Uncovering social network sybils in the wild

By Zhi Yang, Christo Wilson, Xiao Wang, Tingting Gao, Ben Y. Zhao, Yafei Dai. ACM/SIGCOMM Internet Measurement Conference, 2011

461 citations recorded by the source corpus.

Sybil accounts are fake identities created to unfairly increase the power or resources of a single user. Researchers have long known about the existence of Sybil accounts in online communities such as file-sharing systems, but have not been able to perform large scale measurements to detect them or measure their activities. In this paper, we describe our efforts to detect, characterize and understand Sybil account activity in the Renren online social network (OSN). We use ground truth provided by Renren Inc. to build measurement based Sybil account detectors, and deploy them on Renren to detect over 100,000 Sybil accounts. We study these Sybil accounts, as well as an additional 560,000 Sybil accounts caught by Renren, and analyze their link creation behavior. Most interestingly, we find that contrary to prior conjecture, Sybil accounts in OSNs do not form tight-knit communities. Instead, they integrate into the social graph just like normal users. Using link creation timestamps, we verify that the large majority of links between Sybil accounts are created accidentally, unbeknownst to the attacker. Overall, only a very small portion of Sybil accounts are connected to other Sybils with social links. Our study shows that existing Sybil defenses are unlikely to succeed in today's OSNs, and we must design new techniques to effectively detect and defend against Sybil attacks.

Subfields: Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/82a82e11f23b908385ca214b6dd94906e078ecb4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

Citations in the corpus

The Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race (2017, background): “…implemented this solution 2012 Xie et al. [43] 2012 C. Yang et al. [44] 2013 Wang et al. [42] 2013 S. Lee et al. [27, 28] 2013-14 Z. Yang et al. [45] 2014 Liu et al. [30] 2014 Paradise et al. [32] 2014 Cresci et al. [12, 13] 2014-15 Ferrara et al. [7, 15] 2014-16 This table does not aim to be…”
The rise of social bots (2014, methodology): “The Renren Sybil detector [Wang et al. 2013a; Yang et al. 2014] is an example of system that explores multiple dimensions of users’ behaviors like activity and timing information.”
CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks (2015, methodology): “First, detection methods based on account-based features [12,17,23,34,35] inspect the characteristic of individual account, e.g., the number of friends, the number of posts, and age.”
SybilBelief: A Semi-Supervised Learning Approach for Structure-Based Sybil Detection (2013, background): “[19] showed that the friendship network in RenRen, the largest online social networking site in China, does not satisfy this assumption, and thus structure-based approaches should not be applied to such friendship networks.”
Bots increase exposure to negative and inflammatory content in online social systems (2018, unknown): “A great deal of research aims to address this issue, including our own efforts [1,2] and others’ [3-6].”
SybilBlind: Detecting Fake Users in Online Social Networks without Manual Labels (2018, background): “Among various approaches, structure-based ones [39,38,8,26,37,7,33,36,6,14,11,30,18,28] have demonstrated promising results.”
Aiding the Detection of Fake Accounts in Large Scale Social Online Services (2012, unknown): “Automated feature-based Sybil detection [55] (e.”
False Information on Web and Social Media: A Survey (2018, background): “Similarly, sybil accounts in communication and social networks are created to integrate themselves well into the network and prevent detection in order to increase their influence over others [113].”
Contrast Pattern-Based Classification for Bot Detection on Twitter (2019, methodology): “Recently, in [14] a follow-up to [39], authors compare their method against Bot or Not [28], [33], [36], [40], the bots countermeasures implemented by Twitter, and a set of human”
Combating Attacks and Abuse in Large Online Communities (2016, methodology): “As of 2015, Facebook has conservatively estimated that there are at least 170 million Sybils on their service, counting for almost 10% of the Facebook population [27].”
Strength in Numbers: Robust Tamper Detection in Crowd Computations (2015, background): “Existing Sybil defenses have mostly taken the approach of detecting individual Sybils [15, 36, 37, 41], enabling the operator to either sus-pend the Sybils or nullify their contribution to the crowd computation.”
Graph-based Security and Privacy Analytics via Collective Classification with Joint Weight Learning and Propagation (2018, background): “On a directed graph, RW-N [26] (or RW-P [12], [27]) shares a fraction of node u ’s current reputation score to each outgoing (or incoming) neighbor, where the fraction is the edge weight divided by the total weights of u ’s outgoing (or incoming) edges.”
Online Human-Bot Interactions: Detection, Estimation, and Characterization (2017, methodology): “These studies focus on collecting large-scale data to either cluster behavioral patterns of users (Wang et al. 2013a) or classify accounts using supervised learning techniques (Yang et al. 2014; Lee, Eoff, and Caverlee 2011).”
Serf and turf: crowdturfing for fun and profit (2011, background): “Categories and Subject Descriptors H.3.5 [Information Storage and Retrieval]: Online Information Services-Web-based services; J.4 [Computer Applications]: Social and Behavioral Sciences General Terms Measurement, Security, Economics Keywords Crowdturfing, Crowdsourcing, Spam, Sybils, Experimentation”