Uncovering social network Sybils in the wild
Abstract
Sybil accounts are fake identities created to unfairly increase the power or resources of a single malicious user. Researchers have long known about the existence of Sybil accounts in online communities such as file-sharing systems, but they have not been able to perform large-scale measurements to detect them or measure their activities. In this article, we describe our efforts to detect, characterize, and understand Sybil account activity in the Renren Online Social Network (OSN). We use ground truth provided by Renren Inc. to build measurement-based Sybil detectors and deploy them on Renren to detect more than 100,000 Sybil accounts. Using our full dataset of 650,000 Sybils, we examine several aspects of Sybil behavior. First, we study their link creation behavior and find that contrary to prior conjecture, Sybils in OSNs do not form tight-knit communities. Next, we examine the fine-grained behaviors of Sybils on Renren using clickstream data. Third, we investigate behind-the-scenes collusion between large groups of Sybils. Our results reveal that Sybils with no explicit social ties still act in concert to launch attacks. Finally, we investigate enhanced techniques to identify stealthy Sybils. In summary, our study advances the understanding of Sybil behavior on OSNs and shows that Sybils can effectively avoid existing community-based Sybil detectors. We hope that our results will foster new research on Sybil detection that is based on novel types of Sybil features.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Some providers generate fake popularity signals using automated bots, while others use realistic accounts and even crowdsourced real humans.
“some providers generate fake popularity signals using automated bots (aka. sybils), but some others use realistic accounts and even crowdsourced real humans (aka. crowdturfing) [58, 83, 84, 93, 100].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [100]
Cites
Fast unfolding of communities in large networks
Blondel, V. D., Guillaume, J.-L., Lambiotte, R., & Lefebvre, E. (2008) · Journal of Statistical Mechanics: Theory and Experiment · doi:10.1088/1742-5468/2008/10/p10008 · Cited by 21,424 · see citing works
What is Twitter, a social network or a news media?
Kwak, H., Lee, C., Park, H., & Moon, S. (2010) · Proceedings of the 19th international conference on World wide web · doi:10.1145/1772690.1772751 · Cited by 6,652 · see citing works
Douceur, J. R. (2002) · Lecture Notes in Computer Science · doi:10.1007/3-540-45748-8_24 · Cited by 4,419 · see citing works
The sybil attack in sensor networks
Newsome, J., Shi, E., Song, D. X., & Perrig, A. (2004) · ACM/IEEE International Conference on Information Processing in Sensor Networks (IPSN) · doi:10.1145/984622.984660 · Cited by 1,298 · see citing works
User interactions in social networks and their implications
Wilson, C., Boe, B., Sala, A., Puttaswamy, K. P. N., & Zhao, B. Y. (2009) · Proceedings of the 4th ACM European conference on Computer systems · doi:10.1145/1519065.1519089 · Cited by 879 · see citing works
Self-citationCharacterizing user behavior in online social networks
Benevenuto, F., Rodrigues, T., Cha, M., & Almeida, V. A. F. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644900 · Cited by 795 · see citing works
Detecting spammers on social networks
Stringhini, G., Kruegel, C., & Vigna, G. (2010) · Proceedings of the 26th Annual Computer Security Applications Conference · doi:10.1145/1920261.1920263 · Cited by 791 · see citing works
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734 · see citing works
Magno, G., Rodrigues, T., & Almeida, V. A. F. (2010) · Cited by 649 · see citing works
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570 · see citing works
Grier, C., Thomas, K., Paxson, V., & Zhang, M. (2010) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1866307.1866311 · Cited by 558 · see citing works
DON’T FOLLOW ME - Spam Detection in Twitter
Wang, A. H. (2010) · International Conference on Security and Cryptography · doi:10.5220/0002996201420151 · Cited by 469 · see citing works
Aiding the detection of fake accounts in large scale social online services
Cao, Q., Sirivianos, M., Yang, X., & Pregueiro, T. (2012) · Cited by 449 · see citing works
Seven Months with the Devils: A Long-Term Study of Content Polluters on Twitter
Lee, K., Eoff, B. D., & Caverlee, J. (2021) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v5i1.14106 · Cited by 448 · see citing works
Suspended accounts in retrospect: an analysis of twitter spam
Thomas, K., Grier, C., Song, D., & Paxson, V. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068840 · Cited by 439 · see citing works
Detecting and characterizing social spam campaigns
Gao, H., Hu, J. S., Wilson, C., Li, Z., Chen, Y., & Zhao, B. Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879147 · Cited by 420 · see citing works
Self-citationSybilInfer: Detecting Sybil Nodes using Social Networks.
Danezis, G., & Mittal, P. (2009) · Cited by 407 · see citing works
Detecting spam in a Twitter network
Schoenebeck, S. Y., Romero, D. M., Schoenebeck, G. R., & boyd, D. (2009) · First Monday · doi:10.5210/fm.v15i1.2793 · Cited by 347 · see citing works
Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G. M., Paxson, V., & Savage, S. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455774 · Cited by 323 · see citing works
Low-resource routing attacks against tor
Bauer, K. S., McCoy, D., Grunwald, D. C., Kohno, T., & Sicker, D. (2007) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/1314333.1314336 · Cited by 312 · see citing works
An analysis of social network-based Sybil defenses
Viswanath, B., Post, A., Gummadi, K. P., & Mislove, A. E. (2010) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1851182.1851226 · Cited by 308 · see citing works
SybilGuard: defending against sybil attacks via social networks
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. (2006) · Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/1159913.1159945 · Cited by 260 · see citing works
Sybil-resilient online content voting
Tran, N. H. K., Min, B., Li, J., & Subramanian, L. (2009) · Cited by 256 · see citing works
You are how you click: Clickstream analysis for Sybil detection
Wang, G., Konolige, T., Wilson, C., Wang, X., Zheng, H.-T., & Zhao, B. Y. (2013) · Cited by 256 · see citing works
Self-citationStein, T., Chen, E., & Mangla, K. (2011) · Proceedings of the 4th Workshop on Social Network Systems · doi:10.1145/1989656.1989664 · Cited by 219 · see citing works
Understanding latent interactions in online social networks
Jiang, J., Wilson, C., Wang, X., Huang, P., Sha, W., Dai, Y., & Zhao, B. Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879190 · Cited by 205 · see citing works
Self-citationSerf and turf: crowdturfing for fun and profit
Wang, G., Wilson, C., Zhao, X., Zhu, Y., Mohanlal, M., Zheng, H., & Zhao, B. Y. (2012) · Proceedings of the 21st international conference on World Wide Web · doi:10.1145/2187836.2187928 · Cited by 197 · see citing works
Self-citationMeasuring the mixing time of social graphs
Mohaisen, A., Yun, A., & Kim, Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879191 · Cited by 183 · see citing works
MacFarlane, B. D., & Kushner, J. D. (2023) · Elsevier eBooks · doi:10.1016/b978-0-323-95630-7.00010-x · Cited by 172 · see citing works
Uncovering social network sybils in the wild
Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068841 · Cited by 164 · see citing works
Self-citationAn Empirical Study of Collusion Behavior in the Maze P2P File-Sharing System
Lian, Q., Zhang, Z., Yang, M., Zhao, B. Y., Dai, Y., & Li, X. (2007) · Proceedings of the ... International Conference on Distributed Computing Systems/Proceedings of the International Conference on Distributed Computing Systems · doi:10.1109/icdcs.2007.84 · Cited by 152 · see citing works
Self-citationSocial Honeypots: Making Friends With A Spammer Near You.
Webb, S., Caverlee, J., & Pu, C. (2008) · Cited by 110 · see citing works
Dirty jobs: the role of freelance labor in web service abuse
Motoyama, M., McCoy, D., Levchenko, K., Savage, S., & Voelker, G. M. (2011) · Cited by 94 · see citing works
Sharing music files: Tactics of a challenge to the industry
Martin, B. G., Moore, C., & Salter, C. (2010) · First Monday · doi:10.5210/fm.v15i12.2986 · Cited by 46 · see citing works
Nazir, A., Raza, S., Chuah, C., & Schipper, B. C. (2010) · Cited by 35 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016) · Communications of the ACM · doi:10.1145/2818717 · Cited by 1,973 · see citing works
Online Human-Bot Interactions: Detection, Estimation, and Characterization
Varol, O., Ferrara, E., Davis, C., Menczer, F., & Flammini, A. (2017) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v11i1.14871 · Cited by 928 · see citing works
Disinformation and social bot operations in the run up to the 2017 French presidential election
Ferrara, E. (2017) · First Monday · doi:10.5210/fm.v22i8.8005 · Cited by 524 · see citing works
The Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Proceedings of the 26th International Conference on World Wide Web Companion - WWW '17 Companion · doi:10.1145/3041021.3055135 · Cited by 381 · see citing works
False Information on Web and Social Media: A Survey
Kumar, S., & Shah, N. (2018) · arXiv · doi:10.48550/arxiv.1804.08559 · Cited by 289 · see citing works
Unpacking the Social Media Bot: A Typology to Guide Research and Policy
Gorwa, R., & Guilbeault, D. (2020) · Policy & Internet · doi:10.1002/poi3.184 · Cited by 270 · see citing works
Twitter Bot Detection Using Bidirectional Long Short-Term Memory Neural Networks and Word Embeddings
Wei, F., & Nguyen, U. T. (2019) · 2019 First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa48467.2019.00021 · Cited by 168 · see citing works
Detection of malicious social bots: A survey and a refined taxonomy
Latah, M. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113383 · Cited by 94 · see citing works
Changing Perspectives: Is It Sufficient to Detect Social Bots?
Grimme, C., Assenmacher, D., & Adam, L. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-91521-0_32 · Cited by 93 · see citing works
Profile characteristics of fake Twitter accounts
Gurajala, S., White, J. S., Hudson, B., Voter, B. R., & Matthews, J. N. (2016) · Big Data & Society · doi:10.1177/2053951716674236 · Cited by 86 · see citing works
Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks
Zheng, H., Xue, M., Lu, H., Hao, S., Zhu, H., Liang, X., & Ross, K. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23009 · Cited by 61 · see citing works
Using Improved Conditional Generative Adversarial Networks to Detect Social Bots on Twitter
Wu, B., Liu, L., Yang, Y., Zheng, K., & Wang, X. (2020) · IEEE Access · doi:10.1109/access.2020.2975630 · Cited by 54 · see citing works
Self-citationBetter Safe Than Sorry: An Adversarial Approach to Improve Social Bot Detection
Cresci, S., Petrocchi, M., Spognardi, A., & Tognazzi, S. (2019) · Proceedings of the 10th ACM Conference on Web Science · doi:10.1145/3292522.3326030 · Cited by 52 · see citing works
Fraud De-Anonymization for Fun and Profit
Hernandez, N., Rahman, M., Recabarren, R., & Carbunar, B. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243770 · Cited by 16 · see citing works
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 2 · see citing works
- Authors
- Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y.
- Affiliations
- Peking University (CN)
- University of California, Santa Barbara (US)
- Renren Inc., Beijing, China
- Venue
- ACM Transactions on Knowledge Discovery from Data
- Published
- 2014-02
- Volume
- 8
- Issue
- 1
- Pages
- 1-29
- ISSN
- 1556-4681 (ISSN-L)
- 1556-472X
- OpenAlex
- W2092277251
- Cited by
- 290
- References
- 35
- Citations by year
- 2026: 3 · 2025: 6 · 2024: 12 · 2023: 12 · 2022: 17 · 2021: 26 · 2020: 32 · 2019: 34 · 2018: 43 · 2017: 37 · 2016: 37 · 2015: 23 · 2014: 6 · 2013: 2
- FWCI
- 95.23
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ACM Transactions on Knowledge Discovery from Data (publishedVersion)
- eScholarship (California Digital Library) (submittedVersion)
- Funders
- National Science Foundation (61202423)
- Ministry of Science and Technology of the People's Republic of China (2011CB302305, 2013AA013203)
- Division of Information and Intelligent Systems (IIS-0916307 and IIS-847925)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
- Keywords
- Sybil detection, social networking sites, Renren, false identity, community structure, clickstream data, collusion, malicious user behavior
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
