Uncovering Social Network Sybils in the Wild
Zhi Yang
Christo Wilson
Xiao Wang
Tingting Gao
Ben Y. Zhao
Yafei Dai
ACM Transactions on Knowledge Discovery from Data (TKDD), Vol. 8, No. 1, February 2014
[Full Text in PDF Format, 1.5MB]
Paper Abstract
Sybil accounts are fake identities created to unfairly increase the power or
resources of a single malicious user. Researchers have long known about the
existence of Sybil accounts in online communities such as file-sharing systems,
but they have not been able to perform large-scale measurements to detect them
or measure their activities. In this article, we describe our efforts to detect,
characterize, and understand Sybil account activity in the Renren Online Social
Network (OSN). We use ground truth provided by Renren Inc. to build
measurement-based Sybil detectors and deploy them on Renren to detect more than
100,000 Sybil accounts. Using our full dataset of 650,000 Sybils, we examine
several aspects of Sybil behavior. First, we study their link creation behavior
and find that contrary to prior conjecture, Sybils in OSNs do not form
tight-knit communities. Next, we examine the fine-grained behaviors of Sybils on
Renren using clickstream data. Third, we investigate behind-the-scenes collusion
between large groups of Sybils. Our results reveal that Sybils with no explicit
social ties still act in concert to launch attacks. Finally, we investigate
enhanced techniques to identify stealthy Sybils. In summary, our study advances
the understanding of Sybil behavior on OSNs and shows that Sybils can
effectively avoid existing community-based Sybil detectors. We hope that our
results will foster new research on Sybil detection that is based on novel types
of Sybil features.