Detecting and Validating Sybil Groups in the Wild

Sybil attacks are one of the well-known and powerful attacks against online social networks. Sybil users propagate spam or unfairly increase the influence of target users. Previous works focus on detecting sybil users. However, sybil users alone do not harm the system. What is really dangerous is that multiple sybil users collude together and form a sybil group. In this paper, we present the first attempt to identify and validate sybil groups in Renren online social network. We build sybil group detector based on multiple attributes. We apply the sybil group detector to Renren, and identify 2,653 sybil groups and 989,764 sybil users. We design automatic validation mechanisms of sybil groups, by analyzing action time similarity of users in a group. Overall, 2440 (91.9%) sybil groups and 985,797 (99.6%) sybil users are successfully validated. Our sybil group detection and validation mechanisms have important implications for system design to defend against sybil attacks in online social networks.