Uncovering Social Network Sybils in the Wild Zhi YangChristo WilsonXiao Wang Peking UniversityUC Santa BarbaraPeking University Tingting GaoBen Y. ZhaoYafei Dai Renren Inc.UC Santa BarbaraPeking University

Sybils on OSNs Large OSNs are attractive targets for… ▫ Spam dissemination ▫ Theft of personal information Sybil, s ɪ b ə l, Noun: a fake account that attempts to create many friendships with honest userss ɪ b ə l ▫ Friendships are precursor to other malicious activity ▫ Does not include benign fakes Research has identified malicious Sybils on OSNs ▫ Twitter [CCS 2010] ▫ Facebook [IMC 2010] 2

Understanding Sybil Behavior Prior work has focused on spam ▫ Content, dynamics, campaigns ▫ Includes compromised accounts Open question: What is the behavior of Sybils in the wild?  Important for evaluating Sybil detectors Partnership with largest OSN in China: Renren ▫ Leverage ground-truth data on 560K Sybils ▫ Develop measurement-based, real-time Sybil detector ▫ Deployed, caught additional 100K Sybils in 6 months 3

 Introduction  Sybils on Renren  Sybil Analysis  Conclusion 4

Sybils on Renren Renren is the oldest and largest OSN in China ▫ 160M users ▫ Facebook’s Chinese twin Ad-hoc Sybil detectors ▫ Threshold-based spam traps ▫ Keyword and URL blacklists ▫ Crowdsourced account flagging 560K Sybils banned as of August

Sybil Detection 2.0 Developed improved Sybil detector for Renren ▫ Analyzed ground-truth data on existing Sybils ▫ Identified four reliable Sybil indicators Evaluated threshold and SVM detectors ▫ Similar accuracy for both ▫ Deployed threshold, less CPU intensive, real-time 6 SVMThreshold SybilNon-SybilSybilNon-Sybil 98.99%99.34%98.68%99.5% 1.Friend Request Frequency 2.Outgoing Friend Requests Accepted 3.Incoming Friend Requests Accepted 4.Clustering Coefficient

Detection Results Caught 100K Sybils in the first six months ▫ Vast majority are spammers ▫ Many banned before generating content Low false positive rate ▫ Use customer complaint rate as signal ▫ Complaints evaluated by humans ▫ 25 real complaints per 3000 bans (<1%) 7 Spammers attempted to recover banned Sybils by complaining to Renren customer support! More details in the paper

 Introduction  Sybils on Renren  Sybil Analysis  Conclusion 8

Community-based Sybil Detectors Prior work on decentralized OSN Sybil detectors ▫ SybilGuard, SybilLimit, SybilInfer, Sumup ▫ Key assumption: Sybils form tight-knit communities 9 Edges Between Sybils Attack Edges

Do Sybils Form Connected Components? 10  Vast majority of Sybils blend completely into the social graph  Few communities to detect 80% have degree = 0 No edges to other Sybils!

Can Sybil Components be Detected? 11  Sybil components are internally sparse  Not amenable to community detection

Sybil Cluster Analysis 12 Are edges between Sybils formed intentionally? ▫ Temporal analysis indicates random formation How are random edges between Sybils formed? ▫ Surveyed Sybil management tools ▫ Biased sampling for friend request targets ▫ Likelihood of Sybils inadvertently friending is high More details in the paper

 Introduction  Sybils on Renren  Sybil Analysis  Conclusion 13

Conclusion First look at Sybils in the wild ▫ Ground-truth from inside a large OSN ▫ Deployed detector is still active Sybils are quite sophisticated ▫ Cheap labor  very realistic fakes ▫ Created and managed by-hand Need for new, decentralized Sybil detectors ▫ Results may not generalize beyond Renren ▫ Evaluation on other large OSNs 14

Questions? Slides and paper available at Christo Wilson UC Santa Barbara 15 P.S.: I’m on the job market…

Backup Slides Only use in case of emergency! 16

Creation of Edges Between Sybils 17 The majority of edges between Sybils form randomly

Friend Target Selection 18  High degree nodes are often Sybils!  Sybils unknowingly friend each other