Abstract
Online Social Networks (OSNs) have become a primary area of interest for cutting-edge cybersecurity applications, due to their ever increasing popularity and to the variety of data their interaction models allow for. In this perspective, most of the existing anomaly detection techniques rely on models of normal users' behaviour as defined by domain experts. However, the identification of “bad” behaviour as a probable deviation of normality still remains an open issue. Here, we propose a method for identifying human behaviour in a social network, based on a “two-step” detection strategy. In particular, we first train Markov chains on a certain number of models of normal human behaviour from social network data; then, we exploit an activity detection framework to identify unexplained activities on the basis of the normal behaviour models. Finally, the validity of our approach is tested through a set of experiments run on data extracted from Facebook. © 2017 Elsevier Ltd