  As the popularity of content sharing websites such as YouTube and Flickr has
increased, they have become targets for spam, phishing and the distribution of
malware. On YouTube, the facility for users to post comments can be used by
spam campaigns to direct unsuspecting users to bogus e-commerce websites. In
this paper, we demonstrate how such campaigns can be tracked over time using
network motif profiling, i.e. by tracking counts of indicative network motifs.
By considering all motifs of up to five nodes, we identify discriminating
motifs that reveal two distinctly different spam campaign strategies. One of
these strategies uses a small number of spam user accounts to comment on a
large number of videos, whereas a larger number of accounts is used with the
other. We present an evaluation that uses motif profiling to track two active
campaigns matching these strategies, and identify some of the associated user
accounts.
