The DOI matches its Crossref record; 37 of the 37 references it cites were found in a registry or an index.
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Abstract
The success of online social networks has attracted a constant interest in attacking and exploiting them. Attackers usually control malicious accounts, including both fake and compromised real user accounts, to launch attack campaigns such as social spam, malware distribution, and online rating distortion. To defend against these attacks, we design and implement a malicious account detection system called SynchroTrap. We observe that malicious accounts usually perform loosely synchronized actions in a variety of social network context. Our system clusters user accounts according to the similarity of their actions and uncovers large groups of malicious accounts that act similarly at around the same time for a sustained period of time. We implement SynchroTrap as an incremental processing system on Hadoop and Giraph so that it can process the massive user activity data in a large online social network efficiently. We have deployed our system in five applications at Facebook and Instagram. SynchroTrap was able to unveil more than two million malicious accounts and 1156 large attack campaigns within one month.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions, e.g., that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50-53, 53, 5759, 65, 66, 84, 87, 88, 92].”
From RacketStore: measurements of ASO deception in Google play via mobile and app usage (2021) · cites this paper as [32]
In the citing paper
“Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Another one, SynchroTrap, relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Similar to CopyCatch [4] and SynchroTrap [10], the clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
Citations
Cites
Jain, A. K., Murty, M. N., & Flynn, P. J. (1999) · ACM Computing Surveys · doi:10.1145/331499.331504 · Cited by 13,925
THE DISTRIBUTION OF THE FLORA IN THE ALPINE ZONE. 1
Jaccard, P. (1912) · New Phytologist · doi:10.1111/j.1469-8137.1912.tb05611.x · Cited by 4,561
Malewicz, G. G., Austern, M. H., Bik, A. J. C., Dehnert, J. C., Horn, I., Leiser, N., & Czajkowski, G. (2010) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/1807167.1807184 · Cited by 3,518
Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007) · Communications of the ACM · doi:10.1145/1290958.1290968 · Cited by 1,156
Clustering high-dimensional data
Kriegel, H., Kröger, P., & Zimek, A. (2009) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1497577.1497578 · Cited by 1,095
Gu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
Nishtala, R., Fugal, H., Grimm, S., Kwiatkowski, M., Lee, H., Li, H. C., McElroy, R., Paleczny, M., Peek, D., Saab, P., et al. (2013) · Networked Systems Design and Implementation · Cited by 668
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570
All your contacts are belong to us
Bilge, L., Strufe, T., Balzarotti, D., & Kirda, E. (2009) · International World Wide Web Conference (WWW) · doi:10.1145/1526709.1526784 · Cited by 551
Internet quarantine: requirements for containing self-propagating code
Moore, D., Shannon, C., Voelker, G. M., & Savage, S. (2004) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2003.1209212 · Cited by 491
Kleitman, D. J., & Anderson, I. M. (1989) · American Mathematical Monthly · doi:10.2307/2325170 · Cited by 473
Aiding the detection of fake accounts in large scale social online services
Cao, Q., Sirivianos, M., Yang, X., & Pregueiro, T. (2012) · Cited by 449
Self-citationSuspended accounts in retrospect: an analysis of twitter spam
Thomas, K., Grier, C., Song, D., & Paxson, V. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068840 · Cited by 439
Data warehousing and analytics infrastructure at facebook
Thusoo, A., Shao, Z., Anthony, S., Borthakur, D., Jain, N., Sarma, J. S., Murthy, R., & Liu, H. (2010) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/1807167.1807278 · Cited by 428
Multilevel Algorithms for Multi-Constraint Graph Partitioning
Karypis, G., & Kumar, V. (1998) · doi:10.5555/509058.509086 · Cited by 346
Tsourakakis, C. E., Gkantsidis, C., Radunović, B., & Vojnović, M. (2014) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/2556195.2556213 · Cited by 344
Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G., & Osipkov, I. (2008) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1402946.1402979 · Cited by 339
CopyCatch: stopping group attacks by spotting lockstep behavior in social networks
Beutel, A., Xu, W., Guruswami, V., Palow, C., & Faloutsos, C. (2013) · Proceedings of the 22nd international conference on World Wide Web · doi:10.1145/2488388.2488400 · Cited by 335
Self-citationAn analysis of social network-based Sybil defenses
Viswanath, B., Post, A., Gummadi, K. P., & Mislove, A. E. (2010) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1851182.1851226 · Cited by 308
SybilGuard: defending against sybil attacks via social networks
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. (2006) · Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/1159913.1159945 · Cited by 260
Sybil-resilient online content voting
Tran, N. H. K., Min, B., Li, J., & Subramanian, L. (2009) · Cited by 256
You are how you click: Clickstream analysis for Sybil detection
Wang, G., Konolige, T., Wilson, C., Wang, X., Zheng, H.-T., & Zhao, B. Y. (2013) · Cited by 256
Worm propagation modeling and analysis under dynamic quarantine defense
Zou, C. C., Gong, W., & Towsley, D. (2003) · doi:10.1145/948187.948197 · Cited by 252
COMPA: Detecting Compromised Accounts on Social Networks.
Egele, M., Stringhini, G., Krügel, C., & Vigna, G. (2013) · Cited by 250
Trafficking fraudulent accounts: the role of the underground market in Twitter spam and abuse
Thomas, K., McCoy, D., Grier, C., Kolcz, A., & Paxson, V. (2013) · Cited by 239
Stein, T., Chen, E., & Mangla, K. (2011) · Proceedings of the 4th Workshop on Social Network Systems · doi:10.1145/1989656.1989664 · Cited by 219
Two-mode clustering methods: astructuredoverview
Mechelen, I. V., Bock, H., & Boeck, P. D. (2004) · Statistical Methods in Medical Research · doi:10.1191/0962280204sm373ra · Cited by 194
BotGraph: large scale spamming botnet detection
Zhao, Y., Xie, Y., Yu, F., Ke, Q., Yu, Y., Chen, Y., & Gillum, E. (2009) · Cited by 169
Uncovering social network sybils in the wild
Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068841 · Cited by 164
PEGASUS: mining peta-scale graphs
Kang, U., Tsourakakis, C. E., & Faloutsos, C. (2010) · Knowledge and Information Systems · doi:10.1007/s10115-010-0305-0 · Cited by 159
Detecting spammers with SNARE: spatio-temporal network-level automatic reputation engine
Hao, S., Syed, N. A., Feamster, N., Gray, A., & Krasser, S. (2009) · Cited by 144
Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G., & Osipkov, I. (2008) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1402958.1402979 · Cited by 123
Dirty jobs: the role of freelance labor in web service abuse
Motoyama, M., McCoy, D., Levchenko, K., Savage, S., & Voelker, G. M. (2011) · Cited by 94
Anderson, I. (2011) · CERN Document Server (European Organization for Nuclear Research) · Cited by 11
INTERSECTION PROBLEMS IN COMBINATORICS
Brunk, F. (2009) · St Andrews Research Repository (St Andrews Research Repository) · Cited by 4
Research works printed but not linked: 5
- Amazon EC2 Pricing . http://aws.amazon.com/ec2/pricing/ , 2013 . Amazon EC2 Pricing. http://aws.amazon.com/ec2/pricing/, 2013.
- Apache Giraph . http://giraph.apache.org/ , 2013 . Apache Giraph. http://giraph.apache.org/, 2013.
- Apache Hadoop . http://hadoop.apache.org/ , 2013 . Apache Hadoop. http://hadoop.apache.org/, 2013.
- Facebook Reports Fourth Quarter and Full Year 2012 Results . http://investor.fb.com/releasedetail.cfm?ReleaseID=736911 , 2013 . Facebook Reports Fourth Quarter and Full Year 2012 Results. http://investor.fb.com/releasedetail.cfm?ReleaseID=736911, 2013.
- Types of cookies used by Google . http://www.google.com/policies/technologies/types/ , 2013 . Types of cookies used by Google. http://www.google.com/policies/technologies/types/, 2013.
Cited by
Sorted by citations
Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016) · Communications of the ACM · doi:10.1145/2818717 · Cited by 1,973
“2013], SynchroTrap [Cao et al. 2014], and the Renren Sybil detector [Wang et al.”
ResultHeterogeneous Graph Neural Networks for Malicious Account Detection
Liu, Z., Chen, C., Yang, X., Zhou, J., Li, X., & Song, L. (2018) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3269206.3272010 · Cited by 435
“Unlike existing methods that one first studies the graph properties [15] or pairwise comparisons of account activities [5], then feeds into a machine learning framework, our proposed method directly learns a function for each account given the context of the local topology and”
BackgroundMethodSelf-citationThe Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Proceedings of the 26th International Conference on World Wide Web Companion - WWW '17 Companion · doi:10.1145/3041021.3055135 · Cited by 381
“[9] detection of loosely synchronized actions”
Political Astroturfing on Twitter: How to Coordinate a Disinformation Campaign
Keller, F. B., Schoch, D., Stier, S., & Yang, J. (2020) · Political Communication · doi:10.1080/10584609.2019.1661888 · Cited by 378
The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race
Cresci, S., Pietro, R. D., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) · doi:10.48550/arxiv.1701.03017 · Cited by 237
“[9] detection of loosely synchronized actions”
Metadata
- Authors
- Cao, Q., Yang, X., Yu, J., & Palow, C.
- Affiliations
- Duke University (US)
- Meta (United States) (US)
- ORCID
- Yang, Xiaowei
- Venue
- Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2014-11-03
- Pages
- 477-488
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2125490153
- Cited by
- 274
- References
- 37
- Citations by year
- 2026: 7 · 2025: 8 · 2024: 13 · 2023: 18 · 2022: 17 · 2021: 32 · 2020: 40 · 2019: 31 · 2018: 39 · 2017: 38 · 2016: 18 · 2015: 13
- FWCI
- 19.62
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Division of Computer and Network Systems (CNS-0845858, CNS-1017858)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Law › Cybercrime and Law Enforcement Studies
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- malicious account detection, social networking sites, fake accounts, malware distribution, Hadoop, Giraph, Facebook, Instagram
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
