Search Rank Fraud De-Anonymization in Online Systems

TL;DR

This paper presents Dolos, a system that de-anonymizes search rank fraudsters in online systems by analyzing behaviors, traits, and community structures, successfully linking fraud activities to real identities and uncovering widespread app review fraud.

Contribution

The paper introduces Dolos, a novel system combining behavioral analysis, community detection, stylometry, and deep learning to attribute search rank fraud to individual fraudsters and their real identities.

Findings

Dolos correctly identified 95% of fraudster-controlled communities.

Uncovered fraudsters responsible for 97.5% of fraud apps in Google Play.

Identified 1,056 suspicious reviewer groups in monitored app reviews.

Abstract

We introduce the fraud de-anonymization problem, that goes beyond fraud detection, to unmask the human masterminds responsible for posting search rank fraud in online systems. We collect and study search rank fraud data from Upwork, and survey the capabilities and behaviors of 58 search rank fraudsters recruited from 6 crowdsourcing sites. We propose Dolos, a fraud de-anonymization system that leverages traits and behaviors extracted from these studies, to attribute detected fraud to crowdsourcing site fraudsters, thus to real identities and bank accounts. We introduce MCDense, a min-cut dense component detection algorithm to uncover groups of user accounts controlled by different fraudsters, and leverage stylometry and deep learning to attribute them to crowdsourcing site profiles. Dolos correctly identified the owners of 95% of fraudster-controlled communities, and uncovered fraudsters who promoted as many as 97.5% of fraud apps we collected from Google Play. When evaluated on 13,087 apps (820,760 reviews), which we monitored over more than 6 months, Dolos identified 1,056 apps with suspicious reviewer groups. We report orthogonal evidence of their fraud, including fraud duplicates and fraud re-posts.