The DOI matches its Crossref record; 37 of the 37 references it cites were found in a registry or an index.
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Abstract
The success of online social networks has attracted a constant interest in attacking and exploiting them. Attackers usually control malicious accounts, including both fake and compromised real user accounts, to launch attack campaigns such as social spam, malware distribution, and online rating distortion. To defend against these attacks, we design and implement a malicious account detection system called SynchroTrap. We observe that malicious accounts usually perform loosely synchronized actions in a variety of social network context. Our system clusters user accounts according to the similarity of their actions and uncovers large groups of malicious accounts that act similarly at around the same time for a sustained period of time. We implement SynchroTrap as an incremental processing system on Hadoop and Giraph so that it can process the massive user activity data in a large online social network efficiently. We have deployed our system in five applications at Facebook and Instagram. SynchroTrap was able to unveil more than two million malicious accounts and 1156 large attack campaigns within one month.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions, e.g., that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50-53, 53, 5759, 65, 66, 84, 87, 88, 92].”
From RacketStore: measurements of ASO deception in Google play via mobile and app usage (2021) · cites this paper as [32]
In the citing paper
“Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Another one, SynchroTrap, relies on the fact that malicious accounts usually perform loosely synchronized actions in a variety of social network context, and can cluster malicious accounts that act similarly at around the same time for a sustained period of time [10].”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“Similar to CopyCatch [4] and SynchroTrap [10], the clusters identified in the user-page bipartite graph represent near-bipartite cores, and the set of users in a near-bipartite core like the same set of pages.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
In the citing paper
“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”
From Measuring, Characterizing, and Detecting Facebook Like Farms (2017) · cites this paper as [10]
Citations
Cites
Jain, A. K., Murty, M. N., & Flynn, P. J. (1999) · ACM Computing Surveys · doi:10.1145/331499.331504 · Cited by 13,925
THE DISTRIBUTION OF THE FLORA IN THE ALPINE ZONE. 1
Jaccard, P. (1912) · New Phytologist · doi:10.1111/j.1469-8137.1912.tb05611.x · Cited by 4,561
Malewicz, G. G., Austern, M. H., Bik, A. J. C., Dehnert, J. C., Horn, I., Leiser, N., & Czajkowski, G. (2010) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/1807167.1807184 · Cited by 3,518
Jagatic, T. N., Johnson, N. A., Jakobsson, M., & Menczer, F. (2007) · Communications of the ACM · doi:10.1145/1290958.1290968 · Cited by 1,156
Clustering high-dimensional data
Kriegel, H., Kröger, P., & Zimek, A. (2009) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1497577.1497578 · Cited by 1,095
Gu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
Nishtala, R., Fugal, H., Grimm, S., Kwiatkowski, M., Lee, H., Li, H. C., McElroy, R., Paleczny, M., Peek, D., Saab, P., et al. (2013) · Networked Systems Design and Implementation · Cited by 668
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570
Research works printed but not linked: 5
- Amazon EC2 Pricing . http://aws.amazon.com/ec2/pricing/ , 2013 . Amazon EC2 Pricing. http://aws.amazon.com/ec2/pricing/, 2013.
- Apache Giraph . http://giraph.apache.org/ , 2013 . Apache Giraph. http://giraph.apache.org/, 2013.
- Apache Hadoop . http://hadoop.apache.org/ , 2013 . Apache Hadoop. http://hadoop.apache.org/, 2013.
- Facebook Reports Fourth Quarter and Full Year 2012 Results . http://investor.fb.com/releasedetail.cfm?ReleaseID=736911 , 2013 . Facebook Reports Fourth Quarter and Full Year 2012 Results. http://investor.fb.com/releasedetail.cfm?ReleaseID=736911, 2013.
- Types of cookies used by Google . http://www.google.com/policies/technologies/types/ , 2013 . Types of cookies used by Google. http://www.google.com/policies/technologies/types/, 2013.
Cited by
Sorted by citations
Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016) · Communications of the ACM · doi:10.1145/2818717 · Cited by 1,973
“2013], SynchroTrap [Cao et al. 2014], and the Renren Sybil detector [Wang et al.”
ResultHeterogeneous Graph Neural Networks for Malicious Account Detection
Liu, Z., Chen, C., Yang, X., Zhou, J., Li, X., & Song, L. (2018) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3269206.3272010 · Cited by 435
“Unlike existing methods that one first studies the graph properties [15] or pairwise comparisons of account activities [5], then feeds into a machine learning framework, our proposed method directly learns a function for each account given the context of the local topology and”
BackgroundMethodSelf-citationThe Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Proceedings of the 26th International Conference on World Wide Web Companion - WWW '17 Companion · doi:10.1145/3041021.3055135 · Cited by 381
“[9] detection of loosely synchronized actions”
Political Astroturfing on Twitter: How to Coordinate a Disinformation Campaign
Keller, F. B., Schoch, D., Stier, S., & Yang, J. (2020) · Political Communication · doi:10.1080/10584609.2019.1661888 · Cited by 378
The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race
Cresci, S., Pietro, R. D., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) · doi:10.48550/arxiv.1701.03017 · Cited by 237
“[9] detection of loosely synchronized actions”
Metadata
- Authors
- Cao, Q., Yang, X., Yu, J., & Palow, C.
- Affiliations
- Duke University (US)
- Meta (United States) (US)
- ORCID
- Yang, Xiaowei
- Venue
- Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2014-11-03
- Pages
- 477-488
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2125490153
- Cited by
- 274
- References
- 37
- Citations by year
- 2026: 7 · 2025: 8 · 2024: 13 · 2023: 18 · 2022: 17 · 2021: 32 · 2020: 40 · 2019: 31 · 2018: 39 · 2017: 38 · 2016: 18 · 2015: 13
- FWCI
- 19.62
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- Division of Computer and Network Systems (CNS-0845858, CNS-1017858)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Law › Cybercrime and Law Enforcement Studies
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- malicious account detection, social networking sites, fake accounts, malware distribution, Hadoop, Giraph, Facebook, Instagram
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
