TSD: Detecting Sybil Accounts in Twitter

Abstract

Fake identities and user accounts (also called "Sybils") in online communities represent today a treasure for adversaries to spread fake product reviews, malware and spam on social networks, and astroturf political campaigns. State-of-the-art in the defense mechanisms includes Automated Turing Tests (ATTs such as CAPTCHAs) and graph-based Sybil detectors. Sybil detectors in social networks leverage the assumption that Sybils will find it hard to befriend real users which leads to Sybils being connected to each other forming strongly connected sub graphs that can be detected using graph theory. However, the large majority of Sybils are in fact successful in integrating themselves into real user communities (such as the case in Twitter and Facebook). In this paper, we first study and compare the current detection mechanisms of Sybil accounts. We also explore various types of Twitter Sybil accounts detection features with the objective of building an effective and practical classifier. In order to build and evaluate our classifier, we collect and manually label a dataset of twitter accounts, including human users, bots, and hybrid (i.e., tweets are posted by both human and bots). We believe this Twitter Sybils corpus will help researchers in conducting sound measurement studies. We also develop a browser plug-in (that we call Twitter Sybils Detector or TSD for short) that utilizes our classifier and warns the user about possible Sybil accounts before accessing them, upon clicking on a Twitter account.

Can We Trust Social Media Data?

“…However, most of the botnet fake accounts are flagged within six months of their creation. This may be due to the multiple classifiers developed by the community in the past year to flag bots' accounts and suspend them [1,2,7]. SMF service customers must therefore see their follower count decrease as the fake accounts are flagged.…”

Attacking strategies and temporal analysis involving Facebook discussion groups

“…Once the post thread starts, those malicious accounts would be the first few users to lead the discussion. Second strategy is that this duplicate messages has been propagated 10 times by one account (Figure 10), most of them appeared in the early stage of targets posts, the commenting time vector of this 1,8,9,11,12,13,14,18]. Here we examine the mean and standard deviation between malicious accounts and normal accounts, the result is as Figure 11.…”

“…Commonly used profile characteristics are age, image, description, number of followers, geolocation, and total number of posts. These data are used to construct classification systems and supervised learning algorithms aimed at identifying and blocking malicious accounts [9] [10] [11] [12] [13]. OSN connectivity and interaction features have been used to experiment with graph-based approaches to identifying accounts that exhibit inappropriate behaviors.…”

Performance Examination and Feature Selection on Sybil User Data using Recursive Feature Elimination

“…While considering the two classes a) fake and b) human, the experiment was conducted for each case mentioned above. To evaluate the final outcomes of these experiments some metrics were considered based on standard indicators, namely [13]: Overfitting of a model occurs when one trains a model too well on their training set. This results in a good accuracy during training but when we run the same model for testing, the accuracy we get is not up to the mark.…”

“…With such widespread access and easy-to-use interfaces, it became a suitable domain for Sybil accounts. Sybil accounts are generally fake accounts [13]. These accounts are primarily created for increasing the followers of a targeted account.…”