Uncovering social network sybils in the wild
Abstract
Sybil accounts are fake identities created to unfairly increase the power or resources of a single user. Researchers have long known about the existence of Sybil accounts in online communities such as file-sharing systems, but have not been able to perform large scale measurements to detect them or measure their activities. In this paper, we describe our efforts to detect, characterize and understand Sybil account activity in the Renren online social network (OSN). We use ground truth provided by Renren Inc. to build measurement based Sybil account detectors, and deploy them on Renren to detect over 100,000 Sybil accounts. We study these Sybil accounts, as well as an additional 560,000 Sybil accounts caught by Renren, and analyze their link creation behavior. Most interestingly, we find that contrary to prior conjecture, Sybil accounts in OSNs do not form tight-knit communities. Instead, they integrate into the social graph just like normal users. Using link creation timestamps, we verify that the large majority of links between Sybil accounts are created accidentally, unbeknownst to the attacker. Overall, only a very small portion of Sybil accounts are connected to other Sybils with social links. Our study shows that existing Sybil defenses are unlikely to succeed in today's OSNs, and we must design new techniques to effectively detect and defend against Sybil attacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Prior work has focused extensively on analysis and detection of sybil and/or fake accounts in online social networks by relying on tightly-knit community structures.
“Prior work has focused quite extensively on the analysis and the detection of sybil and/or fake accounts in online social networks by relying on tightly-knit community structures [54, 15, 53, 9, 52, 5].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [53]
Cites
Fast unfolding of communities in large networks
Blondel, V. D., Guillaume, J.-L., Lambiotte, R., & Lefebvre, E. (2008) · Journal of Statistical Mechanics: Theory and Experiment · doi:10.1088/1742-5468/2008/10/p10008 · Cited by 21,424 · see citing works
What is Twitter, a social network or a news media?
Kwak, H., Lee, C., Park, H., & Moon, S. (2010) · Proceedings of the 19th international conference on World wide web · doi:10.1145/1772690.1772751 · Cited by 6,652 · see citing works
Douceur, J. R. (2002) · Lecture Notes in Computer Science · doi:10.1007/3-540-45748-8_24 · Cited by 4,419 · see citing works
The sybil attack in sensor networks
Newsome, J., Shi, E., Song, D. X., & Perrig, A. (2004) · ACM/IEEE International Conference on Information Processing in Sensor Networks (IPSN) · doi:10.1145/984622.984660 · Cited by 1,298 · see citing works
User interactions in social networks and their implications
Wilson, C., Boe, B., Sala, A., Puttaswamy, K. P. N., & Zhao, B. Y. (2009) · Proceedings of the 4th ACM European conference on Computer systems · doi:10.1145/1519065.1519089 · Cited by 879 · see citing works
Self-citationCharacterizing user behavior in online social networks
Benevenuto, F., Rodrigues, T., Cha, M., & Almeida, V. A. F. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644900 · Cited by 795 · see citing works
Detecting spammers on social networks
Stringhini, G., Kruegel, C., & Vigna, G. (2010) · Proceedings of the 26th Annual Computer Security Applications Conference · doi:10.1145/1920261.1920263 · Cited by 791 · see citing works
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734 · see citing works
Magno, G., Rodrigues, T., & Almeida, V. A. F. (2010) · Cited by 649 · see citing works
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570 · see citing works
Grier, C., Thomas, K., Paxson, V., & Zhang, M. (2010) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1866307.1866311 · Cited by 558 · see citing works
DON’T FOLLOW ME - Spam Detection in Twitter
Wang, A. H. (2010) · International Conference on Security and Cryptography · doi:10.5220/0002996201420151 · Cited by 469 · see citing works
Aiding the detection of fake accounts in large scale social online services
Cao, Q., Sirivianos, M., Yang, X., & Pregueiro, T. (2012) · Cited by 449 · see citing works
Seven Months with the Devils: A Long-Term Study of Content Polluters on Twitter
Lee, K., Eoff, B. D., & Caverlee, J. (2021) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v5i1.14106 · Cited by 448 · see citing works
Suspended accounts in retrospect: an analysis of twitter spam
Thomas, K., Grier, C., Song, D., & Paxson, V. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068840 · Cited by 439 · see citing works
Detecting and characterizing social spam campaigns
Gao, H., Hu, J. S., Wilson, C., Li, Z., Chen, Y., & Zhao, B. Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879147 · Cited by 420 · see citing works
Self-citationSybilInfer: Detecting Sybil Nodes using Social Networks.
Danezis, G., & Mittal, P. (2009) · Cited by 407 · see citing works
Detecting spam in a Twitter network
Schoenebeck, S. Y., Romero, D. M., Schoenebeck, G. R., & boyd, D. (2009) · First Monday · doi:10.5210/fm.v15i1.2793 · Cited by 347 · see citing works
Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G. M., Paxson, V., & Savage, S. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455774 · Cited by 323 · see citing works
Low-resource routing attacks against tor
Bauer, K. S., McCoy, D., Grunwald, D. C., Kohno, T., & Sicker, D. (2007) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/1314333.1314336 · Cited by 312 · see citing works
An analysis of social network-based Sybil defenses
Viswanath, B., Post, A., Gummadi, K. P., & Mislove, A. E. (2010) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1851182.1851226 · Cited by 308 · see citing works
SybilGuard: defending against sybil attacks via social networks
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. (2006) · Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/1159913.1159945 · Cited by 260 · see citing works
Sybil-resilient online content voting
Tran, N. H. K., Min, B., Li, J., & Subramanian, L. (2009) · Cited by 256 · see citing works
Stein, T., Chen, E., & Mangla, K. (2011) · Proceedings of the 4th Workshop on Social Network Systems · doi:10.1145/1989656.1989664 · Cited by 219 · see citing works
Understanding latent interactions in online social networks
Jiang, J., Wilson, C., Wang, X., Huang, P., Sha, W., Dai, Y., & Zhao, B. Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879190 · Cited by 205 · see citing works
Self-citationSerf and turf: crowdturfing for fun and profit
Wang, G., Wilson, C., Zhao, X., Zhu, Y., Mohanlal, M., Zheng, H., & Zhao, B. Y. (2012) · Proceedings of the 21st international conference on World Wide Web · doi:10.1145/2187836.2187928 · Cited by 197 · see citing works
Self-citationMeasuring the mixing time of social graphs
Mohaisen, A., Yun, A., & Kim, Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879191 · Cited by 183 · see citing works
An Empirical Study of Collusion Behavior in the Maze P2P File-Sharing System
Lian, Q., Zhang, Z., Yang, M., Zhao, B. Y., Dai, Y., & Li, X. (2007) · Proceedings of the ... International Conference on Distributed Computing Systems/Proceedings of the International Conference on Distributed Computing Systems · doi:10.1109/icdcs.2007.84 · Cited by 152 · see citing works
Self-citationSocial Honeypots: Making Friends With A Spammer Near You.
Webb, S., Caverlee, J., & Pu, C. (2008) · Cited by 110 · see citing works
Dirty jobs: the role of freelance labor in web service abuse
Motoyama, M., McCoy, D., Levchenko, K., Savage, S., & Voelker, G. M. (2011) · Cited by 94 · see citing works
Nazir, A., Raza, S., Chuah, C., & Schipper, B. C. (2010) · Cited by 35 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Disinformation and social bot operations in the run up to the 2017 French presidential election
Ferrara, E. (2017) · First Monday · doi:10.5210/fm.v22i8.8005 · Cited by 524 · see citing works
Uncovering social network Sybils in the wild
Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y. (2014) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2556609 · Cited by 290 · see citing works
Self-citationUncovering Large Groups of Active Malicious Accounts in Online Social Networks
Cao, Q., Yang, X., Yu, J., & Palow, C. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660269 · Cited by 274 · see citing works
A generic statistical approach for spam detection in Online Social Networks
Ahmed, F., & Abulaish, M. (2013) · Computer Communications · doi:10.1016/j.comcom.2013.04.004 · Cited by 199 · see citing works
Integro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs
Boshmaf, Y., Logothetis, D., Siganos, G., Leria, J., Lorenzo, J., Ripeanu, M., & Beznosov, K. (2015) · Proceedings 2015 Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23260 · Cited by 134 · see citing works
Online Social Spammer Detection
Hu, X., Tang, J., & Liu, H. (2014) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v28i1.8728 · Cited by 133 · see citing works
De Cristofaro, E., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2014) · Proceedings of the 2014 Conference on Internet Measurement Conference · doi:10.1145/2663716.2663729 · Cited by 85 · see citing works
“acteristics about the social structure and activity of fake profiles attracted by the honeypot pages, e.g., their interconnected nature or the activity bursts.”
BackgroundUsing Improved Conditional Generative Adversarial Networks to Detect Social Bots on Twitter
Wu, B., Liu, L., Yang, Y., Zheng, K., & Wang, X. (2020) · IEEE Access · doi:10.1109/access.2020.2975630 · Cited by 54 · see citing works
Self-citationCrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks
Song, J., Lee, S., & Kim, J. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813661 · Cited by 50 · see citing works
Strength in Numbers: Robust Tamper Detection in Crowd Computations
Viswanath, B., Bashir, M. A., Zafar, M. B., Bouget, S., Guha, S., Gummadi, K. P., Kate, A., & Mislove, A. (2015) · Proceedings of the 2015 ACM on Conference on Online Social Networks · doi:10.1145/2817946.2817964 · Cited by 43 · see citing works
Measuring, Characterizing, and Detecting Facebook Like Farms
Ikram, M., Onwuzurike, L., Farooqi, S., Cristofaro, E. D., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2017) · ACM Transactions on Privacy and Security · doi:10.1145/3121134 · Cited by 27 · see citing works
“Prior work has focused quite extensively on the analysis and the detection of sybil and/or fake accounts in online social networks by relying on tightly-knit community structures [54, 15, 53, 9, 52, 5].”
BackgroundGroupTie: toward hidden collusion group discovery in app stores
Xie, Z., & Zhu, S. (2014) · Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks · doi:10.1145/2627393.2627409 · Cited by 19 · see citing works
- Authors
- Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y.
- Affiliations
- Peking University (CN)
- University of California, Santa Barbara (US)
- Renren Inc., Beijing, China
- Venue
- Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference
- Publisher
- ACM
- Published
- 2011-11-02
- Pages
- 259-268
- OpenAlex
- W2139144138
- Cited by
- 164
- References
- 31
- Citations by year
- 2026: 1 · 2023: 3 · 2022: 1 · 2021: 6 · 2020: 6 · 2019: 8 · 2018: 17 · 2017: 20 · 2016: 8 · 2015: 23 · 2014: 31 · 2013: 23 · 2012: 15
- FWCI
- 16.82
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- Sybil attack, social networking sites, Renren, Sybil detection, false identity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
