  Online Social Networks (OSNs) witness a rise in user activity whenever an
event takes place. Malicious entities exploit this spur in user-engagement
levels to spread malicious content that compromises system reputation and
degrades user experience. It also generates revenue from advertisements,
clicks, etc. for the malicious entities. Facebook, the world's biggest social
network, is no exception and has recently been reported to face much abuse
through scams and other type of malicious content, especially during news
making events. Recent studies have reported that spammers earn $200 million
just by posting malicious links on Facebook. In this paper, we characterize
malicious content posted on Facebook during 17 events, and discover that
existing efforts to counter malicious content by Facebook are not able to stop
all malicious content from entering the social graph. Our findings revealed
that malicious entities tend to post content through web and third party
applications while legitimate entities prefer mobile platforms to post content.
In addition, we discovered a substantial amount of malicious content generated
by Facebook pages. Through our observations, we propose an extensive feature
set based on entity profile, textual content, metadata, and URL features to
identify malicious content on Facebook in real time and at zero-hour. This
feature set was used to train multiple machine learning models and achieved an
accuracy of 86.9%. The intent is to catch malicious content that is currently
evading Facebook's detection techniques. Our machine learning model was able to
detect more than double the number of malicious posts as compared to existing
malicious content detection techniques. Finally, we built a real world solution
in the form of a REST based API and a browser plug-in to identify malicious
Facebook posts in real time.
