FaceTrust: Collaborative Threat Mitigation Using Social Networks

Unwanted traffic mitigation can be broadly classified into two main approaches: a) centralized security infrastructures that rely on a limited number of trusted monitors to detect and report malicious traffic; and b) highly distributed systems that leverage the experiences of multiple nodes within distinct trust domains. The first approach offers limited threat coverage and slow response times. The second approach is not widely adopted, partly due to the lack of guarantees regarding the trustworthiness of nodes that comprise the system. Our proposal, FaceTrust, aims to achieve the trustworthiness of centralized security services and the wide coverage and responsiveness of large-scale collaborative threat mitigation. FaceTrust is a large-scale peer-to-peer system designed to rapidly propagate behavioral reports concerning Internet entities (e.g., hosts, email signatures etc.). A FaceTrust node builds trust for its peers by auditing their behavioral reports and by leveraging the social network of FaceTrust administrators. A FaceTrust node combines the confidence its peers have in their own reports and the trust it places on its peers to derive the likelihood that the entity is malicious (e.g. being a spam bot). The simulation-based evaluation of our approach indicates its potential under a real-world deployment: during a simulated spam campaign, FaceTrust nodes characterized 71% of spam bot connections as such with confidence greater than 75%.