Analysis on the Security Mechanisms of User Data

Protection in Facebook
Bo Liu
School of computer Science
National University of Defense Technology
Changsha, Hunan 410073-P.R.China
e-mail: boliu615@yahoo.com.cn

Zhefeng Xiao
School of Computer Science
National University of Defense Technology
Changsha, Hunan 410073-P.R.China
e-mail: zhefeng.xiao@gmail.com

Tian Zhang
School of computer Science
National University of Defense Technology
Changsha, Hunan 410073-P.R.China
e-mail: jonathan2012@yahoo.cn

Jienan Cao
School of Computer Science
National University of Defense Technology
Changsha, Hunan 410073-P.R.China
e-mail: James6116@163.com
AbstractAs online social networks are booming in recent years,
their security issues have attracted more and more concerns. The
valuable user data stored in online social networks have been a
battleground to both criminals or attackers and social network
service providers. Considering such a severe competition,
whether the user data are as safe as online social networks have
declared is worth our research. Using facebook as the study case,
we describe in detail the security threats to its user data, as well
as its protection mechanism named facebook immune system.
With elaborated experiments, we analyze in depth and then
verify to some extent the effects of facebook immune system on
preventing the friend request from being used maliciously in
facebook.
Keywordsonline social network, facebook immune system,
user data protection, dynamic security mechanism
I. INTRODUCTION
Online social networks have developed rapidly in recent
years. According to the statistics, by the end of November 2011,
the number of active users in online social networks has
surpassed 1.4 billion[1]. Online social network services have
already become the most popular Internet applications[2], and
their impacts have emerged on political, economic, cultural,
educational fields and so on in real-life[3,4]. Thereby, the
security issues of social networks have attracted more and more
concerns, especially how to protect those large amounts of
privacy data of users stored in online social network sites, such
as the users profiles, social relationships and historical
interactive activities. Making use of these data, for example,
commercial companies would advertise to potential users with
more pertinence accordingly, while network attackers would
accelerate the spread of malicious codes such as trojan horses,
worms or spams based on the social relationships among users
in social networks. In addition, social context built by social
relationships and interactive histories would be used to increase
the probability of network phishing, fraud and other criminal
activities[5].
As the largest online social network in the world, facebook
has more than 800 million active users and its service covers
the majority of countries throughout the world. Furthermore, it
has implemented the major functions and characteristics of the
mainstream online social networks[7]. For the purpose to figure
out whether the security mechanisms of user data protection
adopted by online social networks have achieved the effect as
declared, we have used facebook as our study case to analyze
its extent of protection on user data from malicious activities
though some experiments.
The remainder of the paper will be organized as follows.
The section II introduces some related works to the research of
the paper. The section III expounds the implementation of our
experiments in detail. The section IV analyzes the results of
these experiments in depth to verify the deterrent effect of the
protection on user data from some typical security threats in
facebook. The section V gives some concluding remarks of the
paper.
II. RELATED WORKS
There are no networked systems would be totally
secure. Some potential security threats to online social
networks such as facebook may include the following aspects.
1) The external threats out of facebook. For example, user
accounts in facebook could been hijacked as the result of
unencrypted public wireless LAN[9], or trojans may be used to
crack CAPTCHAs verification and create false user accounts in
facebook[10, 11], and so on.
2) The vulnerabilities when design or implement the
security mechanisms adopted by facebook. For
example, research conducted by J. Bonneau has shown that
search engines such as Google have the ability to acquire a part
of social graph among users without logging to facebook
[12]. Furthermore, the unencrypted data at the transport layer
may lead to FITM attack[13]. In addition, the vulnerabilities of
facebook query language (FQL) may bring about the leak of
social graph among users too[14]. Moreover, the attack named
iCloner, which clones user data between different online social
network sites, will create false user accounts and then send out
friend requests to other normal users to extend the social
groups for these false user accounts[15].
3) The "privacy paradox" of social network. The privacy
paradox means that there is a certain degree of contradiction
- 532 -
between the privacy protection and user experiences in most of
online social networks[7]. In order to maintain a certain level of
user experiences and achieve a balance between privacy
protection and user experiences, most online social networks
may compromise the protection on user privacy, which will
refer some settings for user privacy to make users decide by
themselves whether they will adopt these settings or
not, facebook is not an exception too. Many researchers have
pointed out that the social graph among facebook users could
be obtained in a large scale by the use of web crawlers[14, 16-
18]. These crawlers take advantage of the fact that the default
settings of user privacy in facebook once allowed all users to
access others friends lists. One can solve this problem by
changing his default privacy settings to restrain the access to
these data for strangers, but studies show that only about 26.6%
of the facebook users have changed this privacy setting[16].
To deal with these security issues, facebook has modified
its security mechanisms to some extent. For example, it
abolished the policy on user privacy mentioned above which
allowed non-logged in users acquire part of the others friends
lists. More important, it has built a protection system named
facebook immune system, i.e., FIS, which supervises all of
the real-time activities of facebook users after they logged in, to
achieve timely detection and containment when any of its users
wants to launch an attack to facebook[8]. The FIS is composed
by four part, they are policy engine, classification and strategy
generation module, feature extraction module, and
characteristics or features database. Figure 1 shows the
working principles of FIS. The classification and strategy
generation module is the core of FIS. To achieve a dynamic
security mechanism, it uses some complex machine-learning
algorithms, which based on the feedbacks from both facebook
users and features database, to generate action policies that will
be performed by policy enforcement module, i.e., policy engine.
users
policy
engine
classifiers
and
strategy
generation
module
feature
database
feature
extraction
acIion
reponse
feature
value
feature
value
feature data
IeaIure daIa updaIe
action
data
fetching
feature
data
feature value

Fig. 1. Principle diagram of facebook protection system
[8]
.
Usually, attackers need to detect the security mechanisms
of online social networks before they could acquire the users
data. Compared to static security mechanisms, dynamic
security mechanisms will perform different specific security
policies according to different triggers of security events,
therefore they are more difficult to detect and then they are
more secure. By now, facebook has put most of its user data
into the protection of this immune system. Meanwhile, whether
FIS can implement dynamic security mechanisms effectively
becomes the key of realizing its promise to protect user privacy
well.
The default settings of user privacy in facebook give more
permission to users friends than strangers, for example, to
acquire some sensitive information from a user, such as
telephone number, e-mail address and so on. In addition, some
users have modified the default privacy settings, such as only
allowing friends of them to open their friends lists. In this case,
if an attacker manages to become the friend of a user, he will
threaten the security of some privacy data of the user. Because
the first step of becoming ones friend in facebook is to send
out friend request to the aimed user, it is an important point
whether FIS could prevent the friend request from used
maliciously in facebook.
III. IMPLEMENTATION AND ALGORITHM
A. Ideas of the experiments
In our research, we mainly analyze the potential responses
of FIS towards friend request in depth through the serial of
elaborated experiments. We have registered four facebook
users manually and marked them as U
1
, U
2
, U
3
, and U
4
. Before
the experiments start, the initial states of these four users are
shown in table I.
TABLE I. INITIAL STATES OF EXPERIMENT USERS
User
History of
using
(months)
The number
of friends
Interactive
frequency
U1 10 213 Frequently
U2 10 29 Seldom
U3 10 0 Never
U4 0 0 Never
Then we program with JAVA to analog the actions of
sending our friend requests to other users after logged in
facebook using these four users respectively. The frequency of
the action to send our friend request is adjustable on demand.
Because CAPTCHAs validation could distinguish program
behaviors from real personal uses effectively, we achieve
CAPTCHAs verification manually in our experiments. At the
same time, Friends finding is an important service of
facebook, which will recommend other users with whom the
requester might want to make friends. This service bases on
users profile, as well as whether they have mutual friends. Our
experiments have shown, sending our friend request too
quickly or too much will trigger the responses of FIS, which
will then block the request user temporarily according to
different dynamic policies. Based on tracking the figures of
these experiments, we have analyzed part of the security
mechanisms on user data protection of FIS. In addition, to
ensure users privacy, we have deleted all of these four users
after our experiments.


- 533 -
B. Algorithm of implementation
ALGORITHM 1THE PSEUDO CODE OF PROGRM ALGORITHM
1. Opening a facebook page;
2. Using an test user to login in facebook;
3. Setting the frequency of sending out friend request;
4. Opening the friends finding page;
5. if (friends finding service is used) then
6. Step 1:
7. Scanning the user accounts which recommended
automatically by the page in order;
8. Adding these user accounts into the queue of
waiting to send out friend request ;
9. Sending out friend request to aimed user ;
10. if (intercept or prompted for
the CAPTCHAs verification code) then
11. Aloud a sound and pop-up an dialog box to be
handled manually;
12. Goto Step 3;
13. Step 2:
14. /* friends finding service not used*/
15. Modify the search conditions and re-search aimed
users;
16. Goto step 1 until sending out friend request been
forbidden;
17. Step 3:
18. Cancellation of the current login account;
19. Change user account to log in again;
20. Re-set the frequency of sending out friend request;
21. Goto step 1 until sending out friend request been
forbidden;
IV. EXPERIMENTS AND ANALYSIS
A. Statements of the symbols
F: The frequency of sending friend request (times/min);
Y: Friends finding service is used;
N: Friends finding service is not used;
i: times of FIS warnings or interception occurrences before
the test account being blocked;
R
i:
The number of friend requests that have been sent out
when the warnings or interception occurred i times;
R
i
: The total number of the friend requests which have
sent out in the experiments;
S: The StDev (standard deviation) of R
i
;
S ': The StDev (standard deviation) of R
i
;
M: The time (days) of a user account been blocked for
sending out too many friend requests. As M changes
dynamically in the experiments, we represent it using
codomain.
In the experiments, Y, N, F, U1, U2, U3 and U4 are
variable, while i, Ri and M are be detected and analyzed in the
paper.
B. Results and analysis
The major difficulties confronted while analyzing the
security mechanisms of FIS are that the experiment results may
be affected by a variety of factors, and the weight of these
factors may be different as well. In order to distinguish the
effects of these factors and their weight, we adopted statistical
methods to analyze. R
i
is the key indicators to measure the
FIS. In order to avoid the interferences of other factors as much
as possible, average value of R
i
is calculated and compared
instead of R
i
directly. And we introduced the standard
deviation to measure the range of variation while the thresholds
of FIS dynamic security mechanisms are changed.
Considering Ri represents the number of friend requests that
have been sent out when the warnings or interception occur
i times, and FIS would use CAPTCHAs verification to block
the test account, by increasing the variation range of R
i
, we
may distinguish the normal usage from malicious activities.
The experimental results are shown as figure 2 to figure 4,
and table II. From these results, we may indicate that
the security mechanisms of FIS, which prevent malicious usage
of friend request, would be influenced mainly by the following
factors.
5 10 15 20 25 30 35 40 45 50 55
0
20
40
60
80
100
120
140
160
i (F=30 , U
1
)
R
i


N R
i
=28 i=7 M=2
Y R
i
=232 i=51 M=2

(a)
0 10 20 30 40 50
20
40
60
80
100
120
140
160
180
200
i ( F=6 , U
3
)
R
i


N R
i
=72 i=6 M=2
Y R
i
=239 i=55 M=2

(b)
Fig. 2. The influence of Friends finding service
(a) F=30,U1; (b)F=6,U3.
1) The influence of Friends finding service. The use of
Friends finding service can be an important reference to
distinguish the nature whether the friend request is used
normally or not. Shown directly by the experimental
results, under the condition that the service is used, the value
of

has increased up to 186 %, and the standard deviation
of

decreased 651%. Which means that despite the total
number and rangeability of the friend requests could be sent
- 534 -
out, FIS would like to adopt more stringent security check in
the case of Friends finding service not used. In addition, the
experiments also show that in this case, if a test user send out
too much friend requests, this user account may be forced to
logout, and before it can logon next time, some stronger
security authentication credentials are requested, such as
phone number, security questions and so on.
TABLE II. STATE AND STATISTICS PARAMETES

2) The influence of user backgrounds. The two sets of
comparative experimental results indicate that under the same
conditions, the effect of different user backgrounds on the
sercurity mechanisms of FIS is not significant statistically,
such as

,S' and R
i
. However, as shown in figure 3, the
variations of their R
i
are quite different, the reason of which is
waiting for further analysis.
R5 R15 R25 R35 R45 R55
20
40
60
80
100
120
140
160
180
200
i F=6 , Y
R
i


U
1
R
i
=230 i=53 M=(2,7)
U
2
R
i
=239 i=52 M=2

(a)
1 2 3 4 5 6 7 8
0
10
20
30
40
50
60
70
iF=2 , N
R
i


U
3
R
i
=105 i=6 M=2
U
4
R
i
=127 i=8 M=(2,14)

(b)
Fig. 3. The influence of different user backgrounds
(a) F=6, Y; (b) F=2, N.
0 10 20 30 40 50
20
40
60
80
100
120
140
160
180
i (Y, U
4
)
R
i


F=6 R
i
=242 i=52 M=2
F=30 R
i
=233 i=52 M=(2,7)

(a)
1 2 3 4 5 6 7 8
0
10
20
30
40
50
60
70
i (N, U
4
)
R
i


F=6 R
i
=68 i=8 M=2
F=2 R
i
=127 i=8 M=(2,14)
F=1 R
i
=50 i=5 M=4

(b)
Fig. 4. The influence of frequency to send out friend request
(a) Y, U4; (b) N, U4
3) The influence of frequency. Shown as the results, the
frequency to send out friends request has little effect on the
value of i and R
i
when theFriends finding service is used.
So in order to eliminate the influence of Friends finding
service , the R
i
and

of not using the service are chosen

as the analytic object. In addition, base on the analysis of user
backgrounds, we ignore the impact of different backgrounds
on the statistical results. Then, the statistical results show that

does not always increase with the decrease of frequency

to send out friend request all the time. For the purpose of
network security, it is as important to defeat those low rate
- 535 -
attacks as the fast rate attacks, so FIS has achieved the
deterrent effect on low rate attacks to some extent
already. During the experiments, The maximum value of

and

both appeared when the frequency is 2 times per

minute, which is similar to the action of normal user to send
out friend request. Indicating that based on the analysis of user
behavior, FIS could identify the normal user behavior from the
malicious attacks effectively.
4) The influence of user feedback. FIS also takes the
feedbacks from users as an important reference for its security
mechanisms. Our experimental results show that FIS will
adjust the lasting time of a blocked test user account after
enough feedbacks of other users are gathered. (in our
experiments, mainly the rate of friend requests sent out to be
accepted).
C. Discussion
The external environment of facebook is not secure. The
weakness either of the operating systems or of the network
communication could become the potential security threats for
the users data stored in online social networks. As attackers
might exploit vulnerabilities of the external environment to
hijack legal user account of facebook, the Facebook Immune
System has the capability to detect and respond to the attacks in
a short time. The experiments introduced in section IV verified
the dynamic security mechanisms of FIS to some extent. With
the continuous accumulation of data on user behavior
characteristics and the improvement of machine learning
algorithms, we think that FIS would protect user data,
especially privacy data more effectively.
V. CONCLUSION
It is worth notice that security is a relative concept, as
network attackers will explore any potential weakness of
networked systems by all means. To secure user data in
facebook or other online social networks, the participation of
their users are essential. Our analysis of FIS shows that
inappropriate settings of user privacy may result in the failure
of some protective measures. Meanwhile, users should provide
proper feedbacks to online social networks, such as treat the
friend requests from strangers more alertly, and check the
personal information and historical activities of senders before
accepting their requests. Furthermore, it is the responsibility of
online social networks to remind their users of the potential
security risks caused by those inappropriate settings of user
privacy.
Moreover, our research would next address these two points:
First, try to collect more samples to reduce the mutual effects
among different factors. Second, select some new experimental
objects, such as phishing e-mail, web crawler, to compare the
deterrent effects of FIS on different attacks.
ACKNOWLEDGMENT
We would like to thank the National Nature Science
Foundation of China with grant No.90818028 for their supports
to our works.
REFERENCES
[1] ComScore: Google + Grows Worldwide Users From 65 Million In
October To 67 Million In November. http://
techcrunch.com/2011/12/22/googlesplus /? Utm_source = feedburner &
utm_medium = feed & utm_campaign = Feed% 3A + Techcrunch +%
28TechCrunch% 29, 2011.
[2] http://goarticles.com/article/Social-network-first-run-win-the-search-
engine/5686840/.
[3] O. Folorunso, R. O. Vincent, A. F. Adekoya and A.
O. Ogunde, Diffusion of Innovation in Social network Sites among
University Students, International Journal of Computer Science and
Security (IJCSS), Volume(4): Issue (3).
[4] C. White, L. Plotnick and J. Kushmam, An Online Social Network for
Emergency Management, in Proceedings of the 6th International
ISCRAM Conference, Gothenburg, Sweden, 2009.
[5] T. Jagatic, N. Johnson, M. Jakobsson and F. Menczer, Social Phishing,
Communications of the ACM, 2005.
[6] M. Huber, M. Mulazzani and E. Weippl, Social network sites security:
Quo Vadis, in Proceedings of the 2nd International Conference on
Social Computing (SocialCom), 2010, pp.1117-1122.
[7] http://www.facebook.com
[8] T. Stein, E. Chen and K. Mangla, Facebook Immune System, EuroSys
Social Network Systems (SNS), Salzburg, France, 2011.
[9] M. Huber, M. Mulazzani and E. Weippl, Who On Earth Is "Mr.
Cypher": Automated Friend Injection Attacks on Social network Sites,
eweipplg@sba-research.org.
[10] TrendMicro, The real face of koobface, Technical report, 2009.
[11] E. Anthanasopolous, A. Makridakias, S. Antonatos, D. Antoniades, S.
Ioannidis, KG Anagnostakis and EP Markatos, Antisocial networks:
Turning a social network into a botnet, In ISC '08, 2008.
[12] J. Bonneau, J. Anderson, F. Stajano and R. Anderson, Eight Friends
Are Enough: Social Graph Approximation via Public Listings, ACM
978-1-60558-463-8, 2009.
[13] M. Huber, M. Mulazzani, G. Kitzler, S. Goluch and E. Weippl, Friend-
in-the-middle Attacks: Exploiting Social network Sites for Spam, 2011.
[14] J. Bonneau, J. Anderson and G. Danezis, Prying Data out of a Social
Network, Asonam09, 2009.
[15] L. Bilge, T. Strufe, D. Balzarotti and E. Kirda, All Your Contacts Are
Belong to Us: Automated Identity Theft Attacks on Social Networks,
WWW 2009, Madrid, Spain, 2009.
[16] S. A. Catanese, P. De Meo and E. Ferrara, Crawling Facebook for
Social Network Analysis Purposes, ACM 978-1-4503-0148-0/11/05,
2011.
[17] S. Z. Ye, J. Lang and F. Wu, Crawling Online Social Graphs,
Department of Computer Science University of California, Davis
sye@ucdavis.edu
[18] S. Alim, R. Abdul-Rahman, D. Neagu and Mick Ridley, Data Retrieval
from Online Social Network Profiles for Social Engineering
Applications, The Institute of Electrical and Electronics Engineers,
Technical Report, 2009.

- 536 -