1. SybilSCAR: Sybil Detection in Online Social Networks via Local Rule based Propagation
Binghui Wang, Le Zhang, Neil Zhenqiang Gong
Department of Electrical and Computer Engineering

2. OUTLINE
Background
Algorithm
Evaluation
Conclusion

3. OUTLINE
Background
Algorithm
Evaluation
Conclusion

4. Online Social Networks (OSNs) are Popular
1.86 billion
monthly active users
300 million
monthly active users
500 million
tweets per day

5. OSNs Have Many Fake Accounts (Sybils)

6. Threats of Sybil Attacks
Sybils can be used to perform various malicious activities
Distribute spams and phishing attacks
Harvest private user data
Influence financial market
Disrupt presidential election ?? …
Sybil detection is an urgent research problem

7. Existing Sybil Detection Methods
Various methods by multiple research communities
networking, security, data mining, etc.
Feature-based methods: Feature extraction + ML classifier
Feature: side information (e.g., content, behavior), local structure (e.g., clustering coefficient, common neighbor), etc.
Classifier: support vector machine, logistic regression, etc.
Fundamental limitation: not adversarially robust
Structure-based methods: Leverage the global structure of OSNs
Leverage edge between nodes to propagate graph information
More adversarially robust

8. Pros and Cons of Structure-based Methods
Random Walk (RW)-based methods
Pros
Efficient/Scalable
Guarantee to converge
Cons
Use either labeled benign nodes or labeled Sybils, but not both
Not robust to label noise
Loopy Belief Propagation (LBP)-based methods
Leverage both labeled benign nodes and labeled Sybils
Robust to label noise
Not scalable
Not guaranteed to converge

9. Our Contribution: SybilSCAR
A novel structure-based Sybil detection method
Maintain advantages and address limitations of existing methods
Compared with RW, it leverages both labeled benign nodes and labeled Sybils, and is robust to label noise
Compared with LBP, it is scalable and convergent
In a nutshell, scalable, convergent, accurate, robust to label noise

10. OUTLINE
Background
Algorithm
Evaluation
Conclusion

11. Problem Definition Input Output Social Graph G=(V, E) Training set
Labeled Sybils
Labeled benign nodes
Output
Label of each remaining node

12. Our General Local Rule-based Framework
Learn prior knowledge qu using training set
Reputation score, e.g., RW-based methods
Probability of being Sybil, e.g., LBP-based methods
E.g., u is labeled Sybil, qu =0.9; labeled benign, qu =0.1; unlabeled, qu =0.5
Propagate the prior knowledge among social graph to get posterior knowledge pu
Iteratively apply a local rule to every node
Rank posterior knowledge to detect Sybils
Sybils have larger values than benign nodes

13. What is Local Rule
Local Rule: Neighbor influences + prior knowledge => posterior knowledge v
fvu
Different methods use different neighbor influences
fsu s u pu
Different methods have different combinations of neighbor influence with prior knowledge qu
ftu t

14. Existing Methods are Special Cases
RW-based methods: Additive local rule
LBP-based methods: Multiplicative local rule
wuv : weight of the edge (u,v)

15. Our Local Rule: Neighbor Influence
Homophily strength wvu: probability that u and v have the same label
Neighbor influence fvu: the probability that u is a Sybil, given the information about its neighbor v and the homophily strength wvu

16. Our Local Rule: Combine Neighbor Influence with Prior Knowledge Multiplicatively
Do not store neighbor influence => Efficient
Leverage both labeled benign nodes and labeled Sybils => Accurate
Multiplicative combination => Robust to label noise
However, not guaranteed to converge

17. Linearization to Guarantee Converge
Use the approximation
Use residual vector
Nonlinear multiplication reduces to linear residual addition

18. Our Final Local Rule in Residual Form
Set equal homophily strength wvu =w for all edges

19. OUTLINE
Background
Algorithm
Evaluation
Conclusion

20. Experimental Setups Datasets Compared methods
Facebook with synthesized Sybils
Small Twitter with real Sybils
Large Twitter with real Sybils
Compared methods
State-of-the-art RW-based method: SybilRank
State-of-the-art LBP-based method: SybilBelief

21. Ranking Accuracy SybilSCAR is slightly better than SybilBelief
SybilSCAR and SybilBelief are more accurate than SybilRank

22. Robustness to Label Noise
SybilSCAR and SybilBelief almost have the same robustness against label noise
SybilSCAR and SybilBelief are much more robust to label noise than SybilRank

23. Scalability SybilSCAR is as scalable as SybilRank
SybilSCAR is more scalable than SybilBelief

24. Convergence SybilSCAR and SybilRank converge
SybilBelief cannot converge

25. OUTLINE
Background
Algorithm
Evaluation
Conclusion

26. Conclusion
A general local rule-based framework to unify existing Sybil detection methods
Our novel local rule integrates advantages of existing methods, while overcoming their limitations
Future work
Design local rules to detect other types of Sybils, e.g., web spams, fake reviews, and fake likes
Compare different local rules theoretically
Learn homophily strength for each edge

27. Thanks & Questions
Binghui Wang
Le Zhang
Neil Zhenqiang Gong

28. Convergence Analysis
Lemma 1: Given a linear system , it convergences with any initial choice y iff the spectral radius
Theorem 2 (Necessary and sufficient condition): SybilSCAR converges iff
Difficult to achieve, seek for sufficient convergence condition!
Theorem 3 (Sufficient condition): SybilSCAR guarantees to converge if

29. Complexity Analysis Space complexity Time complexity
SybilSCAR has the same asymptotic space and time complexity with RW-based SybilRank and LBP-based SybilBelief
However, it is more space efficient and time efficient than SybilBelief, as it does not store neighbor influence of every edge