NEIGHBORWATCHER: A Content-Agnostic Comment Spam Inference System

Comment spam has become a popular means for spammers to attract direct visits to target websites, or to manipulate search ranks of the target websites. Through posting a small number of spam messages on each victim website (e.g., normal websites such as forums, wikis, guestbooks, and blogs, which we term as spam harbors in this paper) but spamming on a large variety of harbors, spammers can not only directly inherit some reputations from these harbors but also avoid content-based detection systems deployed on these harbors. To find such qualified harbors, spammers always have their own preferred ways based on their available resources and the cost (e.g., easiness of automatic posting, chances of content sanitization on the website). As a result, they will generate their own relatively stable set of harbors proved to be easy and friendly to post their spam, which we refer to as their spamming infrastructure. Our measurement also shows that for different spammers, their spamming infrastructures are typically different, although sometimes with some overlap. This paper presents NEIGHBORWATCHER, a comment spam inference system that exploits spammers’ spamming infrastructure information to infer comment spam. At its core, NEIGHBORWATCHER runs a graph-based algorithm to characterize the spamming neighbor relationship, and reports a spam link when the same link also appears in the harbor’s clique neighbors. Starting from a small seed set of known spam links, our system inferred roughly 91,636 comment spam, and 16,694 spam harbors that are frequently utilized by comment spammers. Furthermore, our evaluation on real-world data shows that NEIGHBORWATCHER can keep inferring new comment spam and finding new spam harbors every day.