LERSSE-RefConfPaper-2014-004

Integro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs

Yazan Boshmaf ; Dionysios Logothetis ; Georgos Siganos ; Jorge Leria ; Jose Lorenzo ; Matei Ripeanu ; Konstantin Beznosov

11 November 2014

Abstract: Detecting fake accounts in online social networks (OSNs) protects OSN operators and their users from various malicious activities. Most detection mechanisms attempt to predict and classify user accounts as real (i.e., benign, honest) or fake (i.e., malicious, Sybil) by analyzing user-level activities or graph-level structures. These mechanisms, however, are not robust against adversarial attacks in which fake accounts cloak their operation with patterns resembling real user behavior. We herein observe that victims, benign users who control real accounts and have befriended fakes, form a distinct classification category that is useful for designing robust detection mechanisms. As attackers have no control over victim accounts and cannot alter their activities, a victim account classifier which relies on user-level activities is relatively hard to circumvent. Moreover, as fakes are directly connected to victims, a fake account detection mechanism that integrates victim prediction into graph-level structures can be more robust against manipulations of the graph. To validate this idea, we designed Integro, a scalable defense system that helps OSNs detect automated fake accounts using a robust user ranking scheme. Integro starts by predicting victim accounts from user-level activities. After that, it integrates these predictions into the graph as weights such that edges incident to predicted victims have lower weights than others. Finally, Integro ranks user accounts based on a modified random walk that starts from a known real account. Integro guarantees that most real accounts rank higher than fakes so that OSN operators can take actions against low-ranking fake accounts. We implemented Integro using widely-used, open-source parallel computing platforms in which it scaled nearly linearly. We evaluated Integro against SybilRank, the state-of-the-art in fake account detection, using real-world datasets and a large-scale deployment at Tuenti, the largest OSN in Spain. In particular, we show that Integro significantly outperforms SybilRank in user ranking quality, with the only requirement that the used victim classifier is better than random. Moreover, the deployment of Integro at Tuenti resulted in an order of magnitude higher fake account detection precision, as compared to SybilRank.

Keyword(s): Victim prediction ; Fake account detection ; Socialbots ; Online social networks

Published in: Boshmaf et al. "Integro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs" In proceedings the 2015 Network and Distributed System Security Symposium (NDSS'15), San Diego, USA.:

The record appears in these collections:
Refereed Conference Papers

 Record created 2014-11-10, last modified 2015-12-03


Fulltext:
NDSS_260_Final - Download fulltextPDF Download fulltextPDF (PDFA)
boshmaf_ndss_2015 - Download fulltextPDF Download fulltextPDF (PDFA)
Rate this document:

Rate this document:
1
2
3
 
(Not yet reviewed)