The DOI matches its Crossref record; 37 of the 37 references it cites were found in a registry or an index.
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Abstract
The success of online social networks has attracted a constant interest in attacking and exploiting them. Attackers usually control malicious accounts, including both fake and compromised real user accounts, to launch attack campaigns such as social spam, malware distribution, and online rating distortion. To defend against these attacks, we design and implement a malicious account detection system called SynchroTrap. We observe that malicious accounts usually perform loosely synchronized actions in a variety of social network context. Our system clusters user accounts according to the similarity of their actions and uncovers large groups of malicious accounts that act similarly at around the same time for a sustained period of time. We implement SynchroTrap as an incremental processing system on Hadoop and Giraph so that it can process the massive user activity data in a large online social network efficiently. We have deployed our system in five applications at Facebook and Instagram. SynchroTrap was able to unveil more than two million malicious accounts and 1156 large attack campaigns within one month.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions, e.g., that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50-53, 53, 5759, 65, 66, 84, 87, 88, 92].”
From RacketStore: measurements of ASO deception in Google play via mobile and app usage (2021) · cites this paper as [32]
In the citing paper
“Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Another one, SynchroTrap, relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Similar to CopyCatch [4] and SynchroTrap [10], the clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
Citations
Cites
Jain, A. K., Murty, M. N., & Flynn, P. J. (1999) · ACM Computing Surveys · doi:10.1145/331499.331504 · Cited by 13,925
THE DISTRIBUTION OF THE FLORA IN THE ALPINE ZONE. 1
Jaccard, P. (1912) · New Phytologist · doi:10.1111/j.1469-8137.1912.tb05611.x · Cited by 4,561
Malewicz, G. G., Austern, M. H., Bik, A. J. C., Dehnert, J. C., Horn, I., Leiser, N., & Czajkowski, G. (2010) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/1807167.1807184 · Cited by 3,518
Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007) · Communications of the ACM · doi:10.1145/1290958.1290968 · Cited by 1,156
Clustering high-dimensional data
Kriegel, H., Kröger, P., & Zimek, A. (2009) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1497577.1497578 · Cited by 1,095
Gu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
Nishtala, R., Fugal, H., Grimm, S., Kwiatkowski, M., Lee, H., Li, H. C., McElroy, R., Paleczny, M., Peek, D., Saab, P., et al. (2013) · Networked Systems Design and Implementation · Cited by 668
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570
Research works printed but not linked: 5
- Amazon EC2 Pricing . http://aws.amazon.com/ec2/pricing/ , 2013 . Amazon EC2 Pricing. http://aws.amazon.com/ec2/pricing/, 2013.
- Apache Giraph . http://giraph.apache.org/ , 2013 . Apache Giraph. http://giraph.apache.org/, 2013.
- Apache Hadoop . http://hadoop.apache.org/ , 2013 . Apache Hadoop. http://hadoop.apache.org/, 2013.
- Facebook Reports Fourth Quarter and Full Year 2012 Results . http://investor.fb.com/releasedetail.cfm?ReleaseID=736911 , 2013 . Facebook Reports Fourth Quarter and Full Year 2012 Results. http://investor.fb.com/releasedetail.cfm?ReleaseID=736911, 2013.
- Types of cookies used by Google . http://www.google.com/policies/technologies/types/ , 2013 . Types of cookies used by Google. http://www.google.com/policies/technologies/types/, 2013.
Cited by
Sorted by citations
Items 101–200 of 275
Combating Friend Spam Using Social Rejections
Cao, Q., Sirivianos, M., Yang, X., & Munagala, K. (2015) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2015.32 · Cited by 21
“OSN providers can apply it to the detection of other malicious accounts [17], such as compromised ones.”
BackgroundSelf-citationFraud Detection through Graph-Based User Behavior Modeling
Beutel, A., Akoglu, L., & Faloutsos, C. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2812702 · Cited by 21
“Temporal lockstep behavior: CopyCatch [8]; extended in [11]”
BackgroundGraph-Based User Behavior Modeling
Beutel, A., Akoglu, L., & Faloutsos, C. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2789985 · Cited by 21
“Temporal lockstep behavior: CopyCatch [8]; extended in [11] iv.”
BackgroundTowards fast and lightweight spam account detection in mobile social networks through fog computing
Zhang, J., Li, Q., Wang, X., Feng, B., & Guo, D. (2017) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-017-0559-3 · Cited by 21
“Cao et al. [14] design and implement a detection system, SynchroTrap.”
Early Identification of Pathogenic Social Media Accounts
Alvari, H., Shaabani, E., & Shakarian, P. (2018) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2018.8587339 · Cited by 22
Measuring and mitigating oauth access token abuse by collusion networks
Farooqi, S., Zaffar, F., Leontiadis, N., & Shafiq, Z. (2017) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3131365.3131404 · Cited by 22
“Starting day 55, as marked by cyan squares in Figure 5, we use SynchoTrap [28] to cluster synchronized access token abuse by collusion network accounts.”
BackgroundMethodInfluentialBeyond Text: Multimodal Credibility Assessment Approaches for Online User-Generated Content
Choudhary, M., Chouhan, S. S., & Rathore, S. S. (2024) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3673236 · Cited by 20
Understanding compromised accounts on Twitter
VanDam, C., Tang, J., & Tan, P. (2017) · IEEE/WIC/ACM International Conference on Web Intelligence · doi:10.1145/3106426.3106543 · Cited by 20
“between fake accounts and compromised accounts [3, 4, 22].”
Understanding Incentivized Mobile App Installs on Google Play Store
Farooqi, S., Feal, Á., Lauinger, T., McCoy, D., Shafiq, Z., & Vallina-Rodriguez, N. (2020) · Proceedings of the ACM Internet Measurement Conference · doi:10.1145/3419394.3423662 · Cited by 22
“Specifically, our proposed measurements can provide a ground truth of apps to help train machine learning models in detecting the lockstep behavior of users who perform similar in-app activities to complete the offer [18, 20, 33].”
Fusing Behavioral Projection Models for Identity Theft Detection in Online Social Networks
Wang, C., Yang, B., Cui, J., & Wang, C. (2019) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2019.2917003 · Cited by 19
“[36] designed and implemented a malicious account detection system for detecting both fake and compromised real user accounts.”
BackgroundGao, M., Li, Z., Li, R., Cui, C.-H., Chen, X., Ye, B., Li, Y., Gu, W., Gong, Q., Wang, X., et al. (2023) · Patterns · doi:10.1016/j.patter.2023.100839 · Cited by 18
LOBO -- Evaluation of Generalization Deficiencies in Twitter Bot ClassifiersPreprint
Echeverría, J., Cristofaro, E. D., Kourtellis, N., Leontiadis, I., Stringhini, G., & Zhou, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.09684 · Cited by 19
“their operators [8, 32, 39], or at the content that they post, looking for signs of maliciousness [26, 29, 35].”
Strengthening Weak Identities Through Inter-Domain Trust Transfer
Venkatadri, G., Goga, O., Zhong, C., Viswanath, B., Gummadi, K. P., & Sastry, N. (2016) · International World Wide Web Conference (WWW) · doi:10.1145/2872427.2883015 · Cited by 18
Beating the Artificial Chaos: Fighting OSN Spam Using Its Own Templates
Zhu, T., Gao, H., Yi, Y., Bu, K., Chen, Y., Downey, D., Lee, K., & Choudhary, A. (2016) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2016.2557849 · Cited by 18
“design and implement a malicious account detection system called SynchroTrap which was able to reveal a lot of malicious accounts [36].”
BackgroundMariconti, E., Onaolapo, J. O., Ahmad, S. S., Nikiforou, N., Egele, M., Nikiforakis, N., & Stringhini, G. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052589 · Cited by 18
“Based on the insights from this research, a number of systems have been proposed to detect malicious activity on Twitter, such as fake accounts [3, 17, 18, 24, 28], compromised accounts [8] or malicious accounts controlled by botnets [4, 25, 31].”
Sybil Detection in Social-Activity Networks: Modeling, Algorithms and Evaluations
Zhang, X., Xie, H. L., & Lui, J. C. S. (2018) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2018.00015 · Cited by 17
“Unsupervised detection usually clusters sybils according to different features, such as loosely synchronized actions [29], activity patterns [30], users’ profiles and tweets [31], click-streams [32], etc.”
BackgroundLearning-Based Model to Fight against Fake Like Clicks on Instagram Posts
Thejas, G. S., Soni, J., Chandna, K., Iyengar, S. S., Sunitha, N. R., & Prabakar, N. (2019) · IEEE SoutheastCon · doi:10.1109/southeastcon42311.2019.9020533 · Cited by 17
“Studies regarding these malicious activities like fake collaboration have been done widely on Twitter [8]–[10], Facebook [11]–[15], YouTube [16], but on a very lesser extent, on Instagram [17].”
BackgroundModeling User Behavior With Interaction Networks for Spam Detection
Agarwal, P., Srivastava, M., Singh, V., & Rosenberg, C. (2022) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3477495.3531875 · Cited by 19
“It is an umbrella term for a wide-class of abuses: posting spam content [20]; artificial engagement boosting [19]; evading the system; diverting traffic through links; inorganic follow [5, 34]; and collusion [24].”
BackgroundA graph-powered large-scale fraud detection system
Li, Z., Wang, B., Huang, J., Jin, Y., Xu, Z.-H., Zhang, J., & Gao, J.-Q. (2023) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-023-01786-w · Cited by 15
“Cao et al. [35] advanced the technique of aggregating behavioral patterns to find out fraudulent accounts in an unsupervised machine learning framework.”
An Evolutionary Computation Approach for Twitter Bot Detection
Rovito, L., Bonin, L., Manzoni, L., & Lorenzo, A. D. (2022) · Applied Sciences · doi:10.3390/app12125915 · Cited by 18
“Cao et al. [28] implemented a malicious account detection system called “SynchroTrap” that clusters user accounts according to the similarity of their actions and analyzes anomalous and suspicious actions to cluster malicious accounts together.”
BackgroundHawkes Process for Understanding the Influence of Pathogenic Social Media Accounts
Alvari, H., & Shakarian, P. (2019) · International Conference on Data Intelligence and Security (ICDIS) · doi:10.1109/icdis.2019.00013 · Cited by 19
“The work of [34] for example, use similarity to cluster accounts and uncover groups of malicious users.”
BackgroundUnveiling Fake Accounts at the Time of Registration: An Unsupervised Approach
Liang, X., Yang, Z., Wang, B., Hu, S., Yang, Z., Yuan, D., Gong, N. Z., Li, Q. L., & He, F. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467094 · Cited by 16
Characterizing and Detecting Malicious Accounts in Privacy-Centric Mobile Social Networks
Xia, Z., Liu, C., Gong, N. Z., Li, Q. L., Cui, Y., & Song, D. X. (2019) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3292500.3330702 · Cited by 16
“For instance, SynchroTrap [12] identified malicious accounts with synchronized behaviors via hierarchical clustering and was deployed by Facebook.”
BackgroundMethodInfluentialCollective Classification of Spam Campaigners on Twitter: A Hierarchical Meta-Path Based ApproachPreprint
Gupta, S., Khattar, A., Gogia, A., Kumaraguru, P., & Chakraborty, T. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.04168 · Cited by 16
Enhancing Sybil Detection via Social-Activity Networks: A Random Walk Approach
Zhang, X., Xie, H. L., Yi, P., & Lui, J. C. S. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3151701 · Cited by 15
“Unsupervised detection usually clusters sybils according to different features, such as loosely synchronized actions [30], activity patterns [31], users’ profiles and tweets [32], click-streams[33], etc.”
BackgroundGroupFound: An effective approach to detect suspicious accounts in online social networks
Feng, B., Li, Q., Pan, X., Zhang, J., & Guo, D. (2017) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147717722499 · Cited by 15
“They observed that malicious accounts usually perform loosely synchronized actions in a variety of social network contexts.(10)”
BackgroundAggarwal, A., Kumar, S., Bhargava, K., & Kumaraguru, P. (2018) · ACM Symposium on Applied Computing · doi:10.1145/3167132.3167318 · Cited by 19
“Crowdsourced manipulation of discussions in online forums has been studied in past [9]; and previous work has explored detection of manipulated e-commerce product ratings by examining the ratings of a product with other products whose ratings are untampered [8, 29], and uncover crowdsourced manipulation in large-scale…”
BackgroundCan We Trust Social Media Data?
Paquet-Clouston, M., Bilodeau, O., & Décary-Hêtu, D. (2017) · International Conference on Social Media and Society (SMSociety) · doi:10.1145/3097286.3097301 · Cited by 14
“To prevent malicious activities on OSN, researchers have also developed classifiers, tools, and applications with the help of machine learning techniques and network connectivity information in order to detect patterns of malicious activity on OSN [7].”
BackgroundMethodMobile botnets meet social networks: design and analysis of a new type of botnet
Faghani, M. R., & Nguyen, U. T. (2018) · International Journal of Information Security · doi:10.1007/s10207-018-0412-6 · Cited by 14
“[27] designed and implemented a defense mechanism called SynchroTrap for detecting large groups of malicious accounts on Facebook.”
Distance-based customer detection in fake follower markets
Jang, B., Jeong, S., & Kim, C.-K. (2018) · Information Systems · doi:10.1016/j.is.2018.12.001 · Cited by 15
Detecting and Characterizing Arab Spammers Campaigns in Twitter
Alharthi, R. M., Alhothali, A., & Moria, K. M. (2019) · Procedia Computer Science · doi:10.1016/j.procs.2019.12.106 · Cited by 14
A comprehensive review of security threats and solutions for the online social networks industry
Nawaz, N. A. H., Ishaq, K., Farooq, U., Khalil, A., Rasheed, S., Abid, A., & Rosdi, F. (2023) · PeerJ Computer Science · doi:10.7717/peerj-cs.1143 · Cited by 13
“Attackers make malicious accounts to get their purpose because malware attacks are easier in online social networks than in other networks due to the structure of OSN ( Cao et al., 2014 ).”
BackgroundSybilHP: Sybil Detection in Directed Social Networks with Adaptive Homophily Prediction
Lu, H., Gong, D., Li, Z., Liu, F., & Liu, F. (2023) · Applied Sciences · doi:10.3390/app13095341 · Cited by 13
Supervised Classification of Social Spammers using a Similarity-based Markov Random Field Approach
El-Mawass, N., Honeiné, P., & Vercouter, L. (2018) · Multidisciplinary International Social Networks Conference (MISNC) · doi:10.1145/3227696.3227712 · Cited by 12
“common tools and obfuscation techniques, and the fact that spammers tend to work in groups or communities to ensure coordinated efforts and reach a large audience [6].”
BackgroundComprehensive Review of Malware Detection Techniques
Inayat, U., Zia, M. F., Ali, F., Ali, S. M., Khan, H. M. A., & Noor, W. (2021) · International Conference on Innovative Computing (ICIC) · doi:10.1109/icic53490.2021.9693072 · Cited by 13
Li, Q., Liu, Q., Liu, S., Di, X., Chen, S., & Zhang, H. (2023) · Communication and the Public · doi:10.1177/20570473231166157 · Cited by 12
“Specifically, crowdsourcing-based approaches refer to the recruitment of numerous trained individuals to classify social accounts according to predetermined rules (Wang et al., 2012); examples of social bot detection systems based on this approach include CopyCatch (Beutel et al., 2013) and SynchroTrap (Cao et al., 20…”
BackgroundDemystifying the underground ecosystem of account registration bots
Gao, Y., Xu, G., Li, L., Luo, X., Wang, C., & Sui, Y. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3549090 · Cited by 12
“Behaviour and content analysis [10, 20, 45, 54] can also help detect these fake accounts.”
BackgroundMethodPerna, D., & Tagarelli, A. (2018) · ACM Conference on Hypertext and Social Media (HT) · doi:10.1145/3209542.3209563 · Cited by 12
“The second group of methods focuses on identifying distinctive temporal behavioral patterns of bots (e.g., burst of interactions, non-stop activity, etc.) [3, 10, 13, 46, 52].”
BackgroundUnmasking deception: detection of fake profiles in online social ecosystems
Sarfraz, A., Ahmad, A., Zeshan, F., Hamid, M., & Alshalali, T. A. N. (2025) · Journal Of Big Data · doi:10.1186/s40537-025-01254-y · Cited by 13
“To handle this problem, Cao et al. [146] presented Synchro Trap for malicious account detection.”
FraudVis: Understanding Unsupervised Fraud Detection Algorithms
Sun, J., Zhu, Q., Liu, Z., Liu, X., Lee, J., Su, Z., Shi, L., Huang, L., & Xu, W. (2018) · IEEE Pacific Visualization Symposium · doi:10.1109/pacificvis.2018.00029 · Cited by 11
“Other types of approaches combine traditional clustering with clever feature engineering [5, 29].”
BackgroundThe Strong Link Graph for Enhancing Sybil Defenses
Effendy, S., & Yap, R. H. C. (2017) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2017.117 · Cited by 12
“Unfortunately, we expect more attack edges can be found in real world OSN [3], [4], [6], [13], [18], [27].”
BackgroundInfluentialMisinformation Detection and Adversarial Attack Cost Analysis in Directional Social Networks
Shao, H., Yao, S., Jing, A., Liu, S., Liu, D., Wang, T., Li, J., Yang, C., Wang, R., & Abdelzaher, T. (2020) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn49398.2020.9209609 · Cited by 11
“• SynchroTrap : This system detects fake users by clustering similar users according to the distance between two users’ actions [19].”
BackgroundHeterogeneous Mini-Graph Neural Network and Its Application to Fraud Invitation Detection
Zhu, Y.-N., Luo, X., Li, Y., Bu, B., Zhou, K., Zhang, W., & Lu, M. (2020) · Proceedings · doi:10.1109/icdm50108.2020.00098 · Cited by 11
“Third, machine learning based classifiers learn statistic models by exploiting a large amount of historical data to infer fake users [1, 5].”
BackgroundVigDet: Knowledge Informed Neural Temporal Point Process for Coordination Detection on Social MediaPreprint
Zhang, Y., Sharma, K., & Liu, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.15454 · Cited by 11
“One way is to measure the similarity or interaction with pre-defined features supported by prior knowledge or assumed signatures of coordinated or collective behaviors, such as co-activity, account clickstream and time sychronization [5, 29, 37].”
BackgroundA New Joint Approach with Temporal and Profile Information for Social Bot Detection
Yang, Z., Chen, X., Wang, H., Wang, W., Miao, Z., & Jiang, T. (2022) · Security and Communication Networks · doi:10.1155/2022/9119388 · Cited by 11
Bahri, L., Carminati, B., & Ferrari, E. (2016) · ACM Transactions on the Web · doi:10.1145/3014338 · Cited by 10
“…as frequency of sending friend requests and frequency of making new friends [Yang et al. 2014], accounts names structure [Xiao et al. 2015], ratio of outgoing to incoming activity and clickstream in the network [Wang et al. 2013], or combinations of features [Cao et al. 2014] have been exploited.”
BackgroundThank You For Being A Friend: An Attacker View on Online-Social-Network-Based Sybil Defenses
Köll, D., Schwarzmaier, M., Li, J., Li, X., & Fu, X. (2017) · IEEE International Conference on Distributed Computing Systems Workshops (ICDCSW) · doi:10.1109/icdcsw.2017.67 · Cited by 9
“These solutions can be categorized as (i) purely machine-learning (ML) based solutions [9]–[11] and (ii) hybrid solutions [12]–[14].”
BackgroundPseudo-Honeypot: Toward Efficient and Scalable Spam Sniffer
Zhang, Y., Zhang, H., Yuan, X., & Tzeng, N.-F. (2019) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2019.00052 · Cited by 10
“To label the remaining dataset, we employ the clustering method, which has been widely applied [5], [21], [24], [25] to detect the spammer campaigns and near-”
BackgroundMethodAn analysis model for detecting misbehaviors in anonymous cryptocurrency
Huang, S., Yang, X., He, L., Hao, X., & Ren, W. (2022) · Computer Standards & Interfaces · doi:10.1016/j.csi.2022.103669 · Cited by 10
Self-citationThe Impact of Bots on Opinions in Social Networks.Preprint
el Hjouji, Z., Hunter, D. S., Mesnards, N. G. D., & Zaman, T. R. (2018) · arXiv (Cornell University) · Cited by 10
MRFS: Mining Rating Fraud Subgraph in Bipartite Graph for Users and Products
Yu, W., Wang, W., Xu, G., Wu, H., Li, H., Wang, J., Li, X., & Liu, J. (2023) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2022.3233821 · Cited by 9
“SynchroTrap [20] works on the user similarity graph.”
BackgroundInformation collection for fraud detection in P2P financial market
Wang, H., Wang, Z., Bin, Z., & Zhou, J. (2018) · MATEC Web of Conferences · doi:10.1051/matecconf/201818906006 · Cited by 9
“Later Facebook team came up with a new invention called SynchroTrap [2] to detect synchronized attack.”
BackgroundJiang, X., Li, Q., Ma, Z., Dong, M., Wu, J., & Guo, D. (2018) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-018-0697-2 · Cited by 9
“QuickSquad also makes use of Scatter and Apply interfaces [23].”
BackgroundMethodWhat's in a Name? Understanding Profile Name Reuse on TwitterPreprint
Mariconti, E., Onaolapo, J. O., Ahmad, S. S., Nikiforou, N., Egele, M., Nikiforakis, N., & Stringhini, G. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.04256 · Cited by 10
“Based on the insights from this research, a number of systems have been proposed to detect malicious activity on Twitter, such as fake accounts [3, 17, 18, 24, 28], compromised accounts [8] or malicious accounts controlled by botnets [4, 25, 31].”
Modak, S., Mulla, Z. A. S., Verma, A., Sunalini, K. K., Khan, P. M. D. A., & Gupta, P. K. (2023) · International Conference on Electronics and Sustainable Communication Systems (ICESC) · doi:10.1109/icesc57686.2023.10193622 · Cited by 9
Discovery and Classification of Twitter Bots
Shevtsov, A., Oikonomidou, M., Antonakaki, D., Pratikakis, P., Kanterakis, A., Fragopoulou, P., & Ioannidis, S. (2022) · SN Computer Science · doi:10.1007/s42979-022-01154-5 · Cited by 7
“CCID is a method to detect automated accounts based on the assumption that when two or more accounts perform similar activities in a seemingly synchronized way, beyond the probability of coincidence, this is a strong indication that these may be automated and operated by the same piece of software, or managed by the s…”
MethodInfluentialResisting tag spam by leveraging implicit user behaviors
Zhai, E., Li, Z., Li, Z., Wu, F., & Chen, G. (2016) · Proceedings of the VLDB Endowment · doi:10.14778/3021924.3021939 · Cited by 8
“On 3 Existing efforts [10, 34] have proposed practical approaches to estimate the proportions of honest and malicious users in social network-based systems. the contrary, SRaaS is capable of assisting its users to achieve this target based upon their “tagging behaviors”.”
BackgroundKnowledge‐based approaches for identity management in online social networks
Bahri, L., Carminati, B., & Ferrari, E. (2018) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.1260 · Cited by 8
“…frequency of sending friend requests and frequency of making new friends (Yang et al., 2014), accounts names structure (Xiao et al., 2015), ratio of outgoing to incoming activity and clickstream in the network (Wang et al., 2013), or combinations of features (Cao et al., 2014) have been exploited.”
BackgroundIdentifying Coordinated Accounts in Disinformation CampaignsPreprint
Sharma, K., Ferrara, E., & Liu, Y. (2020) · arXiv (Cornell University) · Cited by 8
Predictable Model for Detecting Sybil Attacks in Mobile Social Networks
Lyu, C., Huang, D., Jia, Q., Xiao, H., Zhang, X., Chi, C., & Xu, Y. (2021) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc49053.2021.9417254 · Cited by 7
“Other works deploy the clickstream data for Sybil detection, which are solely preserved by operators of social networks [9]–[11] or cloud servers [3].”
MethodPayment-Guard: Detecting fraudulent in-app purchases in iOS system
Zhou, Y., Yue, T., Liu, X., Shen, C. Q., Tong, L., & Ding, Z. (2020) · Neurocomputing · doi:10.1016/j.neucom.2020.10.007 · Cited by 7
Ismailov, M., Tsikerdekis, M., & Zeadally, S. (2020) · Future Internet · doi:10.3390/fi12090148 · Cited by 6
“User behavior models primarily focus on features that relate to an individual user’s behavior, such as frequency of activities (e.g., number of tweets or posts per time interval), patterns of activity, and clickstream sequences [3,6–8, 21, 22, 27 ].”
BackgroundMethodUncovering Malicious Accounts in Online Social Networks Using XGBoost and Graph Convolution Networks
Tang, Y., Zhang, D., Li, K.-C., & Yuan, J. (2025) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3406194 · Cited by 6
Pantè, V., Axelrod, D., Flammini, A., Menczer, F., Ferrara, E., & Luceri, L. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3701716.3715575 · Cited by 9
From Online Behaviours to Images: A Novel Approach to Social Bot Detection
Paolo, E. D., Petrocchi, M., & Spognardi, A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-35995-8_42 · Cited by 6
Understanding a prospective approach to designing malicious social bots
He, Y., Zhang, G., Wu, J., & Li, Q. (2016) · Security and Communication Networks · doi:10.1002/sec.1475 · Cited by 5
“[27] design and implement a malicious account detection system called SynchroTrap.”
MethodUnsupervised and Active Learning Using Maximin-Based Anomaly Detection
Ghafoori, Z., Bezdek, J. C., Leckie, C. A., & Karunasekera, S. A. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-46150-8_6 · Cited by 6
“It has been used in a wide range of domains from cybersecurity [33, 7] to health and safety applications such as fall detection for elderly people [27, 35].”
BackgroundAssessing the Credibility of Cyber Adversaries
Australian Signals Directorate, A., Wells, J. A., Lafon, D., National Security Agency, U. S. A., Gratian, M., & National Security Agency, U. S. A. (2021) · International Journal of Cybersecurity Intelligence and Cybercrime · doi:10.52306/04010221fhte2115 · Cited by 5
Luceri, L., Pantè, V., Burghardt, K., & Ferrara, E. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4614245 · Cited by 6
Attacking strategies and temporal analysis involving Facebook discussion groups
Lai, C.-M., Wang, X., Hong, Y., Lin, Y.-C., Wu, S. F., McDaniel, P., & Cam, H. (2017) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm.2017.8256040 · Cited by 5
“Two behavioral clustering approaches called Copy-Catch [21] and SynchroTrap [22] detect accounts that exhibit synchronized group patterns.”
Fake account detection with attention-based graph convolution networks
Yang, P., & Zheng, Z. (2020) · IEEE International Conference on Automation, Electronics and Electrical Engineering (AUTEEE) · doi:10.1109/auteee50969.2020.9315597 · Cited by 5
“(2) Content features: such as urls/hashtags/mentions-based features (#,@)(Markov clustering, 2013[26]), static and dynamic tweet-based features(tweet syntax, tweet semantics), user behavior(SynchroTrap, 2014[27]), friend requests ratio.”
BackgroundZhang, Y., Sharma, K., & Liu, Y. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-28238-6_61 · Cited by 8
Early malicious activity discovery in microblogs by social bridges detection
Γώγογλου, Α., Θεοδοσίου, Ζ., Kounoudes, A., Vakali, A. I., & Manolopoulos, Y. (2016) · IEEE International Symposium on Signal Processing and Information Technology (ISSPIT) · doi:10.1109/isspit.2016.7886022 · Cited by 6
“Various attempts have been made to define what may constitute a malicious user [22], [23].”
BackgroundDetecting Organization-Targeted Socialbots by Monitoring Social Network Profiles
Vit, A. P., Shabtai, A., & Puzis, R. (2018) · Networks and Spatial Economics · doi:10.1007/s11067-018-9406-1 · Cited by 5
“…fake profile identification; the classification of suspicious profiles on SNs is a task that has been explored in several previous studies (Benevenuto et al. 2010; Wang 2010; Stein et al. 2011; Wang et al. 2011; Cao et al. 2014; Boshmaf et al. 2016), and this is outside the scope of this article.”
MethodTowards De-Anonymization of Google Play Search Rank Fraud
Rahman, M. M., Hernandez, N., Cărbunar, B., & Chau, D. H. (2020) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2020.2975170 · Cited by 6
“[38] used lockstep behaviors and insider information, to cluster user accounts and uncover groups of malicious accounts in Facebook.”
BackgroundDetecting Social Spammers in Sina Weibo Using Extreme Deep Factorization Machine
Wu, Y., Fang, Y., Shang, S., Wei, L., Jin, J., & Wang, H. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-62005-9_13 · Cited by 5
“Currently, most of the existing research of social spammer detection is carried out on Twitter [1,11,17] and Facebook [4,6,18], and there are relatively few studies based on the Chinese OSNs, such as Sina Weibo [8,13].”
Clustered Approach for Clone Detection in Social Media
Liyanage, C., & Premarathne, S. (2021) · International Journal on Advanced Science Engineering and Information Technology · doi:10.18517/ijaseit.11.1.9272 · Cited by 5
“Furthermore, the researchers of some studies [20] have got the help of the Facebook security team to validate their findings.”
BackgroundOn Detecting Growing-Up Behaviors of Malicious Accounts in Privacy-Centric Mobile Social Networks
Yang, Z., Wang, B., Li, H., Yuan, D., Liu, Z., Gong, N. Z., Liu, C., Li, Q. L., Liang, X., & Hu, S. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3488013 · Cited by 5
“The above competitors are state-of-the-art malicious account detection methods, some of which have been deployed in production (e.g., SynchroTrap is deployed by Facebook).”
BackgroundMethodInfluentialDetecting spammers on social networks based on a hybrid model
Xu, G., Qi, J., Huang, D., & Daneshmand, M. (2016) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2016.7840960 · Cited by 6
Analysis of Account Engagement in Onsetting Twitter Message Cascades
Kessling, P., & Grimme, C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-39627-5_10 · Cited by 5
AugSplicing: Synchronized Behavior Detection in Streaming Tensors
Zhang, J., Liu, S., Hou, W., Bhatia, S., Shen, H., Yu, W., & Cheng, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16595 · Cited by 7
No Place to Hide: Catching Fraudulent Entities in TensorsPreprint
Ban, Y., Liu, X., Duan, Y., Liu, X., & Xu, W. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.06230 · Cited by 5
“A number of studies have found that large cluster sizes are a crucial indicator of fraud [5, 39].”
BackgroundUnsupervised detection of coordinated information operations in the wild
Smith, D. H., Ehrett, C., & Warren, P. L. (2025) · EPJ Data Science · doi:10.1140/epjds/s13688-025-00544-y · Cited by 4
“…include resharing the same original messages (known as co-retweeting [20, 21, 28]), sharing messages with the same hashtags [21, 27], domains [7, 21], or similar text [21, 29], sometimes limited to being close together in time [21, 29–31], and having similar account names or other…”
Misbehavior and Account Suspension in an Online Financial Communication Platform
Tsuchiya, T., Cuevas, A., Magelinski, T., & Christin, N. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583385 · Cited by 5
“Suspended/Sybil accounts are generally observed to be clustered together, which enables them to boost their credibility [8, 30, 60].”
BackgroundTang, Y., Zhang, D., Liang, W., Li, K., & Li, K. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3416556 · Cited by 5
“[7] proposed a representative malicious account detection algorithm based on constructing an account-to-account graph using the user behavior and behavior time.”
BackgroundMethodInfluentialHacking social network data mining
Alufaisan, Y., Zhou, Y., Kantarcıoğlu, M., & Thuraisingham, B. M. (2017) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2017.8004874 · Cited by 4
“social networks that has similar design as CopyCatch [21].”
MethodIdentifying Susceptible Agents in Time Varying Opinion Dynamics Through Compressive Measurements
Wai, H.-T., Ozdaglar, A., & Scaglione, A. (2018) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2018.8462377 · Cited by 4
Li, K., Guo, B., Zhang, Q., Yuan, J., & Yu, Z. (2019) · International World Wide Web Conference (WWW) · doi:10.1145/3308560.3316704 · Cited by 4
Scalable Similarity Joins of Tokenized Strings
Metwally, A., & Huang, C.-H. (2019) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde.2019.00193 · Cited by 4
Measuring and mitigating OAuth access token abuse by collusion networks
Farooqi, S., Zaffar, F., Leontiadis, N., & Shafiq, Z. (2020) · Communications of the ACM · doi:10.1145/3387720 · Cited by 4
“…activities in online social networks can be broadly divided into two categories: (a) identifying temporally synchronized manipulative activity patterns 12, 16 ; (b) identifying individual accounts suspected to be involved in manipulative activity based on their social graph characteristics.”
BackgroundA Peer-Based Approach on Analyzing Hacked Twitter Accounts
Murauer, B., Zangerle, E., & Specht, G. (2017) · Hawaii International Conference on System Sciences (HICSS) · doi:10.24251/hicss.2017.224 · Cited by 4
“The scenarios of misusing Twitter include impersonation [15], the creation of fake accounts (socalled “sybils”) [16], phishing [17], malware distribution [18] or spamming campaigns [19].”
BackgroundLiu, Z., Chen, C., Zhou, J., Li, X., Xu, F., Chen, T., & Song, L. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3138827 · Cited by 4
“As attacking strategies from potential adversaries change, it is crucial that a good system could adapt to the evolving strategies [1, 6].”
BackgroundMethodInside the Tool Set of Automation: Free Social Bot Code Revisited
Assenmacher, D., Adam, L., Frischlich, L., Trautmann, H., & Grimme, C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-39627-5_9 · Cited by 4
Sun, J., Yin, L., Chen, C., Lee, J., Liu, X., Zhang, Z., Huang, L., Shi, L., & Xu, W. H. (2020) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3313831.3376140 · Cited by 4
“Researchers in [4, 22] use clustering to find synchronized behaviors.”
BackgroundSocial Engineering Attacks: A Clearer Perspective
Adu-Gyimah, S., Asante, G., & Boansi, O. K. (2022) · International Journal of Computer Applications · doi:10.5120/ijca2022922057 · Cited by 4
Xiao, Q., & Bertino, E. (2017) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.1210 · Cited by 4
“Clustering on Homogenous Graphs Cao et al.(8) proposed SynchroTrap, a system that can detect group of malicious accounts on Facebook and Instagram by identifying users’ loosely synchronized actions.”
BackgroundA Feature-Driven Approach for Identifying Pathogenic Social Media Accounts
Alvari, H., Beigi, G., Sarkar, S., Ruston, S. W. V., Corman, S. R., Davulcu, H., & Shakarian, P. (2020) · International Conference on Data Intelligence and Security (ICDIS) · doi:10.1109/icdis50059.2020.00010 · Cited by 6
“Among the participants, the work of [18], used similarity to cluster accounts and uncover groups of malicious users.”
BackgroundOEC: Open-Ended Classification for Future-Proof Link-Fraud Detection.Preprint
Shah, N., Lamba, H., Beutel, A., & Faloutsos, C. (2017) · arXiv (Cornell University) · Cited by 4
The Follower Count Fallacy: Detecting Twitter Users with Manipulated Follower CountPreprint
Aggarwal, A., Kumar, S., Bhargava, K., & Kumaraguru, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.03625 · Cited by 4
“Crowdsourced manipulation of discussions in online forums has been studied in past [9]; and previous work has explored detection of manipulated e-commerce product ratings by examining the ratings of a product with other products whose ratings are untampered [8, 29], and uncover crowdsourced manipulation in large-scale…”
BackgroundRacketStore: measurements of ASO deception in Google play via mobile and app usage
Hernandez, N., Recabarren, R., Carbunar, B., & Ahmed, S. I. (2021) · Proceedings of the 21st ACM Internet Measurement Conference · doi:10.1145/3487552.3487837 · Cited by 4
“, that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50–53, 53, 57–”
Metadata
- Authors
- Cao, Q., Yang, X., Yu, J., & Palow, C.
- Affiliations
- Duke University (US)
- Meta (United States) (US)
- ORCID
- Yang, Xiaowei
- Venue
- Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2014-11-03
- Pages
- 477-488
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2125490153
- Cited by
- 274
- References
- 37
- Citations by year
- 2026: 7 · 2025: 8 · 2024: 13 · 2023: 18 · 2022: 17 · 2021: 32 · 2020: 40 · 2019: 31 · 2018: 39 · 2017: 38 · 2016: 18 · 2015: 13
- FWCI
- 19.62
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Division of Computer and Network Systems (CNS-0845858, CNS-1017858)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Law › Cybercrime and Law Enforcement Studies
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- malicious account detection, social networking sites, fake accounts, malware distribution, Hadoop, Giraph, Facebook, Instagram
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
