{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,28]],"date-time":"2025-09-28T20:37:45Z","timestamp":1759091865051},"reference-count":24,"publisher":"SAGE Publications","issue":"2","license":[{"start":{"date-parts":[[2017,2,1]],"date-time":"2017-02-01T00:00:00Z","timestamp":1485907200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Distributed Sensor Networks"],"published-print":{"date-parts":[[2017,2]]},"abstract":"<jats:p> Server-side socialbot detection approaches can identify malicious accounts and spams in online social networks. However, they cannot detect socialbot processes, residing on user hosts, which control these accounts. Therefore, new approaches are needed to detect socialbots on hosts. The fundamental to design host-side detecting approaches is to gain an insight into the behaviors of socialbots on host. In this article, we analyzed a series of representative socialbots in depth and summarized the typical features of socialbot behaviors. We proposed a new approach to defense against socialbots on end host. The contributions of this article are threefold: (1) our analysis approach can be used for reference during analyzing new socialbots in the future; (2) we provide several behavior features of socialbots on hosts, including network flow through which socialbots communicate with botmasters through the online social network, system calls via which socialbots conduct an activity, and process information of socialbots running on hosts. These features can be used by someone to design approaches to identifying socialbots on a host; (3) our proposed detection approach can effectively distinguish between a socialbot and a benign application on end hosts. <\/jats:p>","DOI":"10.1177\/1550147717694170","type":"journal-article","created":{"date-parts":[[2017,2,22]],"date-time":"2017-02-22T13:06:57Z","timestamp":1487768817000},"page":"155014771769417","update-policy":"http:\/\/dx.doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":4,"title":["Understanding socialbot behavior on end hosts"],"prefix":"10.1177","volume":"13","author":[{"given":"Yukun","family":"He","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Jilin University, Changchun, China"},{"name":"Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University, Changchun, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiang","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Jilin University, Changchun, China"},{"name":"Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University, Changchun, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jian","family":"Cao","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Jilin University, Changchun, China"},{"name":"Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University, Changchun, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuede","family":"Ji","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Jilin University, Changchun, China"},{"name":"Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University, Changchun, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dong","family":"Guo","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Jilin University, Changchun, China"},{"name":"Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University, Changchun, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2017,2,22]]},"reference":[{"issue":"9","key":"bibr3-1550147717694170","first-page":"10","volume":"5","author":"Baltazar J","year":"2009","journal-title":"Trend Micro Res"},{"key":"bibr6-1550147717694170","first-page":"511","volume-title":"Proceedings of the 8th international conference on applied cryptography and network security (ACNS)","author":"Kartaltepe EJ"},{"key":"bibr7-1550147717694170","first-page":"299","volume-title":"Proceedings of the 13th international conference of information hiding (IH) (Lecture notes in computer science","volume":"6958","author":"Nagaraja S"},{"key":"bibr9-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.06.006"},{"issue":"6","key":"bibr10-1550147717694170","first-page":"11","volume":"5","author":"Singh A","year":"2013","journal-title":"Int J Comput Netw Inf Secur"},{"key":"bibr11-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.10.005"},{"key":"bibr12-1550147717694170","first-page":"299","volume-title":"Proceedings of the 13th international conference of information hiding (IH)","author":"Nagaraja S"},{"key":"bibr14-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.06.019"},{"key":"bibr15-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.07.016"},{"key":"bibr16-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.02.004"},{"key":"bibr21-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.07.021"},{"key":"bibr31-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1111\/j.1469-8137.1912.tb05611.x"},{"key":"bibr33-1550147717694170","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2010-0410"},{"key":"bibr34-1550147717694170","first-page":"78","volume-title":"Proceedings of the first workshop on building analysis datasets and gathering experience returns for security","author":"Rossow C"},{"key":"bibr35-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.06.022"},{"key":"bibr36-1550147717694170","first-page":"339","volume-title":"Proceedings of the 28th annual computer security applications conference (ACSAC)","author":"Graziano M"},{"key":"bibr37-1550147717694170","volume-title":"Proceedings of the 20th USENIX security symposium","author":"Jacob G"},{"key":"bibr38-1550147717694170","first-page":"321","volume-title":"Proceedings of the twenty-fifth annual computer security applications conference (ACSAC)","author":"Park YH"},{"key":"bibr39-1550147717694170","first-page":"95","volume-title":"Proceedings of the 19th USENIX security symposium","author":"Nagaraja S"},{"key":"bibr40-1550147717694170","first-page":"2400","volume-title":"Proceedings of the IEEE INFOCOM 2013","author":"Xue J"},{"key":"bibr41-1550147717694170","first-page":"1","volume-title":"Proceedings of the IEEE 9th international conference on intelligent systems and control (ISCO)","author":"Shanthi K"},{"key":"bibr42-1550147717694170","first-page":"171","volume-title":"Proceedings of the 31st annual computer security applications conference","author":"Pantic N"},{"issue":"9","key":"bibr43-1550147717694170","first-page":"121","volume":"13","author":"Ibrahim LM","year":"2015","journal-title":"Int J Comput Sci Inf Secur"},{"key":"bibr44-1550147717694170","doi-asserted-by":"publisher","DOI":"10.1145\/2818717"}],"container-title":["International Journal of Distributed Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/1550147717694170","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/1550147717694170","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/1550147717694170","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,1,4]],"date-time":"2021-01-04T20:52:12Z","timestamp":1609793532000},"score":1,"resource":{"primary":{"URL":"http:\/\/journals.sagepub.com\/doi\/10.1177\/1550147717694170"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,2]]},"references-count":24,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2017,2]]}},"alternative-id":["10.1177\/1550147717694170"],"URL":"https:\/\/doi.org\/10.1177\/1550147717694170","relation":{},"ISSN":["1550-1477","1550-1477"],"issn-type":[{"value":"1550-1477","type":"print"},{"value":"1550-1477","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,2]]}}}