Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks
Open accessAbstract
Popular User-Review Social Networks (URSNs)such as Dianping, Yelp, and Amazon-are often the targets of reputation attacks in which fake reviews are posted in order to boost or diminish the ratings of listed products and services.These attacks often emanate from a collection of accounts, called Sybils, which are collectively managed by a group of real users.A new advanced scheme, which we term elite Sybil attacks, recruits organically highly-rated accounts to generate seeminglytrustworthy and realistic-looking reviews.These elite Sybil accounts taken together form a large-scale sparsely-knit Sybil network for which existing Sybil fake-review defense systems are unlikely to succeed.In this paper, we conduct the first study to define, characterize, and detect elite Sybil attacks.We show that contemporary elite Sybil attacks have a hybrid architecture, with the first tier recruiting elite Sybil workers and distributing tasks by Sybil organizers, and with the second tier posting fake reviews for profit by elite Sybil workers.We design ELSIEDET, a three-stage Sybil detection scheme, which first separates out suspicious groups of users, then identifies the campaign windows, and finally identifies elite Sybil users participating in the campaigns.We perform a large-scale empirical study on ten million reviews from Dianping, by far the most popular URSN service in China.Our results show that reviews from elite Sybil users are more spread out temporally, craft more convincing reviews, and have higher filter bypass rates.We also measure the impact of Sybil campaigns on various industries (such as cinemas, hotels, restaurants) as well as chain stores, and demonstrate that monitoring elite Sybil users over time can provide valuable early alerts against Sybil campaigns.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Several participants admitted to reusing common linguistic patterns and copying reviews across similar products, and the quantitative study confirmed this.
“several participants admitted to reuse common linguistic patterns and copy reviews across similar products.”
From The Art and Craft of Fraudulent App Promotion in Google Play (2019) · cites this paper as [74]
In A. Data Collection (page unavailable), the paper reports observing duplicate reviews with similar content for one or two stores, which supports the review-reuse aspect. It does not report participants admitting to that behavior or to reusing linguistic patterns, nor does the cited passage establish the claimed quantitative confirmation. (LLM, conf=0.84)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Fast unfolding of communities in large networks
Blondel, V. D., Guillaume, J.-L., Lambiotte, R., & Lefebvre, E. (2008) · Journal of Statistical Mechanics: Theory and Experiment · doi:10.1088/1742-5468/2008/10/p10008 · Cited by 21,424 · see citing works
Social Media and Fake News in the 2016 Election
Allcott, H., & Gentzkow, M. (2017) · Journal of Economic Perspectives · doi:10.1257/jep.31.2.211 · Cited by 6,767 · see citing works
Fake It Till You Make It: Reputation, Competition, and Yelp Review Fraud
Luca, M., & Zervas, G. (2016) · Management Science · doi:10.1287/mnsc.2015.2304 · Cited by 1,263 · see citing works
Diurnal and seasonal mood vary with work, sleep, and daylength across diverse cultures
Golder, S. A., & Macy, M. W. (2011) · Science · doi:10.1126/science.1202775 · Cited by 1,155 · see citing works
Detecting spammers on social networks
Stringhini, G., Kruegel, C., & Vigna, G. (2010) · Proceedings of the 26th Annual Computer Security Applications Conference · doi:10.1145/1920261.1920263 · Cited by 791 · see citing works
Spotting fake reviewer groups in consumer reviews
Mukherjee, A., Liu, B., & Glance, N. (2012) · Proceedings of the 21st international conference on World Wide Web · doi:10.1145/2187836.2187863 · Cited by 773 · see citing works
SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.13 · Cited by 570 · see citing works
What Yelp Fake Review Filter Might Be Doing?
Mukherjee, A., Venkataraman, V., Liu, B., & Glance, N. (2021) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v7i1.14389 · Cited by 564 · see citing works
Design and Evaluation of a Real-Time URL Spam Filtering Service
Thomas, K., Grier, C., Ma, J. H., Paxson, V., & Song, D. X. (2011) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2011.25 · Cited by 470 · see citing works
Aiding the detection of fake accounts in large scale social online services
Cao, Q., Sirivianos, M., Yang, X., & Pregueiro, T. (2012) · Cited by 449 · see citing works
Boshmaf, Y., Muslukhov, I., Beznosov, K., & Ripeanu, M. (2011) · Annual Computer Security Applications Conference · doi:10.1145/2076732.2076746 · Cited by 439 · see citing works
Suspended accounts in retrospect: an analysis of twitter spam
Thomas, K., Grier, C., Song, D., & Paxson, V. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068840 · Cited by 439 · see citing works
Detecting and characterizing social spam campaigns
Gao, H., Hu, J. S., Wilson, C., Li, Z., Chen, Y., & Zhao, B. Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879147 · Cited by 420 · see citing works
Security Evaluation of Pattern Classifiers under Attack
Biggio, B., Fumera, G., & Roli, F. (2013) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2013.57 · Cited by 412 · see citing works
SybilGuard: Defending Against Sybil Attacks via Social Networks
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2008) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2008.923723 · Cited by 408 · see citing works
bcp: AnRPackage for Performing a Bayesian Analysis of Change Point Problems
Erdman, C., & Emerson, J. W. (2007) · Journal of Statistical Software · doi:10.18637/jss.v023.i03 · Cited by 373 · see citing works
An analysis of social network-based Sybil defenses
Viswanath, B., Post, A., Gummadi, K. P., & Mislove, A. E. (2010) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1851182.1851226 · Cited by 308 · see citing works
Fake It Till You Make It: Reputation, Competition, and Yelp Review FraudPreprint
Luca, M., & Zervas, G. (2013) · SSRN Electronic Journal · doi:10.2139/ssrn.2293164 · Cited by 294 · see citing works
Uncovering social network Sybils in the wild
Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y. (2014) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2556609 · Cited by 290 · see citing works
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Cao, Q., Yang, X., Yu, J., & Palow, C. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660269 · Cited by 274 · see citing works
Filtering spam with behavioral blacklisting
Ramachandran, A., Feamster, N., & Vempala, S. (2007) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/1315245.1315288 · Cited by 267 · see citing works
Fighting Spam on Social Web Sites: A Survey of Approaches and Future Challenges
Heymann, P., Koutrika, G., & García-Molina, H. (2007) · IEEE Internet Computing · doi:10.1109/mic.2007.125 · Cited by 260 · see citing works
You are how you click: Clickstream analysis for Sybil detection
Wang, G., Konolige, T., Wilson, C., Wang, X., Zheng, H.-T., & Zhao, B. Y. (2013) · Cited by 256 · see citing works
Self-citationCOMPA: Detecting Compromised Accounts on Social Networks.
Egele, M., Stringhini, G., Krügel, C., & Vigna, G. (2013) · Cited by 250 · see citing works
Sybillimit: a near-optimal social network defense against sybil attacks
Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2009.2034047 · Cited by 246 · see citing works
Adversarial Feature Selection Against Evasion Attacks
Zhang, F., Chan, P. P. K., Biggio, B., Yeung, D., & Roli, F. (2015) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2015.2415032 · Cited by 243 · see citing works
Detecting and characterizing social spam campaigns
Gao, H., Hu, J. S., Wilson, C., Li, Z., Chen, Y., & Zhao, B. Y. (2010) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1866307.1866396 · Cited by 235 · see citing works
Stein, T., Chen, E., & Mangla, K. (2011) · Proceedings of the 4th Workshop on Social Network Systems · doi:10.1145/1989656.1989664 · Cited by 219 · see citing works
Measuring the mixing time of social graphs
Mohaisen, A., Yun, A., & Kim, Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879191 · Cited by 183 · see citing works
SybilBelief: A Semi-Supervised Learning Approach for Structure-Based Sybil Detection
Gong, N. Z., Frank, M., & Mittal, P. (2014) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2014.2316975 · Cited by 177 · see citing works
Social Turing Tests: Crowdsourcing Sybil DetectionPreprint
Wang, G., Mohanlal, M., Wilson, C., Wang, X., Metzger, M. J., Zheng, H.-T., & Zhao, B. Y. (2012) · arXiv (Cornell University) · doi:10.48550/arxiv.1205.3856 · Cited by 173 · see citing works
Self-citationSocial spammer detection in microblogging
Hu, X., Tang, J., Zhang, Y., & Liu, H. (2013) · Cited by 170 · see citing works
BotGraph: large scale spamming botnet detection
Zhao, Y., Xie, Y., Yu, F., Ke, Q., Yu, Y., Chen, Y., & Gillum, E. (2009) · Cited by 169 · see citing works
Static prediction games for adversarial learning problems
Brückner, M., Kanzow, C., & Scheffer, T. (2012) · publish.UP (University of Potsdam) · Cited by 163 · see citing works
An analysis of social network-based Sybil defenses
Viswanath, B., Post, A., Gummadi, K. P., & Mislove, A. E. (2010) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1851275.1851226 · Cited by 161 · see citing works
Automated Crowdturfing Attacks and Defenses in Online Review Systems
Yao, Y., Viswanath, B., Cryan, J., Zheng, H., & Zhao, B. Y. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133990 · Cited by 150 · see citing works
Self-citation$1.00 per RT #BostonMarathon #PrayForBoston: Analyzing fake content on Twitter
Gupta, A., Lamba, H., & Kumaraguru, P. (2013) · doi:10.1109/ecrs.2013.6805772 · Cited by 144 · see citing works
Bimodal Distribution and Co-Bursting in Review Spam Detection
Li, H., Fei, G., Wang, S., Liu, B., Shao, W., Mukherjee, A., & Shao, J. (2017) · Proceedings of the 26th International Conference on World Wide Web · doi:10.1145/3038912.3052582 · Cited by 141 · see citing works
Integro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs
Boshmaf, Y., Logothetis, D., Siganos, G., Leria, J., Lorenzo, J., Ripeanu, M., & Beznosov, K. (2015) · Proceedings 2015 Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23260 · Cited by 134 · see citing works
Analyzing and Detecting Opinion Spam on a Large-scale Dataset via Temporal and Spatial Patterns
Li, H., Chen, Z., Mukherjee, A., Liu, B., & Shao, J. (2021) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v9i1.14652 · Cited by 116 · see citing works
Lee, K., Tamilarasan, P., & Caverlee, J. (2021) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v7i1.14384 · Cited by 81 · see citing works
Thomas, K., Li, F., Grier, C., & Paxson, V. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660282 · Cited by 77 · see citing works
Sybil Guard: Defending Against Sybil Attacks via Social Networks
Vasudevan, S. K., Sivaraman, R., & Karthick, M. R. (2010) · International Journal of Computer Applications · doi:10.5120/896-1270 · Cited by 76 · see citing works
Paying for Likes? Understanding Facebook Like Fraud Using HoneypotsPreprint
Cristofaro, E. D., Friedman, A., Jourjon, G., Kâafar, M. A., & Shafiq, M. Z. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1409.2097 · Cited by 47 · see citing works
Anti-Reconnaissance Tools: Detecting Targeted Socialbots
Paradise, A., Puzis, R., & Shabtai, A. (2014) · IEEE Internet Computing · doi:10.1109/mic.2014.81 · Cited by 40 · see citing works
Xie, Y., Yu, F., Ke, Q., Abadi, M., Gillum, E., Vitaldevaria, K., Walter, J., Huang, J., & Mao, Z. M. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382235 · Cited by 38 · see citing works
On Sparse Feature Attacks in Adversarial Learning
Wang, F., Liu, W., & Chawla, S. (2014) · Proceedings · doi:10.1109/icdm.2014.117 · Cited by 37 · see citing works
Serf and Turf: Crowdturfing for Fun and ProfitPreprint
Wang, G., Wilson, C., Zhao, X., Zhu, Y., Mohanlal, M., Zheng, H.-T., & Zhao, B. Y. (2011) · arXiv (Cornell University) · doi:10.48550/arxiv.1111.5654 · Cited by 37 · see citing works
Self-citationEthical Considerations when Employing Fake Identities in Online Social Networks for Research
Elovici, Y., Fire, M., Herzberg, A., & Shulman, H. (2013) · Science and Engineering Ethics · doi:10.1007/s11948-013-9473-0 · Cited by 35 · see citing works
Exploiting Temporal Dynamics in Sybil Defenses
Liu, C., Gao, P., Wright, M., & Mittal, P. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2813693 · Cited by 33 · see citing works
Measuring, Characterizing, and Detecting Facebook Like Farms
Ikram, M., Onwuzurike, L., Farooqi, S., Cristofaro, E. D., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2017) · ACM Transactions on Privacy and Security · doi:10.1145/3121134 · Cited by 27 · see citing works
Turning the Tide: Curbing Deceptive Yelp Behaviors
Rahman, M., Cărbunar, B., Ballesteros, J., Burri, G. J., & Chau, D. H. (2014) · SIAM International Conference on Data Mining · doi:10.1137/1.9781611973440.28 · Cited by 24 · see citing works
CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks
송종혁, 이상호, & 김종 (2015) · Open Access System for Information Sharing (Pohang University of Science and Technology) · Cited by 13 · see citing works
Flagged first, then by citations
Research works printed but not linked: 2
- A. Beutel, W. Xu, V. Guruswami, C. Palow, and C. Faloutsos, "Copycatch: Stopping Group Attacks by Spotting Lockstep Behavior in Social Networks," in Proc. WWW. ACM, 2013, pp. 119-130.
- L. Bilge, T. Strufe, D. Balzarotti, and E. Kirda, "All Your Contacts are Belong to Us: Automated Identity Theft Attacks on Social Networks," in Proc. WWW. ACM, 2009, pp. 551-560.
Cited by
Sorted by citations
The Art and Craft of Fraudulent App Promotion in Google Play
Rahman, M., Hernandez, N., Recabarren, R., Ahmed, S. I., & Carbunar, B. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3345658 · Cited by 24 · see citing works
Fraud De-Anonymization for Fun and Profit
Hernandez, N., Rahman, M., Recabarren, R., & Carbunar, B. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243770 · Cited by 16 · see citing works
Hernandez, N., Recabarren, R., Carbunar, B., & Ahmed, S. I. (2021) · Proceedings of the 21st ACM Internet Measurement Conference · doi:10.1145/3487552.3487837 · Cited by 3 · see citing works
“Our work is particularly relevant in light of findings that some ASO workers have evolved strategies [67, 94] to evade detection by both app stores and academic solutions, e.g., [27, 28, 32, 32, 35, 39, 40, 42, 44, 45, 48, 50, 51, 51–53, 53, 57–59, 72, 73, 78, 84– 89, 92, 92, 93].”
Background
- Authors
- Zheng, H., Xue, M., Lu, H., Hao, S., Zhu, H., Liang, X., & Ross, K.
- Affiliations
- Shanghai Jiao Tong University (CN)
- New York University Shanghai (CN)
- The University of Texas at Dallas (US)
- University of Massachusetts Boston (US)
- Venue
- Proceedings 2018 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2018
- OpenAlex
- W2962736666
- Cited by
- 61
- References
- 53
- Citations by year
- 2026: 3 · 2025: 5 · 2024: 7 · 2023: 8 · 2022: 8 · 2021: 10 · 2020: 8 · 2019: 9 · 2018: 3
- FWCI
- 5.89
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Network and Distributed System Security Symposium (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (71671114, 61672350, U1405251)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
- Keywords
- Sybil attack, fake reviews, Dianping
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
