Integro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs

By Yazan Boshmaf, Dionysios Logothetis, Georgos Siganos, Jorge Lería, José Lorenzo, Matei Ripeanu, Konstantin Beznosov. 2015

149 citations recorded by the source corpus.

Detecting fake accounts in online social networks (OSNs) protects OSN operators and their users from various malicious activities. Most detection mechanisms attempt to predict and classify user accounts as real (i.e., benign, honest) or fake (i.e., malicious, Sybil) by analyzing user-level activities or graph-level structures. These mechanisms, however, are not robust against adversarial attacks in which fake accounts cloak their operation with patterns resembling real user behavior. We herein demonstrate that victims, benign users who control real accounts and have befriended fakes, form a distinct classification category that is useful for designing robust detection mechanisms. First, as attackers have no control over victim accounts and cannot alter their activities, a victim account classifier which relies on user-level activities is relatively harder to circumvent. Second, as fakes are directly connected to victims, a fake account detection mechanism that integrates victim prediction into graphlevel structures is more robust against manipulations of the graph. To validate this new approach, we designed Integro, a scalable defense system that helps OSNs detect fake accounts using a meaningful a user ranking scheme. Integro starts by predicting victim accounts from user-level activities. After that, it integrates these predictions into the graph as weights, so that edges incident to predicted victims have much lower weights than others. Finally, Integro ranks user accounts based on a modified random walk that starts from a known real account. Integro guarantees that most real accounts rank higher than fakes so that OSN operators can take actions against low-ranking fake accounts. We implemented Integro using widely-used, open-source distributed computing platforms in which it scaled nearly linearly. We evaluated Integro against SybilRank, the state-of-the-art in fake account detection, using real-world datasets and a largescale deployment at Tuenti, the largest OSN in Spain. We show that Integro significantly outperforms SybilRank in user ranking quality, where the only requirement is to employ a victim classifier is better than random. Moreover, the deployment of Integro at Tuenti resulted in up to an order of magnitude higher precision in fake accounts detection, as compared to SybilRank.

Subfields: Computer Networks and Communications, Information Systems, Statistical and Nonlinear Physics

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Statistical and Nonlinear Physics

Citations in the corpus

Attacking Graph-based Classification via Manipulating the Graph Structure (2019, methodology): “r reputation scores, assign/learn the edge weights, and propagate the prior reputation scores. In particular, state-of-the-art collective classification methods include Random Walk (RW) based methods [9, 10, 30, 36, 40, 72, 74, 76], Loopy Belief Propagation (LBP) based methods [1, 14, 23, 25, 47, 59”
SybilBlind: Detecting Fake Users in Online Social Networks without Manual Labels (2018, methodology): “This assumption is required by all previous structurebased methods [39,38,8,26,7,36,6,14,30,33] except Íntegro [6].”
CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks (2015, background): “Second, graph-based methods [9, 10, 13, 30, 36, 37] detect malicious accounts by using the observation that malicious accounts usually have few connections with normal accounts.”
SybilFuse: Combining Local Attributes with Global Structure to Perform Robust Sybil Detection (2018, methodology): “For INT , we further sample 50 victims and 50 non-victims to learn a victim predictor based on Random Forest algorithm [19].”
Random Walk Based Fake Account Detection in Online Social Networks (2017, background): “Rank [10] and Íntegro [12] do not satisfy requirements 1) and 2).”
Structure-Based Sybil Detection in Social Networks via Local Rule-Based Propagation (2018, methodology): “State-of-the-art RW-based methods [8], [12], [13], [14] first assign prior reputation scores for every node using a training dataset.”
Graph-based Security and Privacy Analytics via Collective Classification with Joint Weight Learning and Propagation (2018, methodology): “We note that ´Integro [14] has a similar accuracy at detecting Sybils in Tuenti.”
SybilSCAR: Sybil detection in online social networks via local rule based propagation (2017, methodology): “In RW-based methods [12], [13], [14], edge weights model the relative importance (e.”