Detecting Malicious Apps on OSN Facebook Walls

Abstract

In Online Social Networking (OSN), unfortunately, hackers have realized the potential of using apps for
spreading malware and spam which are harmful to Facebook users. The problem is already significant, as we find that
at least 13% of apps in our dataset are malicious. So far, the research community has focused on detecting malicious
posts and campaigns. In this project, we ask the question to the Facebook user that, given a Facebook application, can
you determine whether that application is malicious? Of course that user couldn’t identify that. So, our key contribution
is in developing “FRAppE—Facebook’s Rigorous Application Evaluator”, arguably the first tool focused on detecting
malicious apps on Facebook. To develop FRAppE, we use information gathered by observing the posting behavior of
111K Facebook apps seen across 2.2 million users on Facebook. First, we identify a set of features that help us
distinguish between malicious apps and benign apps. For example, we find that malicious apps often share names with
other apps, and they typically request little permission than benign apps. Second, leveraging these distinguishing
features, we show that FRAppE can detect malicious apps with 99.5% accuracy, with no false positives and a low false
negative rate (4.1%). Finally, we explore the ecosystem of malicious Facebook apps and identify mechanisms that these
apps use to propagate. Interestingly, we find that many apps collude and support each other; in our dataset, we find
1,584 apps enabling the viral propagation of 3,723 other apps through their posts. Long-term, we see FRAppE as a step
towards creating an independent watchdog for app assessment and ranking, so as to warn Facebook users before
installing apps.