Uncovering Social Network Sybils in the Wild

TL;DR

This paper presents a large-scale measurement of Sybil accounts in the Renren social network, revealing that they integrate into the social graph similarly to normal users, challenging prior assumptions and highlighting the need for new detection techniques.

Contribution

The study deploys ground truth-based detectors to identify over 100,000 Sybil accounts and analyzes their behavior, showing they do not form tight communities as previously believed.

Findings

Most Sybil links are created accidentally, not maliciously.

Sybil accounts are well integrated into the social graph.

Existing defenses are unlikely to succeed against current Sybil behaviors.

Abstract

Sybil accounts are fake identities created to unfairly increase the power or resources of a single malicious user. Researchers have long known about the existence of Sybil accounts in online communities such as file-sharing systems, but have not been able to perform large scale measurements to detect them or measure their activities. In this paper, we describe our efforts to detect, characterize and understand Sybil account activity in the Renren online social network (OSN). We use ground truth provided by Renren Inc. to build measurement based Sybil account detectors, and deploy them on Renren to detect over 100,000 Sybil accounts. We study these Sybil accounts, as well as an additional 560,000 Sybil accounts caught by Renren, and analyze their link creation behavior. Most interestingly, we find that contrary to prior conjecture, Sybil accounts in OSNs do not form tight-knit communities. Instead, they integrate into the social graph just like normal users. Using link creation timestamps, we verify that the large majority of links between Sybil accounts are created accidentally, unbeknownst to the attacker. Overall, only a very small portion of Sybil accounts are connected to other Sybils with social links. Our study shows that existing Sybil defenses are unlikely to succeed in today's OSNs, and we must design new techniques to effectively detect and defend against Sybil attacks.