# Towards Detecting Compromised Accounts on Social Networks

arXiv: https://arxiv.org/abs/1509.03531 · HTML: https://mlsanity.com/paper/1509.03531/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Sep 2015.

## Built on by (most cited first, 3 of 3)

- [Compromised account detection using authorship verification: a novel approach](https://mlsanity.com/paper/2206.03581/) (2022)
- [FENCE: Fairplay Ensuring Network Chain Entity for Real-Time Multiple ID Detection at Scale In Fantasy Sports](https://mlsanity.com/paper/2310.05651/) (2023)
- [Beyond Content: Behavioral Policies Reveal Actors in Information Operations](https://mlsanity.com/paper/2602.02838/) (2026)

## Abstract (arXiv)

Compromising social network accounts has become a profitable course of action for cybercriminals. By hijacking control of a popular media or business account, attackers can distribute their malicious messages or disseminate fake information to a large user base. The impacts of these incidents range from a tarnished reputation to multi-billion dollar monetary losses on financial markets. In our previous work, we demonstrated how we can detect large-scale compromises (i.e., so-called campaigns) of regular online social network users. In this work, we show how we can use similar techniques to identify compromises of individual high-profile accounts. High-profile accounts frequently have one characteristic that makes this detection reliable -- they show consistent behavior over time. We show that our system, were it deployed, would have been able to detect and prevent three real-world attacks against popular companies and news agencies. Furthermore, our system, in contrast to popular media, would not have fallen for a staged compromise instigated by a US restaurant chain for publicity reasons.