CoChat
Sign Up
Cited by 275Spam and Phishing DetectionCybercrime and Law Enforcement StudiesMisinformation and Its Impacts

Uncovering Large Groups of Active Malicious Accounts in Online Social Networks

Cao, Qiang, Yang, Xiaowei, Yu, Jieqi, Palow, Christopher·2014·Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security
DOI 10.1145/2660267.2660269
Open this paper in CoChat — free account

Abstract

The success of online social networks has attracted a constant interest in attacking and exploiting them. Attackers usually control malicious accounts, including both fake and compromised real user accounts, to launch attack campaigns such as social spam, malware distribution, and online rating distortion. To defend against these attacks, we design and implement a malicious account detection system called SynchroTrap. We observe that malicious accounts usually perform loosely synchronized actions in a variety of social network context. Our system clusters user accounts according to the similarity of their actions and uncovers large groups of malicious accounts that act similarly at around the same time for a sustained period of time. We implement SynchroTrap as an incremental processing system on Hadoop and Giraph so that it can process the massive user activity data in a large online social network efficiently. We have deployed our system in five applications at Facebook and Instagram. SynchroTrap was able to unveil more than two million malicious accounts and 1156 large attack campaigns within one month.

Integrity signals

Registry

Crossref · 10.1145/2660267.2660269

Cites

37 of 37 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions.

    “Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions, e.g., that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50-53, 53, 5759, 65, 66, 84, 87, 88, 92].”

    From RacketStore (2021) · cites this paper as [32]

  • Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].

    “Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”

    From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]

  • SynchroTrap relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time.

    “Another one, SynchroTrap, relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time [10].”

    From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]

  • The clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.

    “Similar to CopyCatch [4] and SynchroTrap [10], the clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.”

    From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]

  • The paper demonstrated that sophisticated like farms can successfully evade detection by existing graph-based fraud detection algorithms such as CopyCatch and SynchroTrap.

    “We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”

    From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Cao, Q., Yang, X., Yu, J., & Palow, C.
Affiliations
  • Duke University (US)
  • Meta (United States) (US)
ORCID
Yang, Xiaowei
Venue
Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security
Publisher
ACM
Published
2014-11-03
Pages
477-488
ISSN
1543-7221 (ISSN-L)
DOI
10.1145/2660267.2660269
OpenAlex
W2125490153
Cited by
274
References
37
Citations by year
2026: 7 · 2025: 8 · 2024: 13 · 2023: 18 · 2022: 17 · 2021: 32 · 2020: 40 · 2019: 31 · 2018: 39 · 2017: 38 · 2016: 18 · 2015: 13
FWCI
19.62
Type
conference paper
Language
en
Open access
closed
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
Funders
Division of Computer and Network Systems (CNS-0845858, CNS-1017858)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
  • Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
Keywords
malicious account detection, social networking sites, fake accounts, malware distribution, Hadoop, Giraph, Facebook, Instagram

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review