Measuring, Characterizing, and Detecting Facebook Like Farms

Like farm accounts' posts generate significantly more comments and likes than normal users' posts.

“Moreover, like farm accounts' posts generate significantly more comments and likes, and a much larger fraction of their posts consists of 'shared activity' (i.e., sharing posts from other users, news articles, videos, and external URLs).”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

The SVM classifier achieves higher accuracy across the board than decision tree, AdaBoost, kNN, random forest, and naive Bayes.

“Finally, we generalize our approach using other classification algorithms, namely, decision tree [7], AdaBoost [20], kNN [1], random forest [6], and na¨ ıve Bayes [55], and empirically confirm that the SVM classifier achieves higher accuracy across the board.”

Like farm accounts more often generate duplicate comments and likes compared to normal users.

“We find that like farm accounts tend to re-share content more often, use fewer words and poorer vocabulary, and more often generate duplicate comments and likes compared to normal users.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

Timeline posts by like farm accounts have 43% fewer words than normal users' posts.

“In particular, we find that timeline posts by like farm accounts have 43% fewer words, a more limited vocabulary, and lower readability than normal users' posts.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

For the first four Facebook campaigns (FB-USA, FB-FRA, FB-IND, FB-EGY), we mainly received likes from the targeted country (87-99.8%).

“as shown in Figure 1, for the first four Facebook campaigns (FB-USA, FB-FRA, FB-IND, FB-EGY), we mainly received likes from the targeted country (87-99.8%), even though FB-USA and FB-FRA generated a number of likes much smaller than any other campaign.”

Like farm accounts tend to re-share content more often than normal users.

“We find that like farm accounts tend to re-share content more often, use fewer words and poorer vocabulary, and more often generate duplicate comments and likes compared to normal users.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

When we targeted Facebook users worldwide (FB-ALL), we almost exclusively received likes from India (96%).

“When we targeted Facebook users worldwide (FB-ALL), we almost exclusively received likes from India (96%).”

Facebook's currently deployed fraud detection algorithms do not work well to detect stealthy farms which spread likes over longer timespans and like popular pages to mimic regular users.

“Next, we look at fraud detection algorithms currently deployed by Facebook and show that they do not work well to detect stealthy farms which spread likes over longer timespans and like popular pages to mimic regular users.”

A much larger fraction of like farm accounts' posts consists of 'shared activity' (sharing posts from other users, news articles, videos, and external URLs) than normal users' posts.

“Moreover, like farm accounts' posts generate significantly more comments and likes, and a much larger fraction of their posts consists of 'shared activity' (i.e., sharing posts from other users, news articles, videos, and external URLs).”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

Timeline posts by like farm accounts have a more limited vocabulary than normal users' posts.

“In particular, we find that timeline posts by like farm accounts have 43% fewer words, a more limited vocabulary, and lower readability than normal users' posts.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

Classifiers using timeline-based features achieve 99-100% precision and 93-97% recall in detecting like farm accounts.

“We evaluate the classifiers using the ground-truth dataset of like farm accounts and show that they achieve 99-100% precision and 93-97% recall in detecting like farm accounts.”

Like farm accounts have poorer vocabulary than normal users.

“We find that like farm accounts tend to re-share content more often, use fewer words and poorer vocabulary, and more often generate duplicate comments and likes compared to normal users.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

When targeting Facebook users worldwide, likes are obtained from only a few countries.

“When targeting Facebook users worldwide, we obtain likes from only a few countries, and that likers' profiles seem skewed toward males.”

These three campaigns also appear to be skewed toward male profiles.

“These three campaigns also appear to be skewed toward male profiles.”

Most likers from SocialFormula were based in Turkey, regardless of whether we requested a US-only campaign.

“Looking at the like farms, most likers from SocialFormula were based in Turkey, regardless of whether we requested a US-only campaign.”

Like farm accounts use fewer words than normal users.

“We find that like farm accounts tend to re-share content more often, use fewer words and poorer vocabulary, and more often generate duplicate comments and likes compared to normal users.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

All like farm campaigns, except BoostLikes, exhibit a very similar trend with a few bursts of a large number of likes.

“We observe from Figure 2(a) that all the like farm campaigns, except BoostLikes, exhibit a very similar trend with a few bursts of a large number of likes.”

Graph-based co-clustering fraud detection algorithms incur high false positive rates for stealthy farms, as their accounts mimic normal users.

“We show that these tools incur high false positives rates for stealthy farms, as their accounts mimic normal users.”

Different like farms (with different pricing schemes) garner likes from overlapping sets of users.

“Moreover, we find evidence that different like farms (with different pricing schemes) garner likes from overlapping sets of users and, thus, may be managed by the same operator.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

We collected a total of 6,222 likes (4,453 from like farms and 1,769 from Facebook ads).

“Overall, we collected a total of 6,222 likes (4,453 from like farms and 1,769 from Facebook ads).”

For SocialFormula, AuthenticLikes, and MammothSocials campaigns, likes were garnered within a short period of time of two hours.

“Specifically, for the SocialFormula, AuthenticLikes, and MammothSocials campaigns, likes were garnered within a short period of time of two hours.”

Timeline posts by like farm accounts have lower readability than normal users' posts.

“In particular, we find that timeline posts by like farm accounts have 43% fewer words, a more limited vocabulary, and lower readability than normal users' posts.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

BoostLikes accounts have dense connectivity compared to accounts belonging to SocialFormula, AuthenticLikes, and MammothSocials.

“The distributions demonstrate that BoostLikes accounts have dense connectivity as compared to accounts belonging to SocialFormula, AuthenticLikes, and MammothSocials.”

The page like counts of the baseline sample mirrored numbers reported in prior work, e.g., according to [28], the average number of pages liked by Facebook users amounts to roughly 40.

“The page like counts of our baseline sample mirrored numbers reported in prior work, e.g., according to [28], the average number of pages liked by Facebook users amounts to roughly 40.”

• cites [28] [28] J. Lafferty. How Many Pages Does The Average Facebook User Like? http://allfacebook.com/ how-many-pages-does-the-average-facebook-user-like b115098, 2013. -Not checked yet

  Not checked in the free run.

The BoostLikes network is well-connected.

“In contrast, the BoostLikes network is well-connected.”

FB-IND, FB-EGY, and FB-ALL have relatively large Jaccard similarity with each other.

“Note from Figure 6 that FB-IND, FB-EGY, and FB-ALL have relatively large (Jaccard) similarity with each other.”

In Summer 2015, 624 out of 5,616 accounts (11%) were no longer active.

“In Summer 2015, we checked how many accounts had been closed or terminated and found that 624 out of 5,616 accounts (11%) were no longer active.”

For SocialFormula, AuthenticLikes, and MammothSocials, many isolated pairs and triplets of likers are not connected.

“For SocialFormula, AuthenticLikes, and MammothSocials, we also observe many isolated pairs and triplets of likers who are not connected.”

Users of AL-ALL like farm generate many more comments than the baseline users.

“In Figure 8(a), we plot the distributions of the number of comments a post attracts, revealing that users of AL-ALL like farm generate many more comments than the baseline users.”

A significant fraction of users liked pages corresponding to both the AuthenticLikes and the MammothSocials campaigns.

“A significant fraction of users actually liked pages corresponding to both the AuthenticLikes and the MammothSocials campaigns (see Figure 5): we put these users into a separate group, labelled as ALMS.”

BoostLikes accounts have higher degree than other like farms.

“BoostLikes accounts have higher degree, are part of more triangles, have higher clustering coefficient, and have larger maximal cliques than other like farms.”

Honeypot pages attracted users that tend to like significantly more pages than regular Facebook users.

“In other words, our honeypot pages attracted users that tend to like significantly more pages than regular Facebook users.”

Roughly half of the users in four of the like farms (AL-ALL, BL-USA, SF-ALL, and SF-USA) use 10 or less words in their posts, versus 17 words by baseline users.

“Roughly half of the users in four of the like farms (AL-ALL, BL-USA, SFALL, and SF-USA) use 10 or less words in their posts, versus 17 words by baseline users.”

The average number of friends of users associated with the BoostLikes campaign (and to a smaller extent, the AuthenticLikes campaign) was much higher than the average number of friends observed elsewhere.

“The average number of friends of users associated with the BoostLikes campaign (and to a smaller extent, the AuthenticLikes campaign) was much higher than the average number of friends observed elsewhere.”

The horizontal false positive streaks in BL-USA include popular pages, such as 'Fast & Furious' and 'SpongeBob SquarePants,' each with millions of likes.

“Further analysis reveals that the horizontal false positive streaks in BL-USA include popular pages, such as 'Fast & Furious' and 'SpongeBob SquarePants,' each with millions of likes.”

There is large variance in the number of pages liked, ranging from 1 to 10,000.

“We observed a large variance in the number of pages liked, ranging from 1 to 10,000.”

BoostLikes accounts have larger maximal cliques than other like farms.

“BoostLikes accounts have higher degree, are part of more triangles, have higher clustering coefficient, and have larger maximal cliques than other like farms.”

Posts of like farm users attract much more likes than those of baseline users.

“Next, Figure 8(b) shows the number of likes associated with users' posts, highlighting that posts of like farm users attract much more likes than those of baseline users.”

The median page like count for the baseline Facebook user sample was 34.

“In contrast, the median page like count for our baseline Facebook user sample was 34.”

Posts of like farm users tend to have fewer words.

“Figure 8(d) plots the distributions of number of words that make up a text-based post, highlighting that posts of like farm users tend to have fewer words.”

BL-USA is almost identical to the baseline users in number of comments.

“We note that BL-USA is almost identical to the baseline users.”

There are relations between likers from the same provider.

“Figure 3(b) plots the relations between likers who either have a direct relation or a mutual friend, clearly pointing to the presence of relations between likers from the same provider.”

BoostLikes accounts are part of more triangles than other like farms.

“BoostLikes accounts have higher degree, are part of more triangles, have higher clustering coefficient, and have larger maximal cliques than other like farms.”

BoostLikes accounts have higher clustering coefficient than other like farms.

“BoostLikes accounts have higher degree, are part of more triangles, have higher clustering coefficient, and have larger maximal cliques than other like farms.”

When like farm users target sets of 8 features including prominent ones, the F1-Score of the classifier decreases by between 26% and 56%.

“The F1-Score of our classifier decreases by between 26% to 56% when the like farm users target sets of 8 features including prominent ones (cf. Figure 10).”

• AssumptionThe authors state this as an assumption: Fractions of like farm users mimic all features of baseline users, and all like farm users mimic sets of baseline users' features.
• AssumptionThe authors state this as an assumption: In the latter case, all like farm users coordinate and select sets of features from randomly selected baseline users that they copy or mimic.

Like farm accounts' posts have 43% fewer words than normal users' posts.

“In particular, we find that posts made by like farm accounts have 43% fewer words, a more limited vocabulary, and lower readability than normal users' posts.”

The two-class SVM is the most effective in detecting like farm users compared to Decision Tree, AdaBoost, kNN, Random Forest, and Naïve Bayes.

“We later compare this classifier with other well-known supervised classifiers such as Decision Tree [7], AdaBoost [20], kNN [1], Random Forest [6], and Na¨ ıve Bayes [55] and confirm that the two-class SVM is the most effective in detecting like farms users.”

• cites [7] [7] L. Breiman, J. Friedman, C. J. Stone, and R. A. Olshen. Classification and regression trees . CRC press, 1984. -Not checked yet

  Not checked in the free run.

• cites [20] [20] Y. Freund and R. E. Schapire. A decision-theoretic generalization of on-line learning and an application to boosting. J. Comput. Syst. Sci. , 1997. - sourceNot checked yet

  Not checked in the free run.

• cites [1] [1] A. Andoni and P. Indyk. Near-optimal hashing algorithms for approximate nearest neighbor in high dimensions. Communications of the ACM , 2008. - sourceNot checked yet

  Not checked in the free run.

A large fraction of like farm posts consists of non-original and often redundant 'shared activity'.

“Moreover, like farm posts generated significantly more comments and likes, and a large fraction of their posts consists of non original and often redundant 'shared activity' (i.e., repeatedly sharing posts made by other users, articles, videos, and external URLs).”

The paper's evaluation of graph co-clustering techniques shows that sophisticated like farms successfully evade detection by avoiding lockstep behavior and liking sets of seemingly random pages.

“In fact, our evaluation of graph co-clustering techniques shows that these farms successfully evade detection by avoiding lockstep behavior and liking sets of seemingly random pages.”

Baseline users have higher ARI than like farm users (20 vs. 15).

“In comparison to like farm users, baseline users post text with higher lexical richness (70% vs. 55%), ARI (20 vs. 15), and Flesch score (55 vs. 48), thus suggesting that normal users use a richer vocabulary and that their posts have higher readability.”

When only one feature is mimicked, the F1-Score of the approach decreases by between 1% and 8%.

“With this attack strategy, we observe that when only one feature is mimicked, the F1-Score of our approach (cf. Table 9) decreases by between 1% to 8%.”

• AssumptionThe authors state this as an assumption: Fractions of like farm users mimic all features of baseline users, and all like farm users mimic sets of baseline users' features.
• AssumptionThe authors state this as an assumption: In the latter case, all like farm users coordinate and select sets of features from randomly selected baseline users that they copy or mimic.

A large fraction of like farm users' posts consists of non-original and often redundant 'shared activity'.

“Moreover, like farm users generate significantly more comments and likes and a large fraction of their posts consists of non-original and often redundant 'shared activity'.”

Baseline users have higher lexical richness than like farm users (70% vs. 55%).

“In comparison to like farm users, baseline users post text with higher lexical richness (70% vs. 55%), ARI (20 vs. 15), and Flesch score (55 vs. 48), thus suggesting that normal users use a richer vocabulary and that their posts have higher readability.”

The combined lexical and non-lexical classifier shows high accuracy for all like farms (F1-Score ≥ 96%).

“Results are summarized in Table 9, which shows high accuracy for all like farms (F1-Score ≥ 96%), thus confirming the effectiveness of our timeline-based features in detecting like farm users.”

Like farm accounts' posts have lower readability than normal users' posts.

“In particular, we find that posts made by like farm accounts have 43% fewer words, a more limited vocabulary, and lower readability than normal users' posts.”

Average word length and average number of words per post provide the most improvement in F1-Score for all campaigns.

“We observe that the average word length (cf. Figure 10(a)) and average number of words per post (cf. Figure 10(b)) provide the most improvement in the F1-Score for all campaigns.”

Like farm posts generated significantly more comments and likes than normal users' posts.

“Moreover, like farm posts generated significantly more comments and likes, and a large fraction of their posts consists of non original and often redundant 'shared activity' (i.e., repeatedly sharing posts made by other users, articles, videos, and external URLs).”

Approximately 3% to 22% of like farm users and 14% of baseline users do not have English language posts and are not considered in the lexical features based classification.

“We also note that approximately 3% to 22% of like farm users and 14% of baseline users do not have English language posts and are not considered in the lexical features based classification.”

Like farm accounts' posts have a more limited vocabulary than normal users' posts.

“In particular, we find that posts made by like farm accounts have 43% fewer words, a more limited vocabulary, and lower readability than normal users' posts.”

Accuracy decreases by approximately 8% for SF-USA with lexical features.

“Although the accuracy decreases by approximately 8% for SF-USA, the overall performance suggests that lexical features are useful in automatically detecting like farm users.”

The paper demonstrated that sophisticated like farms can successfully evade detection by existing graph-based fraud detection algorithms such as CopyCatch and SynchroTrap.

“We then evaluated the effectiveness of existing graph based fraud detection algorithms, such as CopyCatch [4] and SynchroTrap [10], and demonstrated that sophisticated like farms can successfully evade detection.”

• cites [4] [4] A. Beutel, W. Xu, V. Guruswami, C. Palow, and C. Faloutsos. CopyCatch: Stopping Group Attacks by Spotting Lockstep Behavior in Social Networks. In WWW , 2013. - sourceNot checked yet

  Not checked in the free run.

• cites [10] [10] Q. Cao, X. Yang, J. Yu, and C. Palow. Uncovering Large Groups of Active Malicious Accounts in Online Social Networks. In CCS , 2014. - sourceNot checked yet

  Not checked in the free run.

Like farm users generate significantly more comments and likes than normal users.

“Moreover, like farm users generate significantly more comments and likes and a large fraction of their posts consists of non-original and often redundant 'shared activity'.”

The paper's demographic, temporal, and social graph analysis highlighted similar patterns between accounts across different like farms.

“Our demographic, temporal, and social graph analysis highlighted similar patterns between accounts across different like farms and revealed two main modi operandi: some farms seem to be operated by bots and do not really try to hide the nature of their operations, while others follow a stealthier approach, mimicking regular users' behavior.”

The paper introduces an empirical evaluation demonstrating that temporal and social graph analysis can only be used to detect naive farms.

“we introduce an empirical evaluation demonstrating that temporal and social graph analysis can only be used to detect naive farms (Section 3)”

The approach has a low false positive ratio (≪ 1%).

“The low false positive ratio ( ≪ 1%, cf. Table 9) highlights the effectiveness of our approach as well as the limitations of prior graph co-clustering algorithms in detecting like farms users (cf. Section 3).”

Baseline users have higher Flesch score than like farm users (55 vs. 48).

“In comparison to like farm users, baseline users post text with higher lexical richness (70% vs. 55%), ARI (20 vs. 15), and Flesch score (55 vs. 48), thus suggesting that normal users use a richer vocabulary and that their posts have higher readability.”

An ecosystem of like farms has emerged that offers paid services to artificially inflate the number of likes on Facebook pages.

“At the same time, as the number of likes on a Facebook page is considered a measure of its popularity [11], an ecosystem of so-called 'like farms' has emerged that offers paid services to artificially inflate the number of likes on Facebook pages.”

• cites [50] [50] B. Viswanath, M. A. Bashir, M. Crovella, S. Guha, K. P. Gummadi, B. Krishnamurthy, and A. Mislove. Towards Detecting Anomalous User Behavior in Online Social Networks. In Usenix Security , 2014. -Not checked yet

  Not checked in the free run.

A majority of Facebook users do not set the visibility of their age and location to public.

“Since a majority of Facebook users do not set the visibility of their age and location to public [13], we used these reports to collect statistics about likers' gender, age, country, home and current town.”

• cites [13] [13] A. Chaabane, G. Acs, and M. A. Kaafar. You Are What You Like! Information Leakage Through Users' Interests. In NDSS , 2012. -Not checked yet

  Not checked in the free run.

Other like farms follow a stealthier approach, mimicking regular users' behavior.

“First, we analyze likes based on demographic, temporal, and social characteristics, and find that some farms seem to be operated by bots and do not really try to hide the nature of their operations, while others follow a stealthier approach, mimicking regular users' behavior.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

Stealthier like farms can successfully circumvent graph-based fraud detection methods by spreading likes over longer timespans and liking popular pages to mimic normal users.

“The issue with these methods, however, is that stealthier (and more expensive) like farms can successfully circumvent them by spreading likes over longer timespans and liking popular pages to mimic normal users.”

The abrupt increase in cumulative number of likes during a short period of time might likely be due to automated scripts operating a set of fake profiles.

“On the one hand, the abrupt increase in the cumulative number of likes happening during a short period of time might likely be due to automated scripts operating a set of fake profiles.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

Two different strategies may be adopted by like farms.

“This suggests that two different strategies may be adopted by like farms.”

BoostLikes's strategy seems to rely on the underlying social graph, possibly constituted by fake profiles operated by humans.

“On the other hand, BoostLikes's strategy, which resembles the temporal evolution in Facebook campaigns, seems to rely on the underlying social graph, possibly constituted by fake profiles operated by humans.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

Different like farms may be managed by the same operator.

“Moreover, we find evidence that different like farms (with different pricing schemes) garner likes from overlapping sets of users and, thus, may be managed by the same operator.”

• AssumptionThe authors state this as an assumption: Likers from farms that like empty honeypot pages are either fake or compromised real users (fake likes).

The experiments use, as ground truth, the Facebook accounts gathered as part of the honeypot-based measurement of like farms.

“Our experiments use, as ground truth, the Facebook accounts gathered as part of the honeypot-based measurement of like farms.”

The same fake profiles are used in multiple campaigns by a like farm (e.g., SF-ALL and SF-USA).

“These findings suggest that the same fake profiles are used in multiple campaigns by a like farm (e.g., SF-ALL and SFUSA).”

The results highlight the limitations of prior graph co-clustering algorithms in detecting fake likes by like farm accounts.

“Our results highlight the limitations of prior graph coclustering algorithms in detecting fake likes by like farm accounts.”

A vast majority of the garnered likes are fake.

“Since our honeypot pages both for Facebook and like farm campaigns explicitly indicated they were not 'real', we argue that a vast majority of the garnered likes are fake.”

These tools use graph co-clustering algorithms to detect large groups of malicious accounts that like similar pages around the same time frame.

“These tools use graph co-clustering algorithms to detect large groups of malicious accounts that like similar pages around the same time frame.”

The findings do not necessarily imply that advertising on Facebook is ineffective, since the campaigns were specifically designed to avert real users.

“We stress that our findings do not necessarily imply that advertising on Facebook is ineffective, since our campaigns were specifically designed to avert real users.”

Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].

“Aiming to counter fraudulent activities, including like farms, Facebook has recently deployed detection tools such as CopyCatch [4] and SynchroTrap [10].”

• cites [4] [4] A. Beutel, W. Xu, V. Guruswami, C. Palow, and C. Faloutsos. CopyCatch: Stopping Group Attacks by Spotting Lockstep Behavior in Social Networks. In WWW , 2013. - sourceNot checked yet

  Not checked in the free run.

• cites [10] [10] Q. Cao, X. Yang, J. Yu, and C. Palow. Uncovering Large Groups of Active Malicious Accounts in Online Social Networks. In CCS , 2014. - sourceNot checked yet

  Not checked in the free run.

The observed tight connections and number of friends suggest that only a small part of these networks is visible.

“These tight connections, along with the number of their friends, suggest that we only see a small part of these networks.”

Some fake profiles seem to be shared by different like farms (e.g., AL-USA and MS-USA), suggesting that they are run by the same operator.

“Moreover, some fake profiles seem to be shared by different like farms (e.g., AL-USA and MS-USA), suggesting that they are run by the same operator.”

The word frequency approach to analyze short text on social media and blogs does not perform well.

“Indeed, [22] has shown that the word frequency approach to analyze short text on social media and blogs does not perform well.”

• cites [22] [22] A. Hogenboom, F. Frasincar, F. de Jong, and U. Kaymak. Using Rhetorical Structure in Sentiment Analysis. Communications of the ACM , 58(7), June 2015. - sourceNot checked yet

  Not checked in the free run.

Fake liking activity is challenging to detect when only relying on monitoring the liking activity due to the increased sophistication of stealthier like farms.

“We argue that fake liking activity is challenging to detect when only relying on monitoring the liking activity due to the increased sophistication of stealthier like farms.”

English-based lexical analysis provides sufficient differences across different categories of users.

“While our analysis could be extended to other languages, we argue that English-based lexical analysis provides sufficient differences across different categories of users.”

Timeline-based features are effective in detecting like farm users.

“Results are summarized in Table 9, which shows high accuracy for all like farms (F1-Score ≥ 96%), thus confirming the effectiveness of our timeline-based features in detecting like farm users.”

Should the proposed techniques be deployed by Facebook, it will be challenging and costly for fraudsters to modify their behavior and evade detection, because this would require instructing automated scripts and/or cheap human labor to match the diversity and richness of real users' timeline posts.

“As a result, we argue that, should our proposed techniques be deployed by Facebook, it will be challenging, as well as costly, for fraudsters to modify their behavior and evade detection, since this would require instructing automated scripts and/or cheap human labor to match the diversity and richness of real users' timeline posts.”

• AssumptionRests on an assumption: Like farms typically rely on pre-defined lists of comments, resulting in word repetition and lower lexical richness.
• AssumptionRests on an assumption: Like farms either heavily automate mechanisms or rely on manual input of cheap human labor.

Combining several features increases the workload required to appear real on like farm accounts.

“Therefore, combining several features increases the workload required to appear real on like farm accounts.”

Increasing word length or number of words per post in a way that is not readable or understandable will not improve the overall outlook of the account to appear real.

“That is, increasing word length and number of words on posts in a way that is not readable nor understandable, will not improve the overall outlook of the account to appear real.”

The poor classification performance for the stealthiest like farm (BL-USA) suggests that non-lexical features alone are not sufficient to accurately detect like farm users.

“The poor classification performance for the stealthiest like farm (BL-USA) suggests that non-lexical features alone are not sufficient to accurately detect like farm users.”

The paper's work differs from prior passive measurement studies by relying on deployment of several honeypot pages and paid campaigns to actively engage with fake profiles.

“Our work differs from these studies as they all conducted passive measurements, whereas we rely on the deployment of several honeypot pages and (paid) campaigns to actively engage with fake profiles.”

Unlike prior honeypot studies, the paper leverages timeline-based features for detection of fake accounts.

“Unlike [30, 44], we leverage timeline-based features for the detection of fake accounts.”

• cites [30] [30] K. Lee, J. Caverlee, and S. Webb. Uncovering Social Spammers: Social Honeypots + Machine Learning. In SIGIR , 2010. - sourceNot checked yet

  Not checked in the free run.

• cites [44] [44] G. Stringhini, C. Kruegel, and G. Vigna. Detecting Spammers on Social Networks. In ACSAC , 2010. - sourceNot checked yet

  Not checked in the free run.

Random Forest and Naïve Bayes show poor classification results due to overfitting on the dataset.

“Due to overfitting on our dataset, Random Forest and Na¨ ıve Bayes show poor results”

The analysis of user timelines highlights several differences in both lexical and non-lexical features of normal and like farm users.

“Our analysis of user timelines highlights several differences in both lexical and non-lexical features of normal and like farm users.”

The cost to interfere with lexical features would be even higher because it would entail modifying or imitating normal users' writing style.

“Even higher would be the cost to interfere with lexical features, since this would entail modifying or imitating normal users' writing style.”

It is possible to accurately detect like farm users from both sophisticated and naïve farms by incorporating additional account information, specifically timeline activities.

“Our results demonstrate that it is possible to accurately detect like farm users from both sophisticated and na¨ ıve farms by incorporating additional account information - specifically, timeline activities.”

The use of a variety of lexical and non-lexical features will make it difficult for like farm operators to circumvent detection.

“We also argue that the use of a variety of lexical and non-lexical features will make it difficult for like farm operators to circumvent detection.”

• AssumptionRests on an assumption: Like farms typically rely on pre-defined lists of comments, resulting in word repetition and lower lexical richness.

Prior graph co-clustering algorithms have limitations in detecting like farm users.

“The low false positive ratio ( ≪ 1%, cf. Table 9) highlights the effectiveness of our approach as well as the limitations of prior graph co-clustering algorithms in detecting like farms users (cf. Section 3).”

Any feature used to identify fake like farm behavior can be circumvented or manipulated by like farm users by behaving more like real users.

“Note that any feature used to identify fake like farms behavior can be either circumvented or manipulated by the like farms users by behaving more like real users.”

Lexical features are useful in automatically detecting like farm users.

“Although the accuracy decreases by approximately 8% for SF-USA, the overall performance suggests that lexical features are useful in automatically detecting like farm users.”

The paper presents a novel timeline-based classifier geared to detect accounts from stealthy like farms with a remarkably high degree of accuracy.

“we present a novel timeline-based classifier geared to detect accounts from stealthy like farms with a remarkably high degree of accuracy (Sections 4 and 5).”

Imitating normal users' behaviors will likely incur a remarkably higher cost because non-lexical features are extracted from users' interactions with timeline posts.

“Since non-lexical features are extracted from users' interactions with timeline posts, imitating normal users' behaviors will likely incur an remarkably higher cost.”

• AssumptionRests on an assumption: Like farms either heavily automate mechanisms or rely on manual input of cheap human labor.

Prior work has focused extensively on analysis and detection of sybil and/or fake accounts in online social networks by relying on tightly-knit community structures.

“Prior work has focused quite extensively on the analysis and the detection of sybil and/or fake accounts in online social networks by relying on tightly-knit community structures [54, 15, 53, 9, 52, 5].”

• cites [54] [54] H. Yu, M. Kaminsky, P. B. Gibbons, and A. Flaxman. SybilGuard: Defending Against Sybil Attacks via Social Networks. In SIGCOMM , 2006. - sourceNot checked yet

  Not checked in the free run.

• cites [15] [15] G. Danezis and P. Mittal. SybilInfer: Detecting Sybil Nodes using Social Networks. In NDSS , 2009. -Not checked yet

  Not checked in the free run.

• cites [53] [53] Z. Yang, C. Wilson, X. Wang, T. Gao, B. Y. Zhao, and Y. Dai. Uncovering Social Network Sybils in the Wild. In ACM IMC , 2011. - sourceNot checked yet

  Not checked in the free run.

• cites [9] [9] Q. Cao, M. Sirivianos, X. Yang, and T. Pregueiro. Aiding the Detection of Fake Accounts in Large Scale Social Online Services. In NSDI , 2012. -Not checked yet

  Not checked in the free run.

• cites [52] [52] C. Yang, R. Harkreader, J. Zhang, S. Shin, and G. Gu. Analyzing Spammers' Social Networks for Fun and Profit. In WWW , 2012. - sourceNot checked yet

  Not checked in the free run.

• cites [5] [5] Y. Boshmaf, D. Logothetis, G. Siganos, J. R. Leria, J. Lorenzo, M. Ripeanu, and K. Beznosov. Integro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs. In NDSS , 2015. - sourceNot checked yet

  Not checked in the free run.