Abstract:Online social networks are plagued by fake information. In particu- lar, using massive fake accounts (also called Sybils), an attacker can disrupt the security and privacy of benign users by spreading spam, malware, and disinformation. Existing Sybil detection methods rely on rich content, behavior, and/or social graphs generated by Sybils. The key limitation of these methods is that they incur significant delays in catching Sybils, i.e., Sybils may have already performed many malicious activities when being detected. In this work, we propose Ianus, a Sybil detection method that leverages account registration information. Ianus aims to catch Sybils immediately after they are registered. First, using a real- world registration dataset with labeled Sybils from WeChat (the largest online social network in China), we perform a measurement study to characterize the registration patterns of Sybils and benign users. We find that Sybils tend to have synchronized and abnormal registration patterns. Second, based on our measurement results, we model Sybil detection as a graph inference problem, which allows us to integrate heterogeneous features. In particular, we extract synchronization and anomaly based features for each pair of accounts, use the features to build a graph in which Sybils are densely connected with each other while a benign user is isolated or sparsely connected with other benign users and Sybils, and finally detect Sybils via analyzing the structure of the graph. We evaluate Ianus using real-world registration datasets of WeChat. Moreover, WeChat has deployed Ianus on a daily basis, i.e., WeChat uses Ianus to analyze newly registered accounts on each day and detect Sybils. Via manual verification by the WeChat security team, we find that Ianus can detect around 400K per million new registered accounts each day and achieve a precision of over 96% on average.

A New Approach to Detect User Collusion Behavior in Online QA System

Detecting Collusive Spamming Activities in Community Question Answering

Camouflage is NOT Easy: Uncovering Adversarial Fraudsters in Large Online App Review Platform

Normal User Community Incoming links-1-1 1 Sybil Community Out-going links

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Question-Score Identity Detection (Q-SID): A Statistical Algorithm to Detect Collusion Groups with Error Quantification from Exam Question Scores

Collusive spam detection from Chinese community question answering sites: A collective classification framework

VoteTrust: Leveraging Friend Invitation Graph to Defend Against Social Network Sybils

Thank You for Being A Friend: an Attacker View on Online-Social-Network-Based Sybil Defenses.

SybilDefender: A Defense Mechanism for Sybil Attacks in Large Social Networks.

Identification of Sybil attacks on social networks using a framework based on user interactions

Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks

Detecting, Representing and Querying Collusion in Online Rating Systems

SybilDefender: Defend Against Sybil Attacks in Large Social Networks

Detecting and Validating Sybil Groups in the Wild

Uncovering Social Network Sybils in the Wild

Sybil Defense In Crowdsourcing Platforms

Understanding Sybil Groups in the Wild

Detecting Fake Accounts in Online Social Networks at the Time of Registrations.

Detecting Spammers in Community Question Answering

Mitigating Sybil Attacks on Differential Privacy based Federated Learning