Uncovering Social Network Sybils in the Wild
Zhi Yang
Christo Wilson
Xiao Wang
Tingting Gao
Ben Y. Zhao
Yafei Dai
Proceedings of The 11th ACM SIGCOMM Internet Measurement Conference (IMC 2011)
[Full Text in PDF Format, 537KB]
Paper Abstract
Sybil accounts are fake identities created to unfairly increase the
power or resources of a single user. Researchers have long known about
the existence of Sybil accounts in online communities such as
file-sharing systems, but have not been able to perform large scale
measurements to detect them or measure their activities. In this paper,
we describe our efforts to detect, characterize and understand Sybil
account activity in the Renren online social network (OSN). We use
ground truth provided by Renren Inc. to build measurement based Sybil
account detectors, and deploy them on Renren to detect over 100,000
Sybil accounts. We study these Sybil accounts, as well as an additional
560,000 Sybil accounts caught by Renren, and analyze their link creation
behavior. Most interestingly, we find that contrary to prior conjecture,
Sybil accounts in OSNs do not form tight-knit communities. Instead, they
integrate into the social graph just like normal users. Using link
creation timestamps, we verify that the large majority of links between
Sybil accounts are created accidentally, unbeknownst to the attacker.
Overall, only a very small portion of Sybil accounts are connected to
other Sybils with social links. Our study shows that existing Sybil
defenses are unlikely to succeed in today's OSNs, and we must design new
techniques to effectively detect and defend against Sybil attacks.