us\/a\/2014\/insights-into-the-worldcup-conversation-on-twitter.html. smfrogers. 2019. Insights into the #WorldCup conversation on Twitter. Retrieved from https:\/\/blog.twitter.com\/en_us\/a\/2014\/insights-into-the-worldcup-conversation-on-twitter.html."},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/S16-2021"},{"key":"e_1_2_1_57_1","unstructured":"Spotcal. 2019. Healthy TV audiences for final as 2015 Rugby World Cup hailed as \u201cbiggest and best\u201d yet.Retrieved from https:\/\/www.sportcal.com\/News\/FeaturedNews\/39963. Spotcal. 2019. Healthy TV audiences for final as 2015 Rugby World Cup hailed as \u201cbiggest and best\u201d yet.Retrieved from https:\/\/www.sportcal.com\/News\/FeaturedNews\/39963."},{"key":"e_1_2_1_58_1","unstructured":"CricketCountry Staff. 2015. ICC Cricket World Cup 2015: India-Pakistan a Twitter hit 1.7 million tweets. Cricket Country. Retrieved from https:\/\/www.cricketcountry.com\/criclife\/icc-cricket-world-cup-2015-india-pakistan-a-twitter-hit-1-7-million-tweets-500296. CricketCountry Staff. 2015. ICC Cricket World Cup 2015: India-Pakistan a Twitter hit 1.7 million tweets. Cricket Country. Retrieved from https:\/\/www.cricketcountry.com\/criclife\/icc-cricket-world-cup-2015-india-pakistan-a-twitter-hit-1-7-million-tweets-500296."},{"key":"e_1_2_1_59_1","volume-title":"Proceedings of the Language Resources and Evaluation Conference (LREC\u201904)","volume":"4","author":"Strapparava Carlo","year":"2004"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920263"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2012\/04\/P04009"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068840"},{"key":"e_1_2_1_63_1","unstructured":"Twitter. 2020. About unsafe links. Retrieved from https:\/\/help.twitter.com\/en\/safety-and-security\/phishing-spam-and-malware-links. Twitter. 2020. About unsafe links. Retrieved from https:\/\/help.twitter.com\/en\/safety-and-security\/phishing-spam-and-malware-links."},{"key":"e_1_2_1_64_1","volume-title":"The spread of true and false news online. Science 359, 6380","author":"Vosoughi Soroush","year":"2018"},{"key":"e_1_2_1_65_1","volume-title":"Workshop on Making Sense of Microposts","volume":"1395","author":"Wang Bo","year":"2015"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2711424"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2581305"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.49"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966939"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2267732"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2014.2320725"},{"key":"e_1_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2005.857113"}],"container-title":["ACM Transactions on the Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3408894","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3408894","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:47:58Z","timestamp":1750193278000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3408894"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,8,25]]},"references-count":72,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2020,11,30]]}},"alternative-id":["10.1145\/3408894"],"URL":"https:\/\/doi.org\/10.1145\/3408894","relation":{},"ISSN":["1559-1131","1559-114X"],"issn-type":[{"value":"1559-1131","type":"print"},{"value":"1559-114X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,25]]},"assertion":[{"value":"2019-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-06-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-08-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}