THÈSE en vue d’obtenir le grade de DOCTEUR DE L’UNIVERSITÉ PIERRE ET MARIE CURIE -PARIS 6 (UPMC) spécialité : informatique Laboratoire d’Informatique de Paris 6 École Doctorale Informatique, Télécommunications et Électronique présentée et soutenue publiquement le 21 Mai 2014 par Oana Goga Titre : Matching User Accounts Across Online Social Networks: Methods and Applications Corrélation des profils d’utilisateurs dans les réseaux sociaux : méthodes et applications Directeur de thèse : Mme. Renata Teixeira Inria Rocquencourt Après avis de : Mme. Anne-Marie Kermarrec Inria Rennes M. Jon Crowcroft University of Cambridge Devant la commission d’examen formée de : M. Jon Crowcroft University of Cambridge M. Krishna Gummadi MPI-SWS Mme. Clémence Magnien CNRS Mme. Dina Papagiannaki Telefónica I+D Mme. Renata Teixeira Inria Rocquencourt 2 Acknowledgments I would like to first express my special appreciation and thanks to my advisor Renata Teixeira for her advice and mentoring during my PhD. I am immensely grateful that Renata allowed me to change PhD topic after one year of PhD and gave me the liberty to explore research I am passionate about while supporting me when I needed her help. For me, changing topic was one of the best decisions in my life. It allowed me to work on projects I believe in and projects that I want to continue pursuing in the years to come as a researcher. It also allowed me to discover the focus I want to give to my career. Finally, Renata taught me how to communicate research results effectively and how to make a good presentation. Even if it is still scary, I love giving presentations thanks to you. I would also like to thank Nina Taft and Robin Sommer. Nina advised me at a very confusing time of my PhD, your encouragements helped me in my decision to change PhD topic. I was extremely lucky to meet Robin at the perfect time and start working with him on my first project on privacy and social networks. It was a very exciting and scary time, but Robin gave me his constant support, without you none of the work presented in this thesis would have been possible. Also, Robin sees research projects with an apparent easiness and clearness. This inspired me and I often think “what would Robin say?” whenever I am stuck in a project. I was also super lucky to meet and work with Krishna Gummadi during my PhD. My time at MPI-SWS was the most amazing part of my PhD. Krishna played a big role in my development as a researcher, Krishna taught me how to be bold and go for crazy research projects, how to constantly push my limits and go deeper and understand the essence of a problem. Krishna has amazing ideas and all our discussions were very enriching. Moreover, Krishna’s depth in the field of social networks allowed me to put my work into perspective. Krishna provided for me, and all his students, a very nurturing environment perfect to rise high quality researchers. I will try to provide the same kind of environment for everyone I will work with in the future. I hope I am worthy of the time and efforts Renata, Robin and Krishna invested in me. I want to also thank Anne-Marie Kermarrec and Jon Crowcroft for accepting to review my thesis. Your reports are very precise and your remarks very pertinent. I also want to thank Clémence Magnien, Krishna Gummadi and Dina Papagiannaki for accepting to be in my thesis committee. I am very honored that such distinguished researchers took time to evaluate the work I did during my PhD. i ii I also want to thank my collaborators Gerald Friedland, Howard Lei, Sree Hari Krishnan, Diana Joumblatt, Jaideep Chandrashekar, Giridhari Venkatadri and Bimal Viswanath. It was very fun working with you and I learned a lot from our interactions. I am very grateful to have met amazing people during my stay at LIP6, LINCS, MPI-SWS, ICSI and Technicolor. I build many friendships that I hope will last a lifetime. I want to thank Jean Bolot and Christophe Diot for hosting me in their Technicolor lab in Palo Alto. Thanks to all students and researchers I have met during my stay in different labs I had an excellent time during my PhD. Finally, I would like to thank my affectionate and supportive family for its constant support. I would like to thank my parents for encouraging me to go abroad to continue my education even if this meant being far away from them. Thank you also for inspiring me and showing me that there are no limits and I can pursue whatever I am passionate about. I want to thank “my other half”, Patrick, even if it is hard to do this in only a few sentences. Patrick is the most amazing person I have met and I am very blessed to have him near me. Patrick constantly cheered me when I was down and helped me when I needed advice and aid on my research. Patrick taught me to be strong and push forward when it is hard. I thank you from all my heart for your help in all aspects of my PhD. My warmest thanks to Patrick’s parents, Isabelle and Bernard, who hosted me in their home during my PhD when I had to travel back and forth between Nice, Paris and Saarbrucken. Thanks to you I was able to spend more time with Patrick during my internships. Contents Acknowledgmentsi Abstract vii 1 Introduction1 1.1 Personal data sharing in social networks....................2 1.2 Current techniques to match accounts.....................3 1.3 Privacy and security threats in social networks................4 1.4 Contributions...................................5 1.4.1 Reliable and scalable account matching across social networks....5 1.4.2 Account matching by exploiting innocuous user activities......6 1.4.3 Detection and characterization of impersonators............7 1.5 Organization of the thesis............................7 2 State of the Art9 2.1 Social networks..................................9 2.1.1 Measurement and characterization of social networks.........9 2.1.2 Inferring additional information about users in social networks... 10 2.1.3 Aggregating users’ data across social networks............. 11 2.2 Online privacy.................................. 11 2.2.1 Online tracking and advertising..................... 12 2.2.2 Privacy of online services........................ 12 2.2.3 Privacy of location data......................... 13 2.2.4 Privacy implications of matching and exploiting users’ data..... 15 2.3 Matching entities across data sources...................... 16 2.3.1 Entity resolution............................. 16 2.3.2 Anonymization and de-anonymization of user identities........ 17 2.4 Matching accounts across social networks................... 18 2.4.1 Matching accounts using private user data............... 18 2.4.2 Matching accounts using public user data............... 18 2.5 Security threats in social networks....................... 21 3 Account Matching Framework 25 3.1 The matching problem: definition........................ 25 3.2 The matching problem: challenges....................... 26 iii iv CONTENTS 3.3 The matching problem: scalability and reliability............... 27 3.3.1 The ACID test for scalable and reliable matching........... 27 3.4 Ground truth data................................ 28 3.5 Evaluation method................................ 29 3.5.1 Evaluation metrics............................ 30 3.5.2 Evaluation over a small dataset..................... 30 3.5.3 Evaluation at scale............................ 30 3.5.4 Evaluation against human workers................... 33 3.6 Summary..................................... 33 4 Matching Accounts using Public Profile Attributes 35 4.1 ACID test of public attributes.......................... 36 4.1.1 Attribute availability........................... 36 4.1.2 Attribute consistency........................... 38 4.1.3 Attribute discriminability........................ 40 4.1.4 Attribute impersonability........................ 42 4.2 One-step matching scheme............................ 42 4.2.1 Design of the scheme........................... 42 4.2.2 The Linker .............................. 42 4.2.3 Evaluation over a small dataset..................... 45 4.2.4 Evaluation at scale............................ 45 4.2.5 Evaluation against human workers................... 46 4.3 Three-step matching scheme........................... 50 4.3.1 Design of the scheme........................... 50 4.3.2 The Filter ............................... 51 4.3.3 The Disambiguator ........................ 52 4.3.4 The Guard .............................. 53 4.3.5 Evaluation at scale............................ 55 4.3.6 Evaluation against human workers................... 57 4.4 Testing the reliability of the three-step matching scheme........... 58 4.4.1 Reliability in the absence of a matching account............ 58 4.4.2 Reliability to impersonation....................... 58 4.5 Matching in the wild............................... 59 4.6 Summary..................................... 60 5 Matching Accounts using Public Innocuous Information 63 5.1 Features of innocuous activity.......................... 64 5.2 Location fingerprint............................... 65 5.2.1 Building the fingerprint......................... 65 5.2.2 Similarity metrics............................. 68 5.2.3 Evaluation at scale............................ 68 5.2.4 Implications................................ 70 5.3 Timing fingerprint................................ 71 5.4 Language fingerprint............................... 72 5.5 Combining features................................ 73 5.5.1 Method.................................. 74 5.5.2 Evaluation at scale............................ 74