{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,9]],"date-time":"2026-10-09T23:35:51Z","timestamp":1791588951796,"version":"4.3.4"},"reference-count":35,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2014,2,1]],"date-time":"2014-02-01T00:00:00Z","timestamp":1391212800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["61202423"],"award-info":[{"award-number":["61202423"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002855","name":"Ministry of Science and Technology of the People's Republic of China","doi-asserted-by":"publisher","award":["2011CB302305"],"award-info":[{"award-number":["2011CB302305"]}],"id":[{"id":"10.13039\/501100002855","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002855","name":"Ministry of Science and Technology of the People's Republic of China","doi-asserted-by":"publisher","award":["2013AA013203"],"award-info":[{"award-number":["2013AA013203"]}],"id":[{"id":"10.13039\/501100002855","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000145","name":"Division of Information and Intelligent Systems","doi-asserted-by":"publisher","award":["IIS-0916307 and IIS-847925"],"award-info":[{"award-number":["IIS-0916307 and IIS-847925"]}],"id":[{"id":"10.13039\/100000145","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Knowl. Discov. Data"],"published-print":{"date-parts":[[2014,2]]},"abstract":"<jats:p>Sybil accounts are fake identities created to unfairly increase the power or resources of a single malicious user. Researchers have long known about the existence of Sybil accounts in online communities such as file-sharing systems, but they have not been able to perform large-scale measurements to detect them or measure their activities. In this article, we describe our efforts to detect, characterize, and understand Sybil account activity in the Renren Online Social Network (OSN). We use ground truth provided by Renren Inc. to build measurement-based Sybil detectors and deploy them on Renren to detect more than 100,000 Sybil accounts. Using our full dataset of 650,000 Sybils, we examine several aspects of Sybil behavior. First, we study their link creation behavior and find that contrary to prior conjecture, Sybils in OSNs do not form tight-knit communities. Next, we examine the fine-grained behaviors of Sybils on Renren using clickstream data. Third, we investigate behind-the-scenes collusion between large groups of Sybils. Our results reveal that Sybils with no explicit social ties still act in concert to launch attacks. Finally, we investigate enhanced techniques to identify stealthy Sybils. In summary, our study advances the understanding of Sybil behavior on OSNs and shows that Sybils can effectively avoid existing community-based Sybil detectors. We hope that our results will foster new research on Sybil detection that is based on novel types of Sybil features.<\/jats:p>","DOI":"10.1145\/2556609","type":"journal-article","created":{"date-parts":[[2014,2,18]],"date-time":"2014-02-18T14:08:32Z","timestamp":1392732512000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":185,"title":["Uncovering social network Sybils in the wild"],"prefix":"10.1145","volume":"8","author":[{"given":"Zhi","family":"Yang","sequence":"first","affiliation":[{"name":"Peking University, Beijing, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christo","family":"Wilson","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiao","family":"Wang","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tingting","family":"Gao","sequence":"additional","affiliation":[{"name":"Renren Inc., Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ben Y.","family":"Zhao","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yafei","family":"Dai","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2014,2]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1314333.1314336"},{"key":"e_1_2_1_2_1","volume-title":"Proc. of CEAS.","author":"Benevenuto Fabricio","year":"2010","unstructured":"Fabricio Benevenuto , Gabriel Magno , Tiago Rodrigues , and Virgilio Almeida . 2010 . Detecting spammers on Twitter . In Proc. of CEAS. Fabricio Benevenuto, Gabriel Magno, Tiago Rodrigues, and Virgilio Almeida. 2010. Detecting spammers on Twitter. In Proc. of CEAS."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644900"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2008\/10\/P10008"},{"key":"e_1_2_1_5_1","volume-title":"Proc. of NSDI.","author":"Cao Qiang","year":"2012","unstructured":"Qiang Cao , Michael Sirivianos , Xiaowei Yang , and Tiago Pregueiro . 2012 . Aiding the detection of fake accounts in large scale social online services . In Proc. of NSDI. Qiang Cao, Michael Sirivianos, Xiaowei Yang, and Tiago Pregueiro. 2012. Aiding the detection of fake accounts in large scale social online services. In Proc. of NSDI."},{"key":"e_1_2_1_6_1","volume-title":"Proc of NDSS.","author":"Danezis George","year":"2009","unstructured":"George Danezis and Prateek Mittal . 2009 . SybilInfer: Detecting Sybil nodes using social networks . In Proc of NDSS. George Danezis and Prateek Mittal. 2009. SybilInfer: Detecting Sybil nodes using social networks. In Proc of NDSS."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.5555\/646334.687813"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879147"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866311"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879190"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455774"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772751"},{"key":"e_1_2_1_13_1","volume-title":"Proc. of ICWSM.","author":"Lee Kyumin","year":"2011","unstructured":"Kyumin Lee , Brian David Eoff , and James Caverlee . 2011 . Seven months with the devils: A long-term study of content polluters on Twitter . In Proc. of ICWSM. Kyumin Lee, Brian David Eoff, and James Caverlee. 2011. Seven months with the devils: A long-term study of content polluters on Twitter. In Proc. of ICWSM."},{"key":"e_1_2_1_14_1","volume-title":"Social media and young adults","author":"Lenhart Amanda","unstructured":"Amanda Lenhart , Kristen Purcell , Aaron Smith , and Kathryn Zickuhr . 2010. Social media and young adults . Pew Research Center . Amanda Lenhart, Kristen Purcell, Aaron Smith, and Kathryn Zickuhr. 2010. Social media and young adults. Pew Research Center."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2007.84"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879191"},{"key":"e_1_2_1_17_1","volume-title":"Proc. of Usenix Security.","author":"Motoyama M.","unstructured":"M. Motoyama , D. McCoy , K. Levchenko , S. Savage , and G. M. Voelker . 2011. Dirty jobs: The role of freelance labor in Web service abuse . In Proc. of Usenix Security. M. Motoyama, D. McCoy, K. Levchenko, S. Savage, and G. M. Voelker. 2011. Dirty jobs: The role of freelance labor in Web service abuse. In Proc. of Usenix Security."},{"key":"e_1_2_1_18_1","unstructured":"Samantha Murphy. 2010. Teens ditch e-mail for texting and Facebook. MSNBC.com.  Samantha Murphy. 2010. Teens ditch e-mail for texting and Facebook. MSNBC.com."},{"key":"e_1_2_1_19_1","volume-title":"Proc. of WOSN.","author":"Nazir Atif","year":"2010","unstructured":"Atif Nazir , Saqib Raza , Chen-Nee Chuah , and Burkhard Schipper . 2010 . Ghostbusting Facebook: Detecting and characterizing phantom profiles in online social gaming applications . In Proc. of WOSN. Atif Nazir, Saqib Raza, Chen-Nee Chuah, and Burkhard Schipper. 2010. Ghostbusting Facebook: Detecting and characterizing phantom profiles in online social gaming applications. In Proc. of WOSN."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/984622.984660"},{"key":"e_1_2_1_21_1","unstructured":"Sophos. 2007. Sophos Facebook ID probe shows 41&percnt; of users happy to reveal all to potential identity thieves.  Sophos. 2007. Sophos Facebook ID probe shows 41&percnt; of users happy to reveal all to potential identity thieves."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1989656.1989664"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920263"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068840"},{"key":"e_1_2_1_25_1","volume-title":"Proc. of NSDI.","author":"Tran Nguyen","year":"2009","unstructured":"Nguyen Tran , Bonan Min , Jinyang Li , and Lakshminarayanan Subramanian . 2009 . Sybil-resilient online content voting . In Proc. of NSDI. Nguyen Tran, Bonan Min, Jinyang Li, and Lakshminarayanan Subramanian. 2009. Sybil-resilient online content voting. In Proc. of NSDI."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1851182.1851226"},{"key":"e_1_2_1_27_1","volume-title":"Proc. of SECRYPT.","author":"Wang Alex Hai","year":"2010","unstructured":"Alex Hai Wang . 2010 . Don\u2019t follow me: Spam detection on Twitter . In Proc. of SECRYPT. Alex Hai Wang. 2010. Don\u2019t follow me: Spam detection on Twitter. In Proc. of SECRYPT."},{"key":"e_1_2_1_28_1","volume-title":"Proc. of Usenix Security.","author":"Wang Gang","year":"2013","unstructured":"Gang Wang , Tristan Konolige , Christo Wilson , Xiao Wang , Heather Zheng , and Ben Zhao . 2013 . You are how you click: Clickstream analysis for Sybil detection . In Proc. of Usenix Security. Gang Wang, Tristan Konolige, Christo Wilson, Xiao Wang, Heather Zheng, and Ben Zhao. 2013. You are how you click: Clickstream analysis for Sybil detection. In Proc. of Usenix Security."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2187836.2187928"},{"key":"e_1_2_1_30_1","volume-title":"Proc. of CEAS.","author":"Webb Steve","year":"2008","unstructured":"Steve Webb , James Caverlee , and Calton Pu . 2008 . Social honeypots: Making friends with a spammer near you . In Proc. of CEAS. Steve Webb, James Caverlee, and Calton Pu. 2008. Social honeypots: Making friends with a spammer near you. In Proc. of CEAS."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519089"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068841"},{"key":"e_1_2_1_33_1","first-page":"1","article-title":"Detecting spam in a Twitter network","volume":"15","author":"Yardi Sarita","year":"2010","unstructured":"Sarita Yardi , Daniel Romero , Grant Schoenebeck , and Danah Boyd . 2010 . Detecting spam in a Twitter network . First Monday 15 , 1 . Sarita Yardi, Daniel Romero, Grant Schoenebeck, and Danah Boyd. 2010. Detecting spam in a Twitter network. First Monday 15, 1.","journal-title":"First Monday"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.13"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159945"}],"container-title":["ACM Transactions on Knowledge Discovery from Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2556609","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2556609","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T08:10:05Z","timestamp":1750234205000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2556609"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,2]]},"references-count":35,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2014,2]]}},"alternative-id":["10.1145\/2556609"],"URL":"https:\/\/doi.org\/10.1145\/2556609","relation":{},"ISSN":["1556-4681","1556-472X"],"issn-type":[{"value":"1556-4681","type":"print"},{"value":"1556-472X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,2]]},"assertion":[{"value":"2012-09-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2012-09-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2014-02-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}