The DOI matches its Crossref record; 37 of the 37 references it cites were found in a registry or an index.
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Abstract
The success of online social networks has attracted a constant interest in attacking and exploiting them. Attackers usually control malicious accounts, including both fake and compromised real user accounts, to launch attack campaigns such as social spam, malware distribution, and online rating distortion. To defend against these attacks, we design and implement a malicious account detection system called SynchroTrap. We observe that malicious accounts usually perform loosely synchronized actions in a variety of social network context. Our system clusters user accounts according to the similarity of their actions and uncovers large groups of malicious accounts that act similarly at around the same time for a sustained period of time. We implement SynchroTrap as an incremental processing system on Hadoop and Giraph so that it can process the massive user activity data in a large online social network efficiently. We have deployed our system in five applications at Facebook and Instagram. SynchroTrap was able to unveil more than two million malicious accounts and 1156 large attack campaigns within one month.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions, e.g., that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50-53, 53, 5759, 65, 66, 84, 87, 88, 92].”
From RacketStore: measurements of ASO deception in Google play via mobile and app usage (2021) · cites this paper as [32]
In the citing paper
“Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Another one, SynchroTrap, relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Similar to CopyCatch [4] and SynchroTrap [10], the clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
Citations
Cites
Jain, A. K., Murty, M. N., & Flynn, P. J. (1999) · ACM Computing Surveys · doi:10.1145/331499.331504 · Cited by 13,925
THE DISTRIBUTION OF THE FLORA IN THE ALPINE ZONE. 1
Jaccard, P. (1912) · New Phytologist · doi:10.1111/j.1469-8137.1912.tb05611.x · Cited by 4,561
Malewicz, G. G., Austern, M. H., Bik, A. J. C., Dehnert, J. C., Horn, I., Leiser, N., & Czajkowski, G. (2010) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/1807167.1807184 · Cited by 3,518
Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007) · Communications of the ACM · doi:10.1145/1290958.1290968 · Cited by 1,156
Clustering high-dimensional data
Kriegel, H., Kröger, P., & Zimek, A. (2009) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1497577.1497578 · Cited by 1,095
Gu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
Nishtala, R., Fugal, H., Grimm, S., Kwiatkowski, M., Lee, H., Li, H. C., McElroy, R., Paleczny, M., Peek, D., Saab, P., et al. (2013) · Networked Systems Design and Implementation · Cited by 668
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570
Research works printed but not linked: 5
- Amazon EC2 Pricing . http://aws.amazon.com/ec2/pricing/ , 2013 . Amazon EC2 Pricing. http://aws.amazon.com/ec2/pricing/, 2013.
- Apache Giraph . http://giraph.apache.org/ , 2013 . Apache Giraph. http://giraph.apache.org/, 2013.
- Apache Hadoop . http://hadoop.apache.org/ , 2013 . Apache Hadoop. http://hadoop.apache.org/, 2013.
- Facebook Reports Fourth Quarter and Full Year 2012 Results . http://investor.fb.com/releasedetail.cfm?ReleaseID=736911 , 2013 . Facebook Reports Fourth Quarter and Full Year 2012 Results. http://investor.fb.com/releasedetail.cfm?ReleaseID=736911, 2013.
- Types of cookies used by Google . http://www.google.com/policies/technologies/types/ , 2013 . Types of cookies used by Google. http://www.google.com/policies/technologies/types/, 2013.
Cited by
Sorted by citations
Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016) · Communications of the ACM · doi:10.1145/2818717 · Cited by 1,973
“2013], SynchroTrap [Cao et al. 2014], and the Renren Sybil detector [Wang et al.”
ResultHeterogeneous Graph Neural Networks for Malicious Account Detection
Liu, Z., Chen, C., Yang, X., Zhou, J., Li, X., & Song, L. (2018) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3269206.3272010 · Cited by 435
“Unlike existing methods that one first studies the graph properties [15] or pairwise comparisons of account activities [5], then feeds into a machine learning framework, our proposed method directly learns a function for each account given the context of the local topology and”
BackgroundMethodSelf-citationThe Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Proceedings of the 26th International Conference on World Wide Web Companion - WWW '17 Companion · doi:10.1145/3041021.3055135 · Cited by 381
“[9] detection of loosely synchronized actions”
Political Astroturfing on Twitter: How to Coordinate a Disinformation Campaign
Keller, F. B., Schoch, D., Stier, S., & Yang, J. (2020) · Political Communication · doi:10.1080/10584609.2019.1661888 · Cited by 378
The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race
Cresci, S., Pietro, R. D., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) · doi:10.48550/arxiv.1701.03017 · Cited by 237
“[9] detection of loosely synchronized actions”
Towards Detecting Compromised Accounts on Social Networks
Egele, M., Stringhini, G., Kruegel, C., & Vigna, G. (2015) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2015.2479616 · Cited by 185
“Recent work in the online abuse area focused on detecting accounts that are accessed by botnets, by either looking at accounts that are accessed by many IP addresses [36] or by looking at accounts that present strong synchronized activity [37].”
BackgroundOne-Class Adversarial Nets for Fraud Detection
Zheng, P., Yuan, S., Wu, X., Li, J., & Lu, A. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33011286 · Cited by 173
Social fingerprinting: detection of spambot groups through DNA-inspired behavioral modeling
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2017.2681672 · Cited by 168
“SynchroTrap [27] aims at detecting loosely synchronized behaviors for a broad range of social network applications.”
Twitter Bot Detection Using Bidirectional Long Short-Term Memory Neural Networks and Word Embeddings
Wei, F., & Nguyen, U. T. (2019) · 2019 First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa48467.2019.00021 · Cited by 168
Privacy and security in online social networks: A survey
Kayes, I., & Iamnitchi, A. (2017) · Online Social Networks and Media · doi:10.1016/j.osnem.2017.09.001 · Cited by 172
Uncovering Coordinated Networks on Social Media: Methods and Case Studies
Pacheco, D., Hui, P.-M., Torres-Lugo, C., Truong, B. T., Flammini, A., & Menczer, F. (2021) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v15i1.18075 · Cited by 140
Data Poisoning Attacks to Deep Learning Based Recommender Systems
Huang, H., Mu, J., Gong, N. Z., Li, Q., Liu, B., & Xu, M. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24525 · Cited by 120
“These methods leverage user registration information [48], user-generated content [3], [44], and/or social graphs between users [9], [16], [24], [41]–[43], [47].”
MethodInstagram Fake and Automated Account Detection
Akyön, F. Ç., & Kalfaoglu, M. E. (2019) · Innovations in Intelligent Systems and Applications Conference (ASYU) · doi:10.1109/asyu48272.2019.8946437 · Cited by 118
“In [15], Facebook employees studied the detection of malicious accounts from the requests sent on Facebook and Instagram but these method is not applicable with publicly available information because requests are reachable only from Facebook.”
MethodFake review detection on online E-commerce platforms: a systematic literature review
Paul, H., & Nikolaev, A. G. (2021) · Data Mining and Knowledge Discovery · doi:10.1007/s10618-021-00772-6 · Cited by 126
“However, CopyCatch cannot detect non-overlapping and partially overlapping synchronized behaviors and does not prevent repeated fraudulent activities from the same IP addresses (Cao et al. 2014).”
BackgroundTwitter turing test: Identifying social machines
Alarifi, A., Alsaleh, M., & Al‐Salman, A. S. (2016) · Information Sciences · doi:10.1016/j.ins.2016.08.036 · Cited by 106
SybilSCAR: Sybil detection in online social networks via local rule based propagation
Wang, B., Zhang, L., & Gong, N. Z. (2017) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2017.8057066 · Cited by 101
“, IP address, behaviors, and content) [22], [23], [24], [25], [26], [27].”
Framing dependencies introduced by underground commoditization
Thomas, K., Huang, D. Y., Wang, D. Y., Bursztein, E., Grier, C., Holt, T., Kruegel, C., McCoy, D., Savage, S., & Vigna, G. (2015) · Cited by 100
Wang, B., Gong, N. Z., & Fu, H. (2017) · Proceedings · doi:10.1109/icdm.2017.56 · Cited by 92
“Depending on the used information sources, we classify existing approaches into two categories, global structure based methods [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16] and local feature based methods [17], [18], [19], [20], [21].”
BackgroundMethodA novel framework for detecting social bots with deep neural networks and active learning
Wu, Y., Fang, Y., Shang, S., Jin, J., Wei, L., & Wang, H. (2020) · Knowledge-Based Systems · doi:10.1016/j.knosys.2020.106525 · Cited by 95
Detection of malicious social bots: A survey and a refined taxonomy
Latah, M. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113383 · Cited by 94
Changing Perspectives: Is It Sufficient to Detect Social Bots?
Grimme, C., Assenmacher, D., & Adam, L. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-91521-0_32 · Cited by 93
Shi, W., Liu, D., Yang, J., Zhang, J., Wen, S., & Su, J. Y. (2020) · International Journal of Environmental Research and Public Health · doi:10.3390/ijerph17228701 · Cited by 96
“Researchers have developed multiple approaches to discriminate between social bots and humans [71,72], among which Botometer, formerly known as BotOrNot, is a widely used social bot detection interface for Twitter [73–76].”
BackgroundIdentifying Coordinated Accounts on Social Media through Hidden Influence and Group Behaviours
Sharma, K., Zhang, Y., Ferrara, E., & Liu, Y. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467391 · Cited by 83
“cluster accounts that take similar actions around the same time, based on the assumption that malicious account activities are synchronized in time [4, 9].”
BackgroundLeveraging Analysis of User Behavior to Identify Malicious Activities in Large-Scale Social Networks
Al‐Qurishi, M., Hossain, M. S., Alrubaian, M., Rahman, S. M. M., & Alamri, A. M. (2017) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2017.2753202 · Cited by 83
“ity of the information exchange on the platform [8]–[10].”
BackgroundIdentifying Toxicity Within YouTube Video Comment
Obadimu, A., Mead, E. L., Hussain, M. N., & Agarwal, N. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-21741-9_22 · Cited by 76
Detecting Fake Accounts in Online Social Networks at the Time of Registrations
Yuan, D., Miao, Y., Gong, N. Z., Yang, Z., Li, Q. L., Song, D. X., Wang, Q., & Liang, X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363198 · Cited by 75
“For instance, SynchroTrap [12] leverages clustering techniques to detect Sybils based on synchronized user behavior, e.”
MethodOn the Detection of Disinformation Campaign Activity with Network Analysis
Vargas, L., Emami, P., & Traynor, P. (2020) · Proceedings of the 2020 ACM SIGSAC Conference on Cloud Computing Security Workshop · doi:10.1145/3411495.3421363 · Cited by 74
“Additionally, network-based detection mechanisms have also been used to uncover Sybil accounts that wish to abuse online platforms [5, 31, 38].”
Method(2015)
Íntegro: Leveraging victim prediction for robust fake account detection in large scale OSNs
Boshmaf, Y., Logothetis, D., Siganos, G., Leria, J., Lorenzo, J., Ripeanu, M., Beznosov, K., & Halawa, H. H. (2016) · Computers & Security · doi:10.1016/j.cose.2016.05.005 · Cited by 69
“SynchroTrap uses a singlelinkage hierarchical clustering algorithm to detect similarities in user actions in order to identify fake accounts.”
MethodInfluentialDiscovering Browser Extensions via Web Accessible Resources
Sjösten, A., Acker, S. V., & Sabelfeld, A. (2017) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3029806.3029820 · Cited by 66
“(LastPass subsequently responded by interface measures and asking for email confir-mation for all logins from new IPs [33].)”
BackgroundStructure-Based Sybil Detection in Social Networks via Local Rule-Based Propagation
Wang, B., Jia, J., Zhang, L., & Gong, N. Z. (2018) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2018.2813672 · Cited by 67
“, IP address, behaviors, and content) [26], [27], [28], [29], [30], [31], [32],”
Wang, C., & Zhu, H. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.2991872 · Cited by 68
“We set four intervals of the hour: [0 , 3) , [6 , 11) , [15 , 24) , and [3 , 6) ∪ [11 , 15) , according to the time distribution in transactions.”
BackgroundSmoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks
Zheng, H., Xue, M., Lu, H., Hao, S., Zhu, H., Liang, X., & Ross, K. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23009 · Cited by 61
Almaatouq, A., Shmueli, E., Nouh, M., Alabdulkareem, A., Singh, V. K., Alsaleh, M., Alarifi, A., Alfaris, A., & Pentland, A. (2016) · International Journal of Information Security · doi:10.1007/s10207-016-0321-5 · Cited by 66
“[12,13] proposed a social graph-based tool, called SybilRank, to detect sybil accounts in Tuenti which is the largest OSN in Spain.”
MethodLOBO: Evaluation of Generalization Deficiencies in Twitter Bot Classifiers
Echeverra, J., De Cristofaro, E., Kourtellis, N., Leontiadis, I., Stringhini, G., & Zhou, S. (2018) · Proceedings of the 34th Annual Computer Security Applications Conference · doi:10.1145/3274694.3274738 · Cited by 61
“their operators [8, 32, 39], or at the content that they post, looking for signs of maliciousness [26, 29, 35].”
Political Astroturfing on Twitter: How to Coordinate a Disinformation CampaignPreprint
Keller, F., Schoch, D., Stier, S., & Yang, J. (2019) · SocArXiv (OSF Preprints) · doi:10.31235/osf.io/a5gk6 · Cited by 66
Combating the evasion mechanisms of social bots
Ji, Y., He, Y., Jiang, X., Cao, J., & Li, Q. (2016) · Computers & Security · doi:10.1016/j.cose.2016.01.007 · Cited by 56
“Several concerted efforts have been made to defend against malicious OSN accounts (Boshmaf et al., 2015; Cao et al., 2014; Yang et al., 2014).”
BackgroundMethodLing, C., Stringhini, G., Balci, U., & Blackburn, J. (2021) · IEEE Security & Privacy · doi:10.1109/msec.2021.3127392 · Cited by 57
Clickstream User Behavior Models
Wang, G., Zhang, X., Tang, S., Wilson, C., Zheng, H.-T., & Zhao, B. Y. (2017) · ACM Transactions on the Web · doi:10.1145/3068332 · Cited by 56
“Finally, recent works propose to detect spammers and Sybils based on synchronized behaviors, that is, performing similar tasks around the same time [5, 6, 11, 29, 30, 35].”
BackgroundWang, Z., Ma, D., Pang, R., Xie, F., Zhang, J., & Sun, D. (2020) · ISPRS International Journal of Geo-Information · doi:10.3390/ijgi9110632 · Cited by 61
“[60] analyzed the massive amount of aggressive social Keywords Year Strength Begin End 2010 - 2020”
BackgroundCreation and Management of Social Network Honeypots for Detecting Targeted Cyber Attacks
Vit, A. P., Shabtai, A., Puzis, R., Elyashar, A., Elovici, Y., Roshandel, M., & Peylo, C. (2017) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2017.2719705 · Cited by 56
“Several studies have presented techniques to detect socialbots by detecting anomalous behavior [15], [30], classification based on content and network topology [31]–[35] or by the detection of loosely synchronized actions [36], [37].”
BackgroundClassification of instagram fake users using supervised machine learning algorithms
Purba, K. R., Asirvatham, D. A. L., & Murugesan, R. K. (2020) · International Journal of Electrical and Computer Engineering (IJECE) · doi:10.11591/ijece.v10i3.pp2763-2772 · Cited by 56
“Similarities are important differentiators of fake and authentic users, such as friends [21], activities [23], names similarity [17], posts similarity [10].”
BackgroundSimilCatch: Enhanced social spammers detection on Twitter using Markov Random Fields
El-Mawass, N., Honeiné, P., & Vercouter, L. (2020) · Information Processing & Management · doi:10.1016/j.ipm.2020.102317 · Cited by 54
“A discussion of the parallelized implementation of a similarity graph on Facebook (based on login information and IP addresses) is provided in Cao et al. (2014). A threshold can be implemented in order to prevent the generation of pairs for highly popular content (messages in our case) Li et al.”
BackgroundInfluentialWorth its Weight in Likes: Towards Detecting Fake Likes on Instagram
Sen, I., Aggarwal, A., Mian, S., Singh, S., Kumaraguru, P., & Datta, A. (2018) · Proceedings of the 10th ACM Conference on Web Science · doi:10.1145/3201064.3201105 · Cited by 52
“Malicious entities on OSNs have been widely studied with a particular focus on Facebook [9, 15], Twitter [4, 21], and to a lesser extent, on Instagram [6].”
BackgroundMethodInfluentialCrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks
Song, J., Lee, S., & Kim, J. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813661 · Cited by 50
“Therefore, recent studies try to detect bot accounts in OSNs by discovering their synchronized group activities [8,11,15,16,31].”
BackgroundInfluentialX under Musk’s leadership: Substantial hate and no reduction in inauthentic activity
Hickey, D., Fessler, D. M. T., Lerman, K., & Burghardt, K. (2025) · PLoS ONE · doi:10.1371/journal.pone.0313293 · Cited by 88
Nilizadeh, S., Labrèche, F., Sedighian, A., Zand, A., Fernandez, J. M., Kruegel, C., Stringhini, G., & Vigna, G. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134055 · Cited by 50
“Cao et al. proposed SynchroTrap [13], a detection system that clusters malicious accounts according to their actions and the time at which they are made.”
BackgroundUncovering Fake Likers in Online Social Networks
Badri Satya, P. R., Lee, K., Lee, D., Tran, T., & Zhang, J. (. (2016) · Proceedings of the 25th ACM International on Conference on Information and Knowledge Management · doi:10.1145/2983323.2983695 · Cited by 46
“In addition, for us to implement three state-of-the-art approaches (i.e., PCA [17], SynchroTrap [3] and CopyCatch [1]) for comparison, we also extracted temporal features.”
BackgroundMethodInfluentialLive-Streaming Fraud Detection: A Heterogeneous Graph Neural Network Approach
Li, Z., Wang, H., Zhang, P., Hui, P., Huang, J., Liao, J., Zhang, J., & Bu, J. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467065 · Cited by 44
“[1] advanced the technique of aggregating behavioral patterns to find out fraudulent accounts in an unsupervised machine learning framework.”
MethodDetecting Bots and Assessing Their Impact in Social Networks
Mesnards, N. G. D., Hunter, D. S., el Hjouji, Z., & Zaman, T. R. (2021) · Operations Research · doi:10.1287/opre.2021.2118 · Cited by 58
“…et al. 2013), Twitter memes (Ratkiewicz et al. 2011), and more generally Sybil detection in online communities (Benevenuto et al. 2009, Aggarwal 2014, Cao et al. 2014, Yang et al. 2014, Ghosh et al. 2012, Tran et al. 2009, Yu et al. 2008, Danezis and Mittal 2009, Yu et al. 2006, Wang et al. 2013,…”
BackgroundStrength in Numbers: Robust Tamper Detection in Crowd Computations
Viswanath, B., Bashir, M. A., Zafar, M. B., Bouget, S., Guha, S., Gummadi, K. P., Kate, A., & Mislove, A. (2015) · Proceedings of the 2015 ACM on Conference on Online Social Networks · doi:10.1145/2817946.2817964 · Cited by 43
“Two other works, SynchoTrap [16] and CopyCatch [13] also focused on analyzing behavior of a group of malicious identities.”
BackgroundUnderstanding (Mis)Behavior on the EOSIO Blockchain
Huang, Y., Wang, H., Wu, L., Gareth Tyson, A., Luo, X., Zhang, R., Liu, X., Huang, G., & Jiang, X. (2020) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3392155 · Cited by 78
“[42] proposed to cluster user accounts according to the similarity of their actions and uncovered large groups of malicious accounts.”
Tweet-Based Bot Detection Using Big Data Analytics
Derhab, A., Alawwad, R. A., Dehwah, K., Tariq, N., Khan, F. A., & Al-Muhtadi, J. F. (2021) · IEEE Access · doi:10.1109/access.2021.3074953 · Cited by 41
“They applied Concurrent Content Injection Detection (CCID) [84] to identify botnets, i.e., accounts posting almost similar tweets nearly simultaneously.”
MethodSocial Media Identity Deception Detection
Alharbi, A., Dong, H., Yi, X., Tari, Z., & Khalil, I. (2021) · ACM Computing Surveys · doi:10.1145/3446372 · Cited by 41
“Malicious accounts can reach many victims, since social shopping networks have millions of users who want to buy genuine items [14].”
BackgroundMarkov-Driven Graph Convolutional Networks for Social Spammer Detection
Deng, L., Wu, C., Lian, D., Wu, Y., & Chen, E. (2022) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2022.3150669 · Cited by 40
“The existing feature-based methods [14], [15], [16], [17], [18], [19] generally exploit text features or behavior features from users.”
MethodCrowdsourcing Under Data Poisoning Attacks: A Comparative Study
Tahmasebian, F., Xiong, L., Sotoodeh, M., & Sunderam, V. S. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-49669-2_18 · Cited by 37
“Other related attacks include spammer [13,19,20,35,48] and sybil [8,26,39, 43, 46, 51–54] attacks.”
In a World That Counts: Clustering and Detecting Fake Social Engagement at ScalePreprint
Li, Y., Martinez, O., Chen, X., Li, Y., & Hopcroft, J. E. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1512.05457 · Cited by 39
“[8] further extended the CopyCatch approach [7] to several other applications such as Facebook app install and Instagram follow.”
BackgroundInfluentialDatingSec: Detecting Malicious Accounts in Dating Apps Using a Content-Based Attention Network
He, X., Gong, Q., Chen, Y., Zhang, Y., Wang, X., & Fu, X. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3068307 · Cited by 40
“However, most of the previous work on malicious user detection overlooked the textual information of user interactions [15], [16], [29], [31], [35].”
BackgroundInfluentialData Poisoning Attacks to Local Differential Privacy ProtocolsPreprint
Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.02046 · Cited by 43
“For instance, methods [12, 16, 26, 52, 56, 57, 67, 68] that leverage content, behavior, and social graphs are developed to detect fake users in social networks.”
BackgroundSocksCatch: Automatic detection and grouping of sockpuppets in social media
Yamak, Z., Saunier, J., & Vercouter, L. (2018) · Knowledge-Based Systems · doi:10.1016/j.knosys.2018.03.002 · Cited by 36
Spectrum-based Deep Neural Networks for Fraud Detection
Yuan, S., Wu, X., Li, J., & Lu, A. (2017) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3132847.3133139 · Cited by 34
“Many fraud detection techniques have been developed in recent years [1, 6, 9, 14], including content-based approaches and graph-based approaches.”
BackgroundTrollMagnifier: Detecting State-Sponsored Troll Accounts on Reddit
Saeed, M. H., Ali, S., Blackburn, J., Cristofaro, E. D., Zannettou, S., & Stringhini, G. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833706 · Cited by 35
Padmanabhan, R., Rula, J. P., Richter, P., Strowes, S. D., & Dainotti, A. (2020) · ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) · doi:10.1145/3386367.3431314 · Cited by 34
FARE: Enabling Fine-grained Attack Categorization under Low-quality Labeled Data
Liang, J., Guo, W., Luo, T., Honavar, V., Wang, G., & Xing, X. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24403 · Cited by 35
“, spam, scam, illegal content scraping, and opinion manipulation) [14], [13], [68], [75], [71], [23], [33].”
Graph Mining for Cybersecurity: A Survey
Yan, B., Yang, C. H., Shi, C., Fang, Y., Li, Q., Ye, Y., & Du, J. (2023) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3610228 · Cited by 44
“g, adding the number of page likes or fake Twitter followers to promote services and products [66], political astroturfing [135], and even manipulating voting results [19].”
BackgroundSybil Defense in Crowdsourcing Platforms
Yuan, D., Li, G., Li, Q., & Zheng, Y. (2017) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3132847.3133039 · Cited by 33
“Although the similarity conception in [2] cannot check the task state and monitor online, we apply its similarity method and compare with ours in experiments.”
BackgroundMethodInfluentialIdentifying Users behind Shared Accounts in Online Streaming Services
Jiang, J., Li, C., Chen, Y., & Wang, W. (2018) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3209978.3210054 · Cited by 33
“Previous work detects malicious users based on context information such as social network structures [2, 8] and unusual behavior patterns [21, 23].”
BackgroundLi, Y., Martinez, O., Chen, X., Li, Y., & Hopcroft, J. E. (2016) · International World Wide Web Conference (WWW) · doi:10.1145/2872427.2882972 · Cited by 53
“[8] further extended the CopyCatch approach [7] to several other applications such as Facebook app install and Instagram follow.”
BackgroundInfluentialCollective Classification of Spam Campaigners on Twitter
Gupta, S., Khattar, A., Gogia, A., Kumaraguru, P., & Chakraborty, T. (2018) · International World Wide Web Conference (WWW) · doi:10.1145/3178876.3186119 · Cited by 46
On network backbone extraction for modeling online collective behavior
Ferreira, C. H. G., Murai, F., da Silva, A. P. C., Trevisan, M., Vassio, L., Drago, I., Mellia, M., & Almeida, J. M. (2022) · PLoS ONE · doi:10.1371/journal.pone.0274218 · Cited by 34
LDPGuard: Defenses Against Data Poisoning Attacks to Local Differential Privacy Protocols
Huang, K., Ouyang, G., Ye, Q., Hu, H., Zheng, B., Zhao, X., Zhang, R., & Zhou, X. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3358909 · Cited by 33
“…Attacks to LDP Protocols: Although there are some countermeasures against data poisoning attacks to LDP protocols [43], [51] and Sybil attacks [52], [53], [54], [55], [56], [57], [58], [59], [74], the former does not focus on LDP protocols for frequency estimation but machine learning models,…”
BackgroundShah, N., Lamba, H., Beutel, A., & Faloutsos, C. (2017) · Proceedings · doi:10.1109/icdm.2017.140 · Cited by 32
“Most previous fraud detection works focus on feature-based classification [14], [15], [16], subgraph analysis [1], [17] and spectral methods [3], [18], [2].”
BackgroundAn Advanced Taxonomy for Social Engineering Attacks
Aldawood, H., & Skinner, G. (2020) · International Journal of Computer Applications · doi:10.5120/ijca2020919744 · Cited by 31
“Thus, attackers may formulate a fake group on these social sites in order to attract the participation of victims [37, 38].”
BackgroundOlszewski, D., Lu, A., Stillman, C., Warren, K., Kitroser, C., Pascual, A., Ukirde, D., Butler, K. R. B., & Traynor, P. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623130 · Cited by 52
End-to-End Compromised Account Detection
Karimi, H., VanDam, C., Ye, L., & Tang, J. (2018) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1109/asonam.2018.8508296 · Cited by 30
“The intuition for using this feature is that some hackers after acquiring an account tend to randomly follow many other users [5], [6] or drag other users’ attention to follow them.”
BackgroundGao, Y., Li, X., Li, J., Gao, Y., & Yu, P. S. (2019) · IEEE Access · doi:10.1109/access.2019.2893657 · Cited by 30
“Behavior-based methods extract valuable information, such as volume and frequency, from historical posting behavior to evaluate trustworthiness [21], [27], [28].”
BackgroundLess is More: Semi-Supervised Causal Inference for Detecting Pathogenic Users in Social Media
Alvari, H., Shaabani, E., Sarkar, S., Beigi, G., & Shakarian, P. (2019) · International World Wide Web Conference (WWW) · doi:10.1145/3308560.3316500 · Cited by 29
“Among the participants, the work of [14], used similarity to cluster accounts and uncover groups of malicious users. work of [42] presented a supervised framework for bot detection which uses more than thousands features.”
Uncovering Coordinated Networks on Social Media.
Pacheco, D. F., Hui, P.-M., Torres-Lugo, C., Truong, B. T., Flammini, A., & Menczer, F. (2020) · Cited by 33
On Twitter Purge: A Retrospective Analysis of Suspended Users
Chowdhury, F. A., Allen, L., Yousuf, M., & Mueen, A. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366424.3383298 · Cited by 30
“Misinformation, spamming, and bot detection are some of the most studied aspects regarding Twitter suspension [15, 18, 22, 30, 33].”
BackgroundThwarting Fake OSN Accounts by Predicting their Victims
Boshmaf, Y., Ripeanu, M., Beznosov, K., & Santos‐Neto, E. (2015) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/2808769.2808772 · Cited by 28
“…features, the authors were able to train a cluster-based classifier using the METIS clustering algorithm [27] with 3% FPR and 1% FNR. Cao et al. observed that fake accounts tend to perform loosely synchronized actions in a variety of OSN applications, all from a limited set of IP addresses [14].”
BackgroundMethodMeasuring, Characterizing, and Detecting Facebook Like Farms
Ikram, M., Onwuzurike, L., Farooqi, S., Cristofaro, E. D., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2017) · ACM Transactions on Privacy and Security · doi:10.1145/3121134 · Cited by 27
“Another one, SynchroTrap, relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time [10].”
BackgroundMethodResultInfluentialCatching Worms, Trojan Horses and PUPs: Unsupervised Detection of Silent Delivery Campaigns
Kwon, B. J., Srinivas, V., Deshpande, A., & Dumitraş, T. (2017) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2017.23220 · Cited by 26
“SynchroTrap [9] proposes a malicious account detection system in the context of social networks to uncover malicious accounts and campaigns.”
BackgroundZhao, L., Hui, P., Zhang, P., Huang, J., Wang, B., Tian, L., Zhang, J., Gao, J., & Tang, X. J. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442442.3451147 · Cited by 26
“[1] advanced the technique of aggregating behavioral patterns to find out fraudulent accounts in an unsupervisedmachine learning framework.”
Understanding the Security of Deepfake Detection
Cao, X., & Gong, N. Z. (2022) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-06365-7_22 · Cited by 29
No Place to Hide: Catching Fraudulent Entities in Tensors
Ban, Y., Xin, L., Ling, H., Duan, Y., Liu, X., & Xu, W. (2019) · International World Wide Web Conference (WWW) · doi:10.1145/3308558.3313403 · Cited by 25
“A number of studies have found that large cluster sizes are a crucial indicator of fraud [5, 39].”
BackgroundComposite Behavioral Modeling for Identity Theft Detection in Online Social Networks
Wang, C., Zhu, H., & Yang, B. (2021) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2021.3092007 · Cited by 27
Luceri, L., Pantè, V., Burghardt, K., & Ferrara, E. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645529 · Cited by 37
“We begin by elucidating the foundational assumptions and strategies for constructing similarity networks from various behavioral traces.”
MethodDiscovering hidden suspicious accounts in online social networks
Cao, J., Fu, Q., Li, Q., & Guo, D. (2017) · Information Sciences · doi:10.1016/j.ins.2017.02.030 · Cited by 25
The Art and Craft of Fraudulent App Promotion in Google Play
Rahman, M., Hernandez, N., Recabarren, R., Ahmed, S. I., & Carbunar, B. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3345658 · Cited by 25
“However, we also report and validate concrete, participant-revealed behaviors that do not t the mold of assumptions made in previous work, including lockstep behaviors [32, 48, 59, 77, 81, 86, 93, 94, 97, 100] or posting reviews in bursts [26, 28, 32, 36–38, 40, 42, 43, 51, 52, 59–61, 63, 65, 92, 95, 96, 100].”
ResultOn the efficacy of old features for the detection of new bots
Nicola, R. D., Petrocchi, M., & Pratelli, M. (2021) · Information Processing & Management · doi:10.1016/j.ipm.2021.102685 · Cited by 24
“Other techniques are based, for example, on anomalies in synchronicity and normality [28, 29], detection of loosely synchronized actions [30], distance between distributions of reputation scores [16], and similarity between sequences of actions [19].”
Cui, Y., Yamashita, N., & Lee, Y. (2022) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3555148 · Cited by 25
“Of course, new technology for detecting malicious accounts’ behaviors (e.g., [2, 15]) could also be helpful in this regard; but again, its use might trigger concerns about being monitored, which could be mitigated by participatory design sessions [5].”
SliceNDice: Mining Suspicious Multi-Attribute Entity Groups with Multi-View Graphs
Nilforoshan, H., & Shah, N. (2019) · IEEE International Conference on Data Science and Advanced Analytics (DSAA) · doi:10.1109/dsaa.2019.00050 · Cited by 24
“Despite these challenges, researchers have made progress in a variety of scenarios including fake account creation [5], [6], bot follower detection [7], [8], malware detection [9] and more.”
Background"You Know What to Do": Proactive Detection of YouTube Videos Targeted by Coordinated Hate Attacks
Mariconti, E., Suárez‐Tangil, G., Blackburn, J., Cristofaro, E. D., Kourtellis, N., Ilias Leontiadis, A., Serrano, J. L., & Stringhini, G. (2018) · OpenBU (Boston University) · doi:10.48550/arxiv.1805.08168 · Cited by 27
“are often criticized for providing inadequate countermeasures [62,63]. Abusive activity is generated by humans and not by automated programs, thus, systems used to detect unwanted content, bots, etc. [6,5,10, 45,59,60,66] are not easily adapted to this problem. Hence, platforms mostly adopt reactive solutions, letting…”
BackgroundBehavioral authentication for security and safety
Wang, C., Tang, H., Zhu, H., Zheng, J., & Jiang, C. (2024) · Security and Safety · doi:10.1051/sands/2024003 · Cited by 27
“Malicious accounts have been detected by analyzing account behavioral characteristics [43, 44].”
BackgroundTowards A User-Level Understanding of IPv6 Behavior
Li, F., & Freeman, D. M. (2020) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3419394.3423618 · Cited by 23
“IPv4 addresses have been widely used for understanding and detecting attacks, such as with fake and compromised online accounts [2, 36], spam and other online abuses [29, 31–34], and distributed denial-of-service attacks [30].”
MethodShah, N. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052617 · Cited by 23
“[3, 5] detail local clustering methods on Facebook page-likes and other user actions which aim to catch synchronized behavior in the form of temporally-coherent bipartite cores in graphs.”
BackgroundA Real-Time Prescriptive Solution for Explainable Cyber-Fraud Detection Within the iGaming Industry
Farrugia, D., Zerafa, C., Cini, T., Kuasney, B., & Livori, K. (2021) · SN Computer Science · doi:10.1007/s42979-021-00623-7 · Cited by 22
“[6] also use a clustering algorithm to detect malicious accounts in online social networks.”
MethodThe Pod People: Understanding Manipulation of Social Media Popularity via Reciprocity Abuse
Weerasinghe, J., Flanigan, B., Stein, A., McCoy, D., & Greenstadt, R. (2020) · Proceedings of The Web Conference 2020 · doi:10.1145/3366423.3380256 · Cited by 23
A postmortem of suspended Twitter accounts in the 2016 U.S. presidential election
Le, H., Boynton, G. R., Shafiq, Z., & Srinivasan, P. (2019) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1145/3341161.3342878 · Cited by 23
“a synchronized or coordinated behaviors) or more strongly connected to each other, which was shown for spammers and malicious accounts in previous work [40], [41], [11], we want to analyze suspended accounts at the group level for better interpretation.”
BackgroundUnderstanding (Mis)Behavior on the EOSIO Blockchain
Huang, Y., Wang, H., Wu, L., Gareth Tyson, A., Luo, X., Zhang, R., Liu, X., Huang, G., & Jiang, X. (2020) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/3393691.3394223 · Cited by 19
Metadata
- Authors
- Cao, Q., Yang, X., Yu, J., & Palow, C.
- Affiliations
- Duke University (US)
- Meta (United States) (US)
- ORCID
- Yang, Xiaowei
- Venue
- Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2014-11-03
- Pages
- 477-488
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2125490153
- Cited by
- 274
- References
- 37
- Citations by year
- 2026: 7 · 2025: 8 · 2024: 13 · 2023: 18 · 2022: 17 · 2021: 32 · 2020: 40 · 2019: 31 · 2018: 39 · 2017: 38 · 2016: 18 · 2015: 13
- FWCI
- 19.62
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Division of Computer and Network Systems (CNS-0845858, CNS-1017858)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Law › Cybercrime and Law Enforcement Studies
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- malicious account detection, social networking sites, fake accounts, malware distribution, Hadoop, Giraph, Facebook, Instagram
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
