Serving more than one billion users around the world, today's online
social networks (OSNs) pervade our everyday life and change the way people
connect and communicate with each other. However, the open nature of
OSNs attracts a constant interest in attacking and exploiting them.
In particular, they are vulnerable to various attacks launched through
malicious accounts, including fake accounts and compromised real user
accounts. In those attacks, malicious accounts are used to send out
spam, spread malware, distort online voting, etc.
In this dissertation, we present practical systems that we have designed
and built to help OSNs effectively throttle malicious accounts. The overarching
contribution of this dissertation is the approaches that leverage the fundamental
weaknesses of attackers to defeat them. We have explored defense schemes along
two dimensions of an attacker's weaknesses: limited social relationships
and strict economic constraints.
The first part of this dissertation focuses on how to leverage social
relationship constraints to detect fake accounts. We present SybilRank, a novel
social-graph-based detection scheme that can scale up to OSNs with billions of
users. SybilRank is based on the observation that the social connections between
fake accounts and real users, called attack edges, are limited. It formulates
the detection as scalable user ranking according to the landing probability of
early-terminated random walks on the social graph. SybilRank generates an informative
user-ranked list with a substantial fraction of fake accounts at the bottom,
and bounds the number of fake accounts that are ranked higher than legitimate
users to O(log n) per attack edge, where n is the total number of users. We have
demonstrated the scalability of SybilRank via a prototype on Hadoop MapReduce,
and its effectiveness in the real world through a live deployment at Tuenti,
the largest OSN in Spain.
The second part of this dissertation focuses on how to exploit an attacker's
economic constraints to uncover malicious accounts. We present SynchroTrap, a system
that uncovers large groups of active malicious accounts, including both fake
accounts and compromised accounts, by detecting their loosely synchronized actions.
The design of SynchroTrap is based on the observation that malicious accounts usually
perform loosely synchronized actions to accomplish an attack mission, due to
limited budgets, specific mission goals, etc. SynchroTrap transforms the detection
into a scalable clustering algorithm. It uncovers large groups of accounts
that act similarly at around the same time for a sustained period of time. To
handle the enormous volume of user action data in large OSNs, we designed SynchroTrap
as an incremental processing system that processes small data chunks on a daily
basis but aggregates the computational results over the continuous data stream.
We implemented SynchroTrap on Hadoop and Giraph, and we deployed it on Facebook
and Instagram. This deployment has resulted in the unveiling of millions of malicious
accounts and thousands of large attack campaigns per month.
","abstract_html":"<p>Serving more than one billion users around the world, today's online </p><p>social networks (OSNs) pervade our everyday life and change the way people </p><p>connect and communicate with each other. However, the open nature of </p><p>OSNs attracts a constant interest in attacking and exploiting them. </p><p>In particular, they are vulnerable to various attacks launched through </p><p>malicious accounts, including fake accounts and compromised real user </p><p>accounts. In those attacks, malicious accounts are used to send out </p><p>spam, spread malware, distort online voting, etc.</p><p>In this dissertation, we present practical systems that we have designed </p><p>and built to help OSNs effectively throttle malicious accounts. The overarching </p><p>contribution of this dissertation is the approaches that leverage the fundamental </p><p>weaknesses of attackers to defeat them. We have explored defense schemes along </p><p>two dimensions of an attacker's weaknesses: limited social relationships </p><p>and strict economic constraints.</p><p>The first part of this dissertation focuses on how to leverage social </p><p>relationship constraints to detect fake accounts. We present SybilRank, a novel </p><p>social-graph-based detection scheme that can scale up to OSNs with billions of </p><p>users. SybilRank is based on the observation that the social connections between </p><p>fake accounts and real users, called attack edges, are limited. It formulates </p><p>the detection as scalable user ranking according to the landing probability of </p><p>early-terminated random walks on the social graph. SybilRank generates an informative </p><p>user-ranked list with a substantial fraction of fake accounts at the bottom, </p><p>and bounds the number of fake accounts that are ranked higher than legitimate </p><p>users to O(log n) per attack edge, where n is the total number of users. We have </p><p>demonstrated the scalability of SybilRank via a prototype on Hadoop MapReduce, </p><p>and its effectiveness in the real world through a live deployment at Tuenti, </p><p>the largest OSN in Spain.</p><p>The second part of this dissertation focuses on how to exploit an attacker's </p><p>economic constraints to uncover malicious accounts. We present SynchroTrap, a system </p><p>that uncovers large groups of active malicious accounts, including both fake </p><p>accounts and compromised accounts, by detecting their loosely synchronized actions.</p><p>The design of SynchroTrap is based on the observation that malicious accounts usually </p><p>perform loosely synchronized actions to accomplish an attack mission, due to </p><p>limited budgets, specific mission goals, etc. SynchroTrap transforms the detection </p><p>into a scalable clustering algorithm. It uncovers large groups of accounts </p><p>that act similarly at around the same time for a sustained period of time. To </p><p>handle the enormous volume of user action data in large OSNs, we designed SynchroTrap</p><p>as an incremental processing system that processes small data chunks on a daily </p><p>basis but aggregates the computational results over the continuous data stream. </p><p>We implemented SynchroTrap on Hadoop and Giraph, and we deployed it on Facebook </p><p>and Instagram. This deployment has resulted in the unveiling of millions of malicious </p><p>accounts and thousands of large attack campaigns per month.</p>","abstract_has_math":false,"creators":["Cao, Qiang"],"institution":null,"degree_name":null,"degree_level":null,"degree_discipline":null,"degree_department":null,"school":null,"contributors":[],"advisors":["Yang, Xiaowei"],"committee_chairs":[],"committee_members":[],"year":2014,"date_issued":"2014","date_published":"2014","updated_at":"2026-07-24T02:07:23Z","subjects":["Computer science","Malicious accounts","Online Social Networks","SybilRank","SynchroTrap"],"languages":[],"rights":[],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/10161/9031","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Yang, Xiaowei"]},{"key":"dc:creator","label":"Author","values":["Cao, Qiang"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2014-08-27T15:20:38Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2014-08-27T15:20:38Z"]},{"key":"dc:date.issued","label":"Date","values":["2014"]},{"key":"dc:type","label":"Dc Type","values":["Dissertation"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Computer science","Malicious accounts","Online Social Networks","SybilRank","SynchroTrap"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/10161/9031"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Serving more than one billion users around the world, today's online
social networks (OSNs) pervade our everyday life and change the way people
connect and communicate with each other. However, the open nature of
OSNs attracts a constant interest in attacking and exploiting them.
In particular, they are vulnerable to various attacks launched through
malicious accounts, including fake accounts and compromised real user
accounts. In those attacks, malicious accounts are used to send out
spam, spread malware, distort online voting, etc.
In this dissertation, we present practical systems that we have designed
and built to help OSNs effectively throttle malicious accounts. The overarching
contribution of this dissertation is the approaches that leverage the fundamental
weaknesses of attackers to defeat them. We have explored defense schemes along
two dimensions of an attacker's weaknesses: limited social relationships
and strict economic constraints.
The first part of this dissertation focuses on how to leverage social
relationship constraints to detect fake accounts. We present SybilRank, a novel
social-graph-based detection scheme that can scale up to OSNs with billions of
users. SybilRank is based on the observation that the social connections between
fake accounts and real users, called attack edges, are limited. It formulates
the detection as scalable user ranking according to the landing probability of
early-terminated random walks on the social graph. SybilRank generates an informative
user-ranked list with a substantial fraction of fake accounts at the bottom,
and bounds the number of fake accounts that are ranked higher than legitimate
users to O(log n) per attack edge, where n is the total number of users. We have
demonstrated the scalability of SybilRank via a prototype on Hadoop MapReduce,
and its effectiveness in the real world through a live deployment at Tuenti,
the largest OSN in Spain.
The second part of this dissertation focuses on how to exploit an attacker's
economic constraints to uncover malicious accounts. We present SynchroTrap, a system
that uncovers large groups of active malicious accounts, including both fake
accounts and compromised accounts, by detecting their loosely synchronized actions.
The design of SynchroTrap is based on the observation that malicious accounts usually
perform loosely synchronized actions to accomplish an attack mission, due to
limited budgets, specific mission goals, etc. SynchroTrap transforms the detection
into a scalable clustering algorithm. It uncovers large groups of accounts
that act similarly at around the same time for a sustained period of time. To
handle the enormous volume of user action data in large OSNs, we designed SynchroTrap
as an incremental processing system that processes small data chunks on a daily
basis but aggregates the computational results over the continuous data stream.
We implemented SynchroTrap on Hadoop and Giraph, and we deployed it on Facebook
and Instagram. This deployment has resulted in the unveiling of millions of malicious
accounts and thousands of large attack campaigns per month.
"]},{"key":"dc:title","label":"Title","values":["Understanding and Defending Against Malicious Identities in Online Social Networks"]}]}],"canonical_facts":{"dc:contributor.advisor":["Yang, Xiaowei"],"dc:creator":["Cao, Qiang"],"dc:date.accessioned":["2014-08-27T15:20:38Z"],"dc:date.available":["2014-08-27T15:20:38Z"],"dc:date.issued":["2014"],"dc:description.abstract":["Serving more than one billion users around the world, today's online
social networks (OSNs) pervade our everyday life and change the way people
connect and communicate with each other. However, the open nature of
OSNs attracts a constant interest in attacking and exploiting them.
In particular, they are vulnerable to various attacks launched through
malicious accounts, including fake accounts and compromised real user
accounts. In those attacks, malicious accounts are used to send out
spam, spread malware, distort online voting, etc.
In this dissertation, we present practical systems that we have designed
and built to help OSNs effectively throttle malicious accounts. The overarching
contribution of this dissertation is the approaches that leverage the fundamental
weaknesses of attackers to defeat them. We have explored defense schemes along
two dimensions of an attacker's weaknesses: limited social relationships
and strict economic constraints.
The first part of this dissertation focuses on how to leverage social
relationship constraints to detect fake accounts. We present SybilRank, a novel
social-graph-based detection scheme that can scale up to OSNs with billions of
users. SybilRank is based on the observation that the social connections between
fake accounts and real users, called attack edges, are limited. It formulates
the detection as scalable user ranking according to the landing probability of
early-terminated random walks on the social graph. SybilRank generates an informative
user-ranked list with a substantial fraction of fake accounts at the bottom,
and bounds the number of fake accounts that are ranked higher than legitimate
users to O(log n) per attack edge, where n is the total number of users. We have
demonstrated the scalability of SybilRank via a prototype on Hadoop MapReduce,
and its effectiveness in the real world through a live deployment at Tuenti,
the largest OSN in Spain.
The second part of this dissertation focuses on how to exploit an attacker's
economic constraints to uncover malicious accounts. We present SynchroTrap, a system
that uncovers large groups of active malicious accounts, including both fake
accounts and compromised accounts, by detecting their loosely synchronized actions.
The design of SynchroTrap is based on the observation that malicious accounts usually
perform loosely synchronized actions to accomplish an attack mission, due to
limited budgets, specific mission goals, etc. SynchroTrap transforms the detection
into a scalable clustering algorithm. It uncovers large groups of accounts
that act similarly at around the same time for a sustained period of time. To
handle the enormous volume of user action data in large OSNs, we designed SynchroTrap
as an incremental processing system that processes small data chunks on a daily
basis but aggregates the computational results over the continuous data stream.
We implemented SynchroTrap on Hadoop and Giraph, and we deployed it on Facebook
and Instagram. This deployment has resulted in the unveiling of millions of malicious
accounts and thousands of large attack campaigns per month.
"],"dc:identifier.uri":["https://hdl.handle.net/10161/9031"],"dc:subject":["Computer science","Malicious accounts","Online Social Networks","SybilRank","SynchroTrap"],"dc:title":["Understanding and Defending Against Malicious Identities in Online Social Networks"],"dc:type":["Dissertation"]},"updated_at":"2026-07-24T02:07:23Z"}