Abstract:Online social networks are plagued by fake information. In particu- lar, using massive fake accounts (also called Sybils), an attacker can disrupt the security and privacy of benign users by spreading spam, malware, and disinformation. Existing Sybil detection methods rely on rich content, behavior, and/or social graphs generated by Sybils. The key limitation of these methods is that they incur significant delays in catching Sybils, i.e., Sybils may have already performed many malicious activities when being detected. In this work, we propose Ianus, a Sybil detection method that leverages account registration information. Ianus aims to catch Sybils immediately after they are registered. First, using a real- world registration dataset with labeled Sybils from WeChat (the largest online social network in China), we perform a measurement study to characterize the registration patterns of Sybils and benign users. We find that Sybils tend to have synchronized and abnormal registration patterns. Second, based on our measurement results, we model Sybil detection as a graph inference problem, which allows us to integrate heterogeneous features. In particular, we extract synchronization and anomaly based features for each pair of accounts, use the features to build a graph in which Sybils are densely connected with each other while a benign user is isolated or sparsely connected with other benign users and Sybils, and finally detect Sybils via analyzing the structure of the graph. We evaluate Ianus using real-world registration datasets of WeChat. Moreover, WeChat has deployed Ianus on a daily basis, i.e., WeChat uses Ianus to analyze newly registered accounts on each day and detect Sybils. Via manual verification by the WeChat security team, we find that Ianus can detect around 400K per million new registered accounts each day and achieve a precision of over 96% on average.

Identification of Sybil attacks on social networks using a framework based on user interactions

Thank You for Being A Friend: an Attacker View on Online-Social-Network-Based Sybil Defenses.

SybilDefender: A Defense Mechanism for Sybil Attacks in Large Social Networks.

SybilDefender: Defend Against Sybil Attacks in Large Social Networks

Uncovering Social Network Sybils in the Wild

Survey of Sybil Attacks in Social Networks

Understanding Sybil Groups in the Wild

Defending Against Social Network Sybils with Interaction Graph Embedding.

Defense Against Sybil Attacks in Directed Social Networks.

Normal User Community Incoming links-1-1 1 Sybil Community Out-going links

Detecting Fake Accounts in Online Social Networks at the Time of Registrations.

Detecting and Validating Sybil Groups in the Wild

VoteTrust: Leveraging Friend Invitation Graph to Defend Against Social Network Sybils

SybilPSIoT: Preventing Sybil attacks in signed social internet of things based on web of trust and smart contract

Resisting Sybil Attack By Social Network and Network Clustering

Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks

Sybil-Resilient Reality-Aware Social Choice

A Review of Techniques to Mitigate Sybil Attacks

Sybil Detection using Graph Neural Networks

A New Approach to Detect User Collusion Behavior in Online QA System

Friend or Faux: Graph-Based Early Detection of Fake Accounts on Social Networks