S YBIL F USE : Combining Local Attributes with Global Structure to - PowerPoint PPT Presentation

S YBIL F USE : Combining Local Attributes with Global Structure to Perform Robust Sybil Detection Peng Gao 1 Binghui Wang 2 Neil Zhenqiang Gong 2 Sanjeev R. Kulkarni 1 Kurt Thomas 3 Prateek Mittal 1 1 Princeton University 2 Iowa State University 3 Google

Outline Introduction to Sybil Attack 1 2 Background and Related Work 3 The S YBIL F USE Framework Evaluation on Labeled Twitter Networks 4 Conclusion 5 Peng Gao S YBIL F USE 2 / 45

Outline Introduction to Sybil Attack 1 2 Background and Related Work 3 The S YBIL F USE Framework Evaluation on Labeled Twitter Networks 4 Conclusion 5 Peng Gao S YBIL F USE 3 / 45

Sybil Attack: Introduction Sybil Attack: A single adversary injects multiple colluding identities in the system to compromise security and privacy. Peng Gao S YBIL F USE 4 / 45

Sybil Attack: Introduction Sybil Attack: A single adversary injects multiple colluding identities in the system to compromise security and privacy. Peng Gao S YBIL F USE 5 / 45

Sybil Attack: Introduction Sybil Attack: A single adversary injects multiple colluding identities in the system to compromise security and privacy. Peng Gao S YBIL F USE 6 / 45

Sybil Attack: Impact Fake Malware reviews Spam Fake news messages Sybil Attack Scams Private data Unsolicited friend Others requests Peng Gao S YBIL F USE 7 / 45

Sybil Attack: Network Model Benign Region Sybil Region Attack Edges Peng Gao S YBIL F USE 8 / 45

Outline Introduction to Sybil Attack 1 2 Background and Related Work 3 The S YBIL F USE Framework Evaluation on Labeled Twitter Networks 4 Conclusion 5 Peng Gao S YBIL F USE 9 / 45

Local Attributes-Based Approaches • Blacklisting [ Ramachandran et al. CCS’07 ] • Whitelisting [ Yardi et al. Firsy Monday Vol15(1)’10 ] • URL filtering [ Thomas et al. IEEE S&P’11 ] • Local structural features [ Yang et al. IMC’11 ] Peng Gao S YBIL F USE 10 / 45

Local Attributes-Based Approaches • Blacklisting [ Ramachandran et al. CCS’07 ] • Whitelisting [ Yardi et al. Firsy Monday Vol15(1)’10 ] • URL filtering [ Thomas et al. IEEE S&P’11 ] • Local structural features [ Yang et al. IMC’11 ] Limitations: • Sybils can mimic the behaviors of benign users by manipulating their profiles and connections. Peng Gao S YBIL F USE 11 / 45

Global Structure-Based Approaches • SybilGuard [ Yu et al. SIGCOMM’06 ] • SybilLimit [ Yu et al. IEEE S&P’08 ] • SybilInfer [ Danezis et al. NDSS’09 ] • SybilRank [ Cao et al. NSDI’12 ] • CIA [ Yang et al. WWW’12 ] • SybilBelief [ Gong et al. TIFS’13 ] • ´ Integro [ Boshmaf et al. NDSS’15 ] • SybilSCAR [ Wang et al. INFOCOM’17 ] Peng Gao S YBIL F USE 12 / 45

Global Structure-Based Approaches • SybilGuard [ Yu et al. SIGCOMM’06 ] • SybilLimit [ Yu et al. IEEE S&P’08 ] • SybilInfer [ Danezis et al. NDSS’09 ] • SybilRank [ Cao et al. NSDI’12 ] • CIA [ Yang et al. WWW’12 ] • SybilBelief [ Gong et al. TIFS’13 ] • ´ Integro [ Boshmaf et al. NDSS’15 ] • SybilSCAR [ Wang et al. INFOCOM’17 ] Limitations: • Strong-trust assumptions: limited number of attack edges Peng Gao S YBIL F USE 13 / 45

Global Structure-Based Approaches • SybilGuard [ Yu et al. SIGCOMM’06 ] • SybilLimit [ Yu et al. IEEE S&P’08 ] • SybilInfer [ Danezis et al. NDSS’09 ] • SybilRank [ Cao et al. NSDI’12 ] • CIA [ Yang et al. WWW’12 ] • SybilBelief [ Gong et al. TIFS’13 ] • ´ Integro [ Boshmaf et al. NDSS’15 ] • SybilSCAR [ Wang et al. INFOCOM’17 ] Limitations: • Strong-trust assumptions: limited number of attack edges • RenRen network does not follow [ Yang et al. IMC’11 ] • Link farming on Twitter [ Ghosh et al. WWW’12 ] Peng Gao S YBIL F USE 14 / 45

Global Structure-Based Approaches • SybilGuard [ Yu et al. SIGCOMM’06 ] • SybilLimit [ Yu et al. IEEE S&P’08 ] • SybilInfer [ Danezis et al. NDSS’09 ] • SybilRank [ Cao et al. NSDI’12 ] • CIA [ Yang et al. WWW’12 ] • SybilBelief [ Gong et al. TIFS’13 ] • ´ Integro [ Boshmaf et al. NDSS’15 ] • SybilSCAR [ Wang et al. INFOCOM’17 ] Limitations: • Strong-trust assumptions: limited number of attack edges • RenRen network does not follow [ Yang et al. IMC’11 ] • Link farming on Twitter [ Ghosh et al. WWW’12 ] • ´ Integro requires the number of victims to be small and the victims are accurately predicted. Peng Gao S YBIL F USE 15 / 45

Outline Introduction to Sybil Attack 1 2 Background and Related Work 3 The S YBIL F USE Framework Evaluation on Labeled Twitter Networks 4 Conclusion 5 Peng Gao S YBIL F USE 16 / 45

Framework Overview SybilFuse Framework Known Labels Local Attributes Output local trust Trust Score Input scores final Structural Attributes Local Propagation scores Predicted Labels Social Network Classifiers Weighted Random Data Content Attributes Walk Node Ranking Weighted Loopy Global Structure Belief Propagation Directed/Undirected Graph Peng Gao S YBIL F USE 17 / 45

Local Trust Score Computation S v for node v : probability that v is benign • Computed via training a node classifier using local node attributes (e.g., degree, local clustering coefficient, profile info) • Normalize to [ 0 . 1 , 0 . 9 ] Peng Gao S YBIL F USE 18 / 45

Local Trust Score Computation S v for node v : probability that v is benign • Computed via training a node classifier using local node attributes (e.g., degree, local clustering coefficient, profile info) • Normalize to [ 0 . 1 , 0 . 9 ] S u , v for edge ( u , v ) : probability that u and v take the same label (i.e., models homophily strength) • Computed via training an edge classifier • Similarity between node u and node v • Normalize to [ 0 . 1 , 0 . 9 ] Peng Gao S YBIL F USE 19 / 45

Trust Score Propagation: Weighted Random Walk Set the initial score of every node v :  0 . 9 v is a training benign node   S ( 0 ) ( v ) = 0 . 1 v is a training Sybil node  S v else  Peng Gao S YBIL F USE 20 / 45

Trust Score Propagation: Weighted Random Walk Set the initial score of every node v :  0 . 9 v is a training benign node   S ( 0 ) ( v ) = 0 . 1 v is a training Sybil node  S v else  Score update equation: S u , v � S ( i ) ( v ) = S ( i − 1 ) ( u ) � ( u , w ) ∈ E S u , w ( u , v ) ∈ E Peng Gao S YBIL F USE 21 / 45

Trust Score Propagation: Weighted Random Walk Set the initial score of every node v :  0 . 9 v is a training benign node   S ( 0 ) ( v ) = 0 . 1 v is a training Sybil node  S v else  Score update equation: S u , v � S ( i ) ( v ) = S ( i − 1 ) ( u ) � ( u , w ) ∈ E S u , w ( u , v ) ∈ E After d = O ( log n ) iterations, we obtain the final score S F v : S F v = S ( d ) ( v ) Peng Gao S YBIL F USE 22 / 45

Trust Score Propagation: Weighted LBP Node & edge potentials: X v ∈ { 1 , − 1 } represents the label of node v � S v if X v = 1 ψ v ( X v ) = 1 − S v if X v = − 1 � S u , v if X u X v = 1 ψ u , v ( X u , X v ) = 1 − S u , v if X u X v = − 1 ( G , Ψ) defines a pairwise Markov Random Field. Peng Gao S YBIL F USE 23 / 45

Trust Score Propagation: Weighted LBP Belief update equation:   � � m u → v ( X v ) =  ψ u ( X u ) ψ u , v ( X u , X v ) m s → u ( X s )  X u s ∈ Neighbors ( u ) \ v Peng Gao S YBIL F USE 24 / 45

Trust Score Propagation: Weighted LBP Belief update equation:   � � m u → v ( X v ) =  ψ u ( X u ) ψ u , v ( X u , X v ) m s → u ( X s )  X u s ∈ Neighbors ( u ) \ v After d = 5 ∼ 10 iterations, we obtain the final score S F v : � bel v ( X v = x v ) ∝ ψ v ( X v = x v ) m u → v ( X v = x v ) u ∈ Neighbors ( v ) bel v ( X v = 1 ) S F v = bel v ( X v = 1 ) + bel v ( X v = − 1 ) Peng Gao S YBIL F USE 25 / 45

Sybil Account Prediction and Ranking Label L v of node v is predicted as: L v = sign ( S F v − threshold ) We can also rank nodes according to S F v . Sybil nodes with low scores will be ranked upfront. Peng Gao S YBIL F USE 26 / 45

Outline Introduction to Sybil Attack 1 2 Background and Related Work 3 The S YBIL F USE Framework Evaluation on Labeled Twitter Networks 4 Conclusion 5 Peng Gao S YBIL F USE 27 / 45

Small Twitter Network: Measurement • 8,167 nodes (7,358 benign nodes & 809 Sybil nodes) and 54,146 edges (40,001 attack edges) Peng Gao S YBIL F USE 28 / 45

Small Twitter Network: Measurement • 8,167 nodes (7,358 benign nodes & 809 Sybil nodes) and 54,146 edges (40,001 attack edges) We have the following observations: • More than half (53 . 4 % ) of Sybils are isolated, i.e., only connect to benign nodes. Peng Gao S YBIL F USE 29 / 45

Small Twitter Network: Measurement • 8,167 nodes (7,358 benign nodes & 809 Sybil nodes) and 54,146 edges (40,001 attack edges) We have the following observations: • More than half (53 . 4 % ) of Sybils are isolated, i.e., only connect to benign nodes. • The number of attack edges is large, with 49 attack edges on average per Sybil. Peng Gao S YBIL F USE 30 / 45