CoChat
Sign Up
Cited by 16Spam and Phishing DetectionMisinformation and Its ImpactsPrivacy-Preserving Technologies in Data

Fraud De-Anonymization for Fun and Profit

Open access
Hernandez, Nestor, Rahman, Mizanur, Recabarren, Ruben, Carbunar, Bogdan·2018·Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
DOI 10.1145/3243734.3243770
Open this paper in CoChat — free accountOpen PDF

Abstract

The persistence of search rank fraud in online, peer-opinion systems, made possible by crowdsourcing sites and specialized fraud workers, shows that the current approach of detecting and filtering fraud is inefficient. We introduce a fraud de-anonymization approach to disincentivize search rank fraud: attribute user accounts flagged by fraud detection algorithms in online peer-opinion systems, to the human workers in crowdsourcing sites, who control them. We model fraud de-anonymization as a maximum likelihood estimation problem, and introduce UODA, an unconstrained optimization solution. We develop a graph based deep learning approach to predict ownership of account pairs by the same fraudster and use it to build discriminative fraud de-anonymization (DDA) and pseudonymous fraudster discovery algorithms (PFD). To address the lack of ground truth fraud data and its pernicious impacts on online systems that employ fraud detection, we propose the first cheating-resistant fraud de-anonymization validation protocol, that transforms human fraud workers into ground truth, performance evaluation oracles. In a user study with 16 human fraud workers, UODA achieved a precision of 91%. On ground truth data that we collected starting from other 23 fraud workers, our co-ownership predictor significantly outperformed a state-of-the-art competitor, and enabled DDA and PFD to discover tens of new fraud workers, and attribute thousands of suspicious user accounts to existing and newly discovered fraudsters.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper proposes fraud de-anonymization to attribute fraudulent peer-opinion accounts to the human crowdsourcing fraud workers who control them, using MLE-based UODA, a DeepWalk/DeepCluster co-ownership predictor, DDA, PFD, and the Detego system. In a user study with 16 fraud workers, UODA reached 91% precision, and on 942 ground-truth accounts from 23 workers DDA reached 94.5% F1 while the co-ownership predictor reached 96.67% F1 versus Elsiedet’s 84.13%.

Key findings

  • In the user study, 16 human fraud workers revealed 230 Google Play accounts; UODA achieved 91% precision, with 7 unconfirmed accounts among 77 predicted, and for 3 of those 7 the participants did not remember whether they controlled them.
  • On 942 ground-truth attributed accounts from 23 fraud workers, DDA’s MLP achieved 94.50% F1, while UODA achieved 83.83% F1 for Top 1, 91.11% for Top 2, and 93.57% for Top 3; DDA attributed 3,547 accounts to the 23 workers, leaving only 134 unassigned.
  • The co-ownership predictor cowPred achieved 96.67% F1 versus Elsiedet’s 84.13% F1; PFD identified 129 components over 5,548 user accounts and 97,448 edges, and analysis of 1.1 billion Jaccard pairs from 118,281 reviews belonging to 5,364 accounts found 15 components with more than 80% of accounts suspected of review-text plagiarism.
  • The 640 selected fraud apps received 159,469 reviews, of which 17,575 were written from the 942 attributed fraud accounts.

Methods

  • Design: fraud de-anonymization is modeled as maximum likelihood estimation; UODA solves an unconstrained optimization problem, DeepCluster uses DeepWalk features on co-review/union fraud graphs, cowPred predicts account co-ownership from 16 features, DDA trains a classifier for attribution, PFD partitions a co-ownership graph via a Karger-style weighted min-cut, and Detego iterates attribution and discovery.
  • Data: a user study with 16 fraud workers (m=10, n=5, q=5) revealed 230 Google Play accounts; an additional 23 fraud workers revealed 942 attributed accounts; 640 fraud apps were crawled every 2 days over 6 months; the union fraud graph had 56,950 nodes and 34,742,730 edges (5,858,940 unique) across 202 disconnected components.
  • Analysis: precision, recall, and F1 were evaluated with 10 random ground-truth/testing splits and stratified 10-fold cross-validation; DeepWalk parameters were grid-searched to d=300, t=100, γ=80, w=5; validation also used Jaccard similarity with k=3 shingles.

Limitations

  • Paper-stated: Detego requires seed ground truth about accounts controlled by known fraudsters; fraudsters may evade by using disjoint account sets; underground fraud markets may emerge; recruitment was limited (320 contacted, 16 participated); account memorability is a caveat because only 5 test accounts were presented; UODA assumes review histories are independent and identically distributed.
  • Text-evident: UODA was evaluated with only two features, so its performance may depend on that limited instantiation; PFD validation relies on orthogonal evidence such as plagiarism/Jaccard similarity rather than confirmed ownership; DDA and PFD depend on fraud detection filtering and seed clusters, which may affect attribution and discovery.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1145/3243734.3243770

Cites

68 of 68 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 38 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    Jobs assigned to a single worker were less frequent than jobs awarded to two workers.

    “We found that jobs assigned to a single worker occurred less frequently than jobs awarded to 2 workers.”
    Quote in the paperSubstantial claim
  • Findingown data

    UODA reached 91% precision in a study involving 16 human fraud workers.

    “In a user study with 16 human fraud workers, UODA achieved a precision of 91%.”
    • Also stated in: § 1 INTRODUCTION · plain
      “The participants confirmed control of 91% of the user accounts newly discovered by UODA.”
    Quote in the paperSubstantial claim
  • Findingown data

    On 942 ground truth attributed accounts from 23 fraud workers, both DDA and UODA achieved precision and recall above 90%.

    “Further, on 942 ground truth attributed user accounts that we collected from other 23 fraud workers, both DDA and UODA achieved precision and recall that exceed 90%, and attributed thousands of new accounts to these fraudsters.”
    Quote in the paperSubstantial claim
  • Findingown data

    In a separate Upwork dataset experiment, 161 search rank fraud jobs and 533 bidding workers were collected.

    “In a separate Upwork data set experiment, we collected 161 search rank fraud jobs and their 533 bidding workers.”
    Quote in the paperSubstantial claim
  • Findingown data

    A single job was assigned by some developers to up to 12 workers.

    “Furthermore, some developers assigned a single job to as many as 12 workers.”
    Quote in the paperSubstantial claim
  • May combine two claims. 32
  • The quote only partly states this claim. 4
  • Classified as probably not a substantial claim. 14

  • May combine two claims.

    Findingown data

    PFD found thousands of accounts that had not been known as fraudulent and clustered them by shared ownership by fraudsters.

    “Further, the PFD algorithm identified thousands of accounts not previously known to be fraudulent, grouped into communities according to common ownership by fraudsters.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingcitation

    Fraudulent activity is profitable, with advertised prices ranging from a few cents (average $0.56 on Zeerk) to up to $10 per review on Freelancer.

    “For instance, we identified 44 fraud workers in Facebook groups, Zeerk, Peopleperhour, Freelancer and Upwork that advertised prices ranging from a few cents ($0.56 on average from Zeerk.com) to several dollars per review (up to $10 in Freelancer.com) [56].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [56]

      Not checked in the free run.

  • May combine two claims.

    Findingown data

    Analysis of 1.1 billion review pairs from PFD communities found orthogonal evidence of fraud, including communities where more than 80% of accounts were involved in review text plagiarism.

    “We analyzed 1.1 billion pairs of reviews from these communities and report orthogonal evidence of fraud, including communities with more than 80% of accounts involved in review text plagiarism.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    DDA and PFD found dozens of previously unknown fraud workers and linked thousands of suspicious accounts to both known and newly found fraudsters.

    “and enabled DDA and PFD to discover tens of new fraud workers, and attribute thousands of suspicious user accounts to existing and newly discovered fraudsters.”
    Quote in the paperSubstantial claim

  • The quote only partly states this claim.

    Findingown data

    On ground truth data collected from 23 other fraud workers, the co-ownership predictor outperformed Elsiedet's Sybil social link builder by more than 12 percentage points in F1.

    “On ground truth data that we collected starting from other 23 fraud workers, our co-ownership predictor significantly outperformed a state-of-theart competitor”
    • Also stated in: § 1 INTRODUCTION · plain
      “Our predictor outperformed the F1-measure of state-of-the-art, Elsiedet's Sybil social link builder [87] by more than 12 percentage points, on ground truth attributed data.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [87]

      Not checked in the free run.

  • May combine two claims.

    Findingown data

    15 of 16 participants answered all 5 test accounts correctly; the remaining participant answered 'I don't remember' for one test account not controlled by them.

    “Figure 4 shows that 15 of the 16 participants have provided correct responses to all 5 test accounts.The remaining participant answered”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Fifteen components containing 1,967 users had a ratio greater than 0.8, and very few components had a ratio below 0.3.

    “Figure 8 highlights fifteen components (1967 users) with ratio greater than 0.8.Very few components have a ratio below 0.3.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    13 of 23 fraudulent workers had around 90% of their newly attributed accounts with reviews similar to their seed accounts, and 22 of 23 had at least 50% similar.

    “We observe that 13 out of 23 fraudulent workers have around 90% of their new attributed accounts with similar reviews to the ones written by its seed accounts.Likewise, 22 out of 23 fraudsters have at least 50% of their accounts with similar reviews.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Top 2 UODA achieved an average F1 of 91.11%, and Top 3 UODA achieved 93.57%.

    “Specifically, Top 2 UODA achieves an average F1 of 91.11% while Top 3 UODA achieves an average F1 of 93.57%.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S1 (asserted), S3 (load-bearing), S4 (based).

    Findingnone given

    A review was posted from three different accounts in the same component for three different apps on the same date.

    “The review”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Experiments showed that DeepCluster clusters often contain accounts controlled by different fraudsters, because fraudsters tend to collaborate in search rank fraud jobs.

    “However, our experiments revealed that clusters often contain accounts controlled by different fraudsters, as fraudsters tend to collaborate in search rank fraud jobs.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    DDA achieved an F1 measure of 94.5%, outperforming UODA's top 1 choice.

    “We observe that DDA achieves an F1 measure of 94.5%, outperforming UODA's top 1 choice.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    DDA attributed 3,547 of 3,681 accounts to the 23 fraud workers, leaving 134 accounts unassigned.

    “Figure 5 (top) shows the distribution of 3,547 of these accounts attributed to the 23 fraud workers.Only 134 accounts were not assigned to any fraud worker.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The co-ownership graph consisted of 5,548 user accounts and 97,448 edges, and PFD identified 129 components.

    “The resulting co-ownership graph consists of 5,548 user accounts and 97,448 edges.Figure 7 shows 129 components identified by PFD.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    cowPred's results were very similar for no sampling and oversampling strategies, and both outperformed undersampling.

    “cowPred's results were very similar for the no sampling and oversampling strategies, outperforming the undersampling strategy.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The 16 participants were honest, with a single 'I don't remember' response among 80 test accounts.

    “We note that the 16 participants were honest (a single”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingown data

    12 accounts in one component used a review template to post reviews for 8 apps.

    “We found 12 accounts in one component that used the review”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    UODA's precision is 91%, with 7 unconfirmed accounts among 77 predicted.

    “UODA's precision ( T P T P +F P , where TP is the number of true positives and FP is the number of false positives) is thus 91%, i.e., 7 unconfirmed accounts among 77 predicted.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: UODA assumes that the review history of a fraudulent user account is independent and identically distributed.

  • May combine two claims.

    Findingown data

    10 of 16 participants confirmed control of all UODA proposed accounts, 5 confirmed 4 of 5, and 1 confirmed 3 of 5.

    “We observe that 10 out of 16 participants have confirmed control (and passed our verification) of all UODA proposed accounts.5 participants confirmed control of 4 out of 5 UODA recommended accounts and 1 participant confirmed control of only 3 accounts out of 5 UODA recommended accounts.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Fraud workers know the user accounts that they control.

  • The quote only partly states this claim.

    Findingown data

    On the ground truth data set, DDA outperforms UODA.

    “DDA performs better.”
    Quote in the paperSubstantial claim

  • May combine two claims. The quote only partly states this claim.

    Findingown data

    An additional 23 fraud workers were recruited and revealed a total of 942 attributed fraud accounts.

    “We have recruited an additional set of 23 fraud workers and performed only the first step of the fraud de-anonymization validation protocol of § 9, where we asked each participant to reveal at least 15 accounts that they control in Google Play.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The study recruited 16 fraud workers from India, Bangladesh, UK, Egypt, USA, Pakistan, Indonesia, and Morocco; 12 were male and 4 female; they claimed to control between 40 and 500 accounts (M=211, SD=166).

    “We have recruited 16 fraud workers from India (4), Bangladesh (4), UK (2), Egypt (2), USA (1), Pakistan (1), Indonesia (1), and Morocco (1), 12 male and 4 female, who claimed to control between 40 to 500 accounts (M=211, SD=166).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The 640 apps received 159,469 reviews, of which 17,575 were written from the 942 attributed fraud accounts.

    “On the whole, the 640 apps have received 159,469 reviews, of which 17,575 were written from the above 942 attributed fraud accounts.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    To recruit 16 participants, the study contacted 320 fraud workers.

    “To recruit 16 participants for the user study of Section 10, we have contacted 320 fraud workers.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The union fraud graph had 56,950 nodes and 34,742,730 edges (5,858,940 unique edges) and consisted of 202 disconnected components.

    “The resulting union fraud graph has 56,950 nodes and 34,742,730 edges (5,858,940 unique edges) and consists of 202 disconnected components.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Specialized fraud workers control multiple user accounts and seek employment from product developers to post fake reviews or activities.

    “Specialized fraud workers (also referred to as fraud freelancers, or fraudsters) control multiple user accounts and seek employment by product developers to post fake reviews or activities for their products.”
    Quote in the paperSubstantial claim0 of 8 sources checked
    • cites [13] source

      Not checked in the free run.

    • cites [23] source

      Not checked in the free run.

    • cites [40] source

      Not checked in the free run.

    • cites [45] source

      Not checked in the free run.

    • cites [81]

      Not checked in the free run.

    • cites [84]

      Not checked in the free run.

    • cites [85]

      Not checked in the free run.

    • cites [87]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A one-star rating boost was shown to increase restaurant revenue by 5-9%.

    “For example, a one star boost in rating was shown to help restaurants increase revenue by a 5-9% margin [46].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [46] source

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning

    Those rule-based assumptions are difficult to validate and easy for experienced fraudsters to circumvent.

    “However, such assumptions are also difficult to validate, especially as they are straightforward to bypass by experienced fraudsters (e.g., using proxies, better distributing the post time and rating of reviews).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Current fraud detection and filtering methods are ineffective at preventing search rank fraud, as shown by the continued profitability of fraud on online services and crowdsourcing platforms.

    “The persistence of search rank fraud in online, peer-opinion systems, made possible by crowdsourcing sites and specialized fraud workers, shows that the current approach of detecting and filtering fraud is inefficient.”
    • Also stated in: § 1 INTRODUCTION · plain
      “Fraud detection solutions however are not only (1) ineffective in preventing fraud, as observed from the continued profitability of fraud in online services and crowdsourcing platforms”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Interpretationnone given

    Evaluating the accuracy of fraud detection is difficult because obtaining ground truth fraud data is very hard.

    “their accuracy is difficult to evaluate, given that collecting ground truth fraud data is a notoriously hard task.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Collecting ground truth fraud data is notoriously hard.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Most workers post either positive or negative reviews.

    “This observation implies that most workers post either positive or negative reviews.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The study used IRB-approved protocols to ethically interact with participants and collect data.

    “We have developed IRB-approved protocols to ethically interact with participants and collect data.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Some fraudster-controlled accounts may not be controlled by any known fraudster in W*.

    “However, some accounts in U * may not be controlled by any of the known fraudsters in W * .”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Detego forces fraudsters to minimize account reuse and reduces review fraud incentives.

    “Thus, Detego forces fraudsters to minimize account reuse and reduces review fraud incentives.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    Decreasing account reuse decreases profits, because reputable accounts are often preferred in search rank fraud jobs.

    “Decreasing account reuse decreases profits, as reputable accounts are often preferred in search rank fraud jobs [22,68,87].”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [22] source

      Not checked in the free run.

    • cites [68] source

      Not checked in the free run.

    • cites [87]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Elsiedet was designed for a different type of social network (Dianping, Yelp) and a different adversary type (elite reviewer).

    “While Elsiedet was designed for a different type of social network (i.e., Dianping, Yelp), and a different adversary type (elite reviewer), we believe that cowPred's advantage stems from its use of features extracted from common review behaviors exhibited by Sybil accounts.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [87]

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    Equation (4) assigns a user account to the worker profile in W* that is most likely to have produced that account's review history.

    “Equation ( 4) from Theorem 4.1 attributes a user account to the worker profile in W * most likely responsible for the account's review history”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationcitation

    Such behavior affects the temporal distribution of the app's reviews, making it detectable through Detego's interreview-time and rating-difference features.

    “Such behavior however affects the temporal distribution of the app's reviews [55], which makes it detectable, i.e., through the interreview-time and rating-difference features of Detego.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [55]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    An adversarial developer who wants to boost the average rating of an app needs to commission a number of fake reviews that is linear in the number of the app's honest reviews.

    “Further, an adversarial developer who wants to boost the average rating of her app, needs to commission a number of fake reviews that is linear in the number of the app's honest reviews [55].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [55]

      Not checked in the free run.

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductnone given

    The study restricted volatile handling of emails and photos to the validation process and discarded them immediately after validation.

    “We restricted the volatile handling of emails and photos of accounts revealed by participants, to the validation process.We have immediately discarded them after validation.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Unlike Twitter and Facebook, sites for crowdsourcing and peer opinions lack explicit mechanisms for linking accounts.

    “This problem is also more challenging: unlike Twitter and Facebook, crowdsourcing and peer-opinion sites do not facilitate explicit forms of inter-connection.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given

    A caveat is that participants were only presented with 5 test accounts.

    “The caveat is that we only presented participants with 5 test accounts.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductreasoning

    The authors did not compare with Kumar et al. [40]'s predictor, since it relies on community feedback features not available on sites such as Google Play.

    “We did not compare against the predictor of Kumar et al. [40], that uses community feedback features that are unavailable in sites like Google Play.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Kumar et al. [40]

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data

    These results confirm DDA's outcome and previous work on crowdsourced review manipulation.

    “These results confirm DDA's outcome and previous work on crowdsourced review manipulation, e.g., [36].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [36] source

      Not checked in the free run.

  • May combine two claims.

    Study design and conductown data

    The authors used responses from fraudsters for live validation of their methods and to link accounts in the peer-opinion system to the crowdsourcing worker controlling them.

    “In this paper we use fraudster responses to conduct a live validation of our solutions, and map accounts in the online peer-opinion system to the controlling crowdsourcing worker.”
    Quote in the paperSubstantial claim
45 of 45

  • The paper relies on this without support.

    Crowdsourcing site accounts contain uniquely identifying payment information, such as bank or PayPal accounts, that can be used to link them to real identities.

    “Specifically, we leverage the observation that crowdsourcing site accounts contain uniquely identifying payment information, e.g., bank, Paypal accounts, to take steps toward de-anonymizing fraud”

  • The paper relies on this without support.

    A crowdsourcing account must have a bank account linked to it so that escrow funds can be deposited and worker earnings withdrawn.

    “These crowdsourcing accounts have a unique identifier and require a linked bank account for depositing employer's escrow money or withdrawing worker's earnings.”

  • The authors state this as an assumption.

    Accounts run by fraudsters tend to promote items within a pre-specified partition of the product space.

    “We propose a general theoretical framework for the fraud deanonymization problem via Maximum Likelihood Estimation (MLE) and assume a generative review-posting model wherein fraudstercontrolled accounts are more likely to endorse products in a predefined partition of the product space.”

  • The authors state this as an assumption.

    A fraudulent account's review history can be modeled as a sequence of independent and identically distributed random variables over subjects.

    “Further, we assume that the review history of a user account is described by a sequence of independent and identically distributed random variables R 1 , R 2 , . . ., R n where R k ∈ S represents the k-th subject reviewed from the account.”

  • The authors state this as an assumption.

    Fake reviews exhibit burstiness: accounts controlled by the same worker post reviews closer in time.

    “Since fraudsters need to meet tight deadlines [64], we expect ∆ T i j (s k ) to be lower for user accounts controlled by the same worker (fake review”

  • The paper relies on this without support.

    Accounts controlled by the same fraudster form a densely connected subgraph or cluster in the union fraud graph.

    “We exploit the intuition that in DeepCluster, accounts in a union fraud graph that are controlled by the same fraudster, form a densely connected subgraph, or cluster.”

  • The paper relies on this without support.

    Collecting ground truth fraud data is notoriously hard.

    “their accuracy is difficult to evaluate, given that collecting ground truth fraud data is a notoriously hard task.”

  • The paper relies on this without support.

    The unique lockstep feature is lower for pairs of accounts governed by the same fraudster.

    “Further, we expect the unique lockstep u L to be lower for pair of accounts governed by the same fraudster.”

  • The paper relies on this without support.

    The number of unique rating differences is lower for pairs of accounts controlled by the same worker.

    “For the rating difference features, we expect u R to be lower for pair of accounts controlled by the same worker, which would imply that both accounts tend to post the same rating for their common subjects.”

  • The authors state this as an assumption.

    UODA assumes that the review history of a fraudulent user account is independent and identically distributed.

    “I.i.d.assumption.UODA assumes that the review history of a fraudulent user account is independent and identically distributed, i.e., that an element in the sequence of reviews is independent of the element that came before it.”

  • The paper relies on this without support.

    Fraud workers know the user accounts that they control.

    “We leverage the observation that fraud workers know the user accounts that they control, to introduce a novel approach to validate fraud de-anonymization solutions, that converts human fraud workers into FDA oracles.”

  • The authors state this as an assumption.

    The number of workers who targeted each subject is known a priori.

    “We have used K-means as clustering algorithm in DeepCluster (see § 1) considering that we have prior knowledge about the number of workers who targeted each subject.”

  • The paper relies on this without support.

    Responses from fraudsters are a valid source of ground truth for assessing de-anonymization methods.

    “In this paper we use fraudster responses to conduct a live validation of our solutions, and map accounts in the online peer-opinion system to the controlling crowdsourcing worker.”
13 of 13

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions.

    “Identifying organic ASO activities is an open problem due to the ability of such workers to evade existing detection solutions, e.g., that leverage lockstep behaviors [32, 43, 51, 72, 73, 78, 85, 86, 89, 92, 93] or review bursts [27, 28, 35, 39, 40, 42, 44, 45, 50-53, 53, 5759, 65, 66, 84, 87, 88, 92].”

    From RacketStore (2021) · cites this paper as [43]

    The Abstract says persistent search-rank fraud shows that current detection and filtering are inefficient. The ‘Fraud detection’ passage identifies bursty activity and lockstep behavior as assumptions used by existing approaches. The paper does not specifically discuss organic ASO activities or establish that their workers evade those approaches. (LLM, conf=0.83)

    Experimental — accuracy not yet measured

Cites

Flagged first, then by citations

3 of the 71 references couldn’t be matched to a known paper.

Research works printed but not linked: 14

  1. Qurishi Muhammad, 2017, Sk Md Mizanur Rahman, and M Hossain
  2. 10.5555/829502.830043 · DOI
  3. 10.5555/1622407.1622416 · DOI
  4. Confessore Nicholas, 2018, The Follower Factory. The New York Times (Jan
  5. Kaghazgaran Parisa, 2017, Proceedings of ICWSM.
  6. Karger David R, 1993, SODA, 93
  7. Mukherjee Arjun, 2013, Proceedings of the International Conference on Weblogs and Social Media.
  8. Reigh Brian, 2017, Fake reviews on the Play Store reportedly growing and getting smarter. Android Authority (April
  9. Rosenberg Eli, 2017, The Shed at Dulwich' was London's top-rated restaurant. Just one problem: It didn't exist. The Washington Post (Dec
  10. Thomas Kurt, 2013, Proceedings of the 22Nd USENIX Conference on Security (SEC'13)
  11. 10.5555/1558977.1558979 · DOI
  12. Wamback Colleen, 2017, WPI Research Detects When Online Reviews and News Are a Paid-for Pack of Lies
  13. Wang Binghui, 2017, Neil Zhenqiang Gong, and Hao Fu
  14. Woollacott Emma, 2017, Study Suggests. Forbes (September.

Cited by

Sorted by citations

Related

Authors
Hernandez, N., Rahman, M., Recabarren, R., & Carbunar, B.
Affiliations
  • Florida International University (US)
  • Florida International University, Miami, FL, USA
Venue
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
Publisher
ACM
Published
2018-10-15
Pages
115-130
ISSN
1543-7221 (ISSN-L)
DOI
10.1145/3243734.3243770
OpenAlex
W2890697686
Semantic Scholar
7301d1984d709c7c7ab5135c08e07513a15ec8ad
Cited by
16
References
71
Citations by year
2025: 1 · 2024: 2 · 2023: 4 · 2022: 1 · 2021: 5 · 2020: 1 · 2019: 1 · 2018: 1
FWCI
1.57
Type
conference paper
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
Funders
Division of Computer and Network Systems (1527153)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
graph-based deep learning, maximum likelihood estimation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review