CopyCatch: stopping group attacks by spotting lockstep behavior in social networks
Abstract
How can web services that depend on user generated content discern fraudulent input by spammers from legitimate input? In this paper we focus on the social network Facebook and the problem of discerning ill-gotten Page Likes, made by spammers hoping to turn a profit, from legitimate Page Likes. Our method, which we refer to as CopyCatch, detects lockstep Page Like patterns on Facebook by analyzing only the social graph between users and Pages and the times at which the edges in the graph (the Likes) were created. We offer the following contributions: (1) We give a novel problem formulation, with a simple concrete definition of suspicious behavior in terms of graph structure and edge constraints. (2) We offer two algorithms to find such suspicious lockstep behavior - one provably-convergent iterative algorithm and one approximate, scalable MapReduce implementation. (3) We show that our method severely limits "greedy attacks" and analyze the bounds from the application of the Zarankiewicz problem to our setting. Finally, we demonstrate and discuss the effectiveness of CopyCatch at Facebook and on synthetic data, as well as potential extensions to anomaly detection problems in other domains. CopyCatch is actively in use at Facebook, searching for attacks on Facebook's social graph of over a billion users, many millions of Pages, and billions of Page Likes.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Thirteen of the 18 interview participants mentioned using fake name generators to name their user accounts.
“13 of the 18 interview participants, mentioned use of fake name generators, e.g., [6], to name their user accounts.”
From The Art and Craft of Fraudulent App Promotion in Google Play (2019) · cites this paper as [6]
CopyCatch is a state-of-the-art algorithm that has been deployed at Facebook to detect fake Likes with the same lockstep signatures.
“StarScout implements CopyCatch [30], a state-of-the-art algorithm that has been deployed at Facebook to detect fake Likes with the same lockstep signatures.”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [30]
CopyCatch is highly scalable and has been shown to work reasonably well in practice.
“it is highly scalable and has been shown to work reasonably well in practice [30]”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [30]
The lockstep signature is unlikely to form naturally and is highly correlated to fraudulent activities.
“this signature is unlikely to form naturally and highly correlated to fraudulent activities [30, 57, 73]”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [30]
Since 2013, a number of research teams independently started to formalize new approaches, including algorithmic ones, for detecting coordinated and synchronized behavior that characterizes groups of automated malicious accounts.
“However, since 2013, a number of research teams independently started to formalize new approaches, also from the algorithmic point of view, for detecting the coordinated and synchronized behavior that characterizes groups of automated malicious accounts [6].”
From The Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race (2017) · cites this paper as [6]
CopyCatch detects lockstep page like patterns by analyzing the social graph between users and pages, and the times at which the edges in the graph are created.
“One currently deployed tool is CopyCatch, which detects lockstep page like patterns by analyzing the social graph between users and pages, and the times at which the edges in the graph are created [4].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [4]
Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].
“Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [4]
The clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.
“Similar to CopyCatch [4] and SynchroTrap [10], the clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [4]
The paper demonstrated that sophisticated like farms can successfully evade detection by existing graph-based fraud detection algorithms such as CopyCatch and SynchroTrap.
“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [4]
Cites
MapReduce: simplified data processing on large clusters
Dean, J., & Ghemawat, S. (2008) · Communications of the ACM · doi:10.1145/1327452.1327492 · Cited by 18,476 · see citing works
Mean shift, mode seeking, and clustering
Cheng, Y. (1995) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/34.400568 · Cited by 3,868 · see citing works
Clustering high-dimensional data
Kriegel, H., Kröger, P., & Zimek, A. (2009) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1497577.1497578 · Cited by 1,095 · see citing works
Information-theoretic co-clustering
Dhillon, I. S., Mallela, S., & Modha, D. S. (2003) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/956750.956764 · Cited by 1,019 · see citing works
Data warehousing and analytics infrastructure at facebook
Thusoo, A., Shao, Z., Anthony, S., Borthakur, D., Jain, N., Sarma, J. S., Murthy, R., & Liu, H. (2010) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/1807167.1807278 · Cited by 428 · see citing works
A Scalable Collaborative Filtering Framework Based on Co-Clustering
George, T., & Merugu, S. (2006) · Proceedings · doi:10.1109/icdm.2005.14 · Cited by 410 · see citing works
Netprobe: a fast and scalable system for fraud detection in online auction networks
Pandit, S., Chau, D. H., Wang, S., & Faloutsos, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242600 · Cited by 382 · see citing works
Self-citationThe maximum edge biclique problem is NP-complete
Peeters, R. (2003) · Discrete Applied Mathematics · doi:10.1016/s0166-218x(03)00333-0 · Cited by 374 · see citing works
A Generalized Maximum Entropy Approach to Bregman Co-clustering and Matrix Approximation
Banerjee, A., Dhillon, I. S., Ghosh, J., et al. (2004) · Cited by 303 · see citing works
On mining cross-graph quasi-cliques
Pei, J., Jiang, D., & Zhang, A. (2005) · doi:10.1145/1081870.1081898 · Cited by 249 · see citing works
Stein, T., Chen, E., & Mangla, K. (2011) · Proceedings of the 4th Workshop on Social Network Systems · doi:10.1145/1989656.1989664 · Cited by 219 · see citing works
Papadimitriou, S., & Sun, J. (2008) · Proceedings · doi:10.1109/icdm.2008.142 · Cited by 209 · see citing works
EigenSpokes: Surprising Patterns and Scalable Community Chipping in Large Graphs
Prakash, B. A., Sridharan, A., Seshadri, M., Sridhar Machiraju, B., & Faloutsos, C. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13672-6_42 · Cited by 141 · see citing works
Self-citationAn Upper Bound on Zarankiewicz' Problem
Füredi, Z. (1996) · Combinatorics Probability Computing · doi:10.1017/s0963548300001814 · Cited by 120 · see citing works
MultiAspectForensics: Pattern Mining on Large-Scale Heterogeneous Networks with Tensor Analysis
Maruhashi, K., Guo, F., & Faloutsos, C. (2011) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1109/asonam.2011.80 · Cited by 115 · see citing works
Self-citationCrammer, K., & Chechik, G. (2004) · doi:10.1145/1015330.1015399 · Cited by 60 · see citing works
RTM: Laws and a Recursive Generator for Weighted Time-Evolving Graphs
Akoglu, L., McGlohon, M., & Faloutsos, C. (2008) · Proceedings · doi:10.1109/icdm.2008.123 · Cited by 57 · see citing works
Self-citationRobust one-class clustering using hybrid global and local search
Gupta, G., & Ghosh, J. (2005) · International Conference on Machine Learning · doi:10.1145/1102351.1102386 · Cited by 50 · see citing works
Approximation algorithms for co-clustering
Anagnostopoulos, A., Dasgupta, A., & Kumar, R. (2008) · ACM SIGACT-SIGMOD-SIGART Symposium on Principles of Database Systems (PODS) · doi:10.1145/1376916.1376945 · Cited by 47 · see citing works
Network Anomaly Detection Using Co-clustering
Papalexakis, E. E., Beutel, A., & Steenkiste, P. (2012) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1109/asonam.2012.72 · Cited by 45 · see citing works
Self-citationCo-clustering as multilinear decomposition with sparse latent factors
Papalexakis, E. E., & Sidiropoulos, N. D. (2011) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2011.5946731 · Cited by 40 · see citing works
Bernstein, J. (2011) · American Journal of Physics · doi:10.1119/1.3559499 · Cited by 14 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016) · Communications of the ACM · doi:10.1145/2818717 · Cited by 1,973 · see citing works
Online Human-Bot Interactions: Detection, Estimation, and Characterization
Varol, O., Ferrara, E., Davis, C., Menczer, F., & Flammini, A. (2017) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v11i1.14871 · Cited by 928 · see citing works
“decomposed event data in time, user, and activity dimensions to extract similar behaviors (Beutel et al. 2013).”
BackgroundThe Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Proceedings of the 26th International Conference on World Wide Web Companion - WWW '17 Companion · doi:10.1145/3041021.3055135 · Cited by 381 · see citing works
FRAUDAR: Bounding Graph Fraud in the Face of Camouflage
Hooi, B., Song, H. A., Beutel, A., Shah, N., Shin, K., & Faloutsos, C. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939747 · Cited by 305 · see citing works
Self-citationUncovering Large Groups of Active Malicious Accounts in Online Social Networks
Cao, Q., Yang, X., Yu, J., & Palow, C. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660269 · Cited by 274 · see citing works
Self-citationTwitter Bot Detection Using Bidirectional Long Short-Term Memory Neural Networks and Word Embeddings
Wei, F., & Nguyen, U. T. (2019) · 2019 First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa48467.2019.00021 · Cited by 168 · see citing works
CatchSync: catching synchronized behavior in large directed graphs
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S. (2014) · Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining · doi:10.1145/2623330.2623632 · Cited by 151 · see citing works
Self-citationBimodal Distribution and Co-Bursting in Review Spam Detection
Li, H., Fei, G., Wang, S., Liu, B., Shao, W., Mukherjee, A., & Shao, J. (2017) · Proceedings of the 26th International Conference on World Wide Web · doi:10.1145/3038912.3052582 · Cited by 141 · see citing works
Cashtag Piggybacking: Uncovering Spam and Bot Activity in Stock Microblogs on Twitter
Cresci, S., Lillo, F., Regoli, D., Tardelli, S., & Tesconi, M. (2019) · ACM Transactions on the Web · doi:10.1145/3313184 · Cited by 105 · see citing works
Detection of malicious social bots: A survey and a refined taxonomy
Latah, M. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113383 · Cited by 94 · see citing works
Catching Synchronized Behaviors in Large Networks: A Graph Mining Approach
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S. (2016) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2746403 · Cited by 88 · see citing works
Self-citationDe Cristofaro, E., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2014) · Proceedings of the 2014 Conference on Internet Measurement Conference · doi:10.1145/2663716.2663729 · Cited by 85 · see citing works
“Finally, a few investigative press reports [3, 7, 14, 20] have also looked into Facebook page ads and underground like farms, however, without any systematic analysis of Facebook pages’ promotion methods.”
BackgroundInferring Strange Behavior from Connectivity Pattern in Social Networks
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S. (2014) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-06608-0_11 · Cited by 82 · see citing works
Self-citationCrowd Fraud Detection in Internet Advertising
Tian, T., Zhu, J., Xia, F., Zhuang, X., & Zhang, T. (2015) · Proceedings of the 24th International Conference on World Wide Web · doi:10.1145/2736277.2741136 · Cited by 67 · see citing works
Combating Crowdsourced Review Manipulators: A Neighborhood-Based Approach
Kaghazgaran, P., Caverlee, J., & Squicciarini, A. (2018) · Proceedings of the Eleventh ACM International Conference on Web Search and Data Mining · doi:10.1145/3159652.3159726 · Cited by 59 · see citing works
Using Improved Conditional Generative Adversarial Networks to Detect Social Bots on Twitter
Wu, B., Liu, L., Yang, Y., Zheng, K., & Wang, X. (2020) · IEEE Access · doi:10.1109/access.2020.2975630 · Cited by 54 · see citing works
Sen, I., Aggarwal, A., Mian, S., Singh, S., Kumaraguru, P., & Datta, A. (2018) · Proceedings of the 10th ACM Conference on Web Science · doi:10.1145/3201064.3201105 · Cited by 50 · see citing works
CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks
Song, J., Lee, S., & Kim, J. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813661 · Cited by 50 · see citing works
Uncovering Fake Likers in Online Social Networks
Badri Satya, P. R., Lee, K., Lee, D., Tran, T., & Zhang, J. (. (2016) · Proceedings of the 25th ACM International on Conference on Information and Knowledge Management · doi:10.1145/2983323.2983695 · Cited by 46 · see citing works
Inferring lockstep behavior from connectivity pattern in large graphs
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S. (2016) · Knowledge and Information Systems · doi:10.1007/s10115-015-0883-y · Cited by 43 · see citing works
Self-citationStrength in Numbers: Robust Tamper Detection in Crowd Computations
Viswanath, B., Bashir, M. A., Zafar, M. B., Bouget, S., Guha, S., Gummadi, K. P., Kate, A., & Mislove, A. (2015) · Proceedings of the 2015 ACM on Conference on Online Social Networks · doi:10.1145/2817946.2817964 · Cited by 43 · see citing works
Measuring, Characterizing, and Detecting Facebook Like Farms
Ikram, M., Onwuzurike, L., Farooqi, S., Cristofaro, E. D., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2017) · ACM Transactions on Privacy and Security · doi:10.1145/3121134 · Cited by 27 · see citing works
“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”
MethodResultInfluentialThe Art and Craft of Fraudulent App Promotion in Google Play
Rahman, M., Hernandez, N., Recabarren, R., Ahmed, S. I., & Carbunar, B. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3345658 · Cited by 24 · see citing works
The Pod People: Understanding Manipulation of Social Media Popularity via Reciprocity Abuse
Weerasinghe, J., Flanigan, B., Stein, A., McCoy, D., & Greenstadt, R. (2020) · Proceedings of The Web Conference 2020 · doi:10.1145/3366423.3380256 · Cited by 21 · see citing works
“Recent advances in scalably detecting this lockstep behaviour (orchestrated actions by sets of users which have a very low likelihood of happening spontaneously or organically) [3] have allowed OSN platforms such as YouTube to successfully address this problem [16].”
Understanding Incentivized Mobile App Installs on Google Play Store
Farooqi, S., Feal, Á., Lauinger, T., McCoy, D., Shafiq, Z., & Vallina-Rodriguez, N. (2020) · Proceedings of the ACM Internet Measurement Conference · doi:10.1145/3419394.3423662 · Cited by 22 · see citing works
GroupTie: toward hidden collusion group discovery in app stores
Xie, Z., & Zhu, S. (2014) · Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks · doi:10.1145/2627393.2627409 · Cited by 19 · see citing works
Fraud De-Anonymization for Fun and Profit
Hernandez, N., Rahman, M., Recabarren, R., & Carbunar, B. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243770 · Cited by 16 · see citing works
Search Rank Fraud De-Anonymization in Online Systems
Rahman, M., Hernandez, N., Carbunar, B., & Chau, D. H. (2018) · Proceedings of the 29th on Hypertext and Social Media · doi:10.1145/3209542.3209555 · Cited by 8 · see citing works
Hernandez, N., Recabarren, R., Carbunar, B., & Ahmed, S. I. (2021) · Proceedings of the 21st ACM Internet Measurement Conference · doi:10.1145/3487552.3487837 · Cited by 3 · see citing works
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 2 · see citing works
The Limits of Query Monitoring against Distributed Model Extraction
Khilar, S. C. (2026) · arXiv
“Detecting groups of accounts that act together is a long-standing problem in fraud and bot detection: EigenSpokes (Prakash et al., 2010), CopyCatch (Beutel et al., 2013) and Fraudar (Hooi et al., 2016) find lockstep groups through singular vectors or dense blocks; DeBot (Chavoshi et al., 2016), SynchroTrap (Cao et al.…”
- Authors
- Beutel, A., Xu, W., Guruswami, V., Palow, C., & Faloutsos, C.
- Affiliations
- Carnegie Mellon University (US)
- Meta (United States) (US)
- Meta (United Kingdom) (GB)
- Venue
- Proceedings of the 22nd international conference on World Wide Web
- Publisher
- ACM
- Published
- 2013-05-13
- Pages
- 119-130
- OpenAlex
- W2133591726
- Cited by
- 335
- References
- 22
- Citations by year
- 2026: 10 · 2025: 16 · 2024: 24 · 2023: 25 · 2022: 19 · 2021: 31 · 2020: 31 · 2019: 21 · 2018: 47 · 2017: 46 · 2016: 28 · 2015: 22 · 2014: 14 · 2013: 1
- FWCI
- 17.36
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International World Wide Web Conference (WWW) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Keywords
- spam detection, social graphs, suspicious activity detection, Zarankiewicz problem, anomaly detection, MapReduce, user-generated content
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
