Detecting Hacked Twitter Accounts by Examining Behavioural Change using Twitter Metadata

Social media accounts are valuable for hackers for spreading phishing links, malware and spam. Furthermore, some people deliberately hack an acquaintance to damage his image. In this paper, a classification model is described for detecting these hacked Twitter accounts by examining changing features in behaviour. We look at changes in language, source, URL, retweets, frequency and time. Our model recognizes 99% of the malicious tweets when tested on a Twitter data set containing tweets of more than 100 Dutch users. We used the J48 machine learning algorithm, which proved to give better results than the SMO algorithm. The model proves that behavioural changes can reveal a hack and performs better than just using raw data for classification. The model could assist Twitter in detecting hacked accounts more precisely. Moreover, with the use of this algorithm the legitimate owner of the account and its followers can be warned that the account may be hacked, preventing more annoyances and reputational damage.