Uncovering social network sybils in the wild
- 2 November 2011
- conference paper
- conference paper
- Published by Association for Computing Machinery (ACM)
- p. 259-268
- https://doi.org/10.1145/2068816.2068841
Abstract
Sybil accounts are fake identities created to unfairly increase the power or resources of a single malicious user. Researchers have long known about the existence of Sybil accounts in online communities such as file-sharing systems, but they have not been able to perform large-scale measurements to detect them or measure their activities. In this article, we describe our efforts to detect, characterize, and understand Sybil account activity in the Renren Online Social Network (OSN). We use ground truth provided by Renren Inc. to build measurement-based Sybil detectors and deploy them on Renren to detect more than 100,000 Sybil accounts. Using our full dataset of 650,000 Sybils, we examine several aspects of Sybil behavior. First, we study their link creation behavior and find that contrary to prior conjecture, Sybils in OSNs do not form tight-knit communities. Next, we examine the fine-grained behaviors of Sybils on Renren using clickstream data. Third, we investigate behind-the-scenes collusion between large groups of Sybils. Our results reveal that Sybils with no explicit social ties still act in concert to launch attacks. Finally, we investigate enhanced techniques to identify stealthy Sybils. In summary, our study advances the understanding of Sybil behavior on OSNs and shows that Sybils can effectively avoid existing community-based Sybil detectors. We hope that our results will foster new research on Sybil detection that is based on novel types of Sybil features.Keywords
This publication has 13 references indexed in Scilit:
- Detecting spammers on social networksPublished by Association for Computing Machinery (ACM) ,2010
- Measuring the mixing time of social graphsPublished by Association for Computing Machinery (ACM) ,2010
- Detecting and characterizing social spam campaignsPublished by Association for Computing Machinery (ACM) ,2010
- An analysis of social network-based Sybil defensesPublished by Association for Computing Machinery (ACM) ,2010
- What is Twitter, a social network or a news media?Published by Association for Computing Machinery (ACM) ,2010
- SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks2008 IEEE Symposium on Security and Privacy (SP 2008), 2008
- Low-resource routing attacks against torPublished by Association for Computing Machinery (ACM) ,2007
- An Empirical Study of Collusion Behavior in the Maze P2P File-Sharing SystemPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2007
- SybilGuardPublished by Association for Computing Machinery (ACM) ,2006
- The sybil attack in sensor networksPublished by Association for Computing Machinery (ACM) ,2004