SybilRadar: A Graph-Structure Based Framework for Sybil Detection in On-line Social Networks
SybilRadar: A Graph-Structure Based Framework for Sybil Detection in On-line Social Networks
复制标题
DOI：
10.1007/978-3-319-33630-5_13
复制
发表时间：
2016-05
期刊：
影响因子：
--
通讯作者：
Dieudonne Mulamba;I. Ray;I. Ray
中科院分区：
文献类型：
--
作者：
Dieudonne Mulamba;I. Ray;I. Ray
在线社交网络（Online Social Networks， OSN）越来越多地成为Sybil攻击的受害者。这些攻击包括创建多个串通的假账户（称为Sybils），目的是破坏OSN的信任基础，进而导致安全和隐私侵犯。现有的Sybils检测机制要么基于对用户属性和活动的分析，要么基于对OSN的拓扑结构的分析，这些分析通常是不完整的、不准确的，或者会引起隐私问题。后一类作品做出了两个主要假设，即OSN可以被划分为Sybil区域和非Sybil区域，而Sybil节点和非Sybil节点之间的所谓“攻击边”只有少数，在现实场景中往往不成立。因此，当攻击者将Sybils设计成像真实用户帐户一样运行时，这些机制的性能就会很差。在这项工作中，我们提出了SybilRadar，这是一个基于OSN的基于图的结构属性的鲁棒Sybil检测框架，它不依赖于类似基于结构的框架所做的传统的非现实假设。我们在合成的和真实的OSN数据上运行SybilRadar。我们的研究结果表明，即使在网络不是快速混合的情况下，SybilRadar也具有非常高的检测率，Sybils和非Sybils之间的所谓“攻击边”有数万条。
Online Social Networks (OSN) are increasingly becoming victims of Sybil attacks. These attacks involve creation of multiple colluding fake accounts (called Sybils) with the goal of compromising the trust underpinnings of the OSN, in turn, leading to security and the privacy violations. Existing mechanisms to detect Sybils are based either on analyzing user attributes and activities, which are often incomplete or inaccurate or raise privacy concerns, or on analyzing the topological structures of the OSN. Two major assumptions that the latter category of works make, namely, that the OSN can be partitioned into a Sybil and a non-Sybil region and that the so-called “attack edges” between Sybil nodes and non-Sybil nodes are only a handful, often do not hold in real life scenarios. Consequently, when attackers engineer Sybils to behave like real user accounts, these mechanisms perform poorly. In this work, we propose SybilRadar, a robust Sybil detection framework based on graph-based structural properties of an OSN that does not rely on the traditional non-realistic assumptions that similar structure-based frameworks make. We run SybilRadar on both synthetic as well as real-world OSN data. Our results demonstrate that SybilRadar has very high detection rate even when the network is not fast mixing and the so-called “attack edges” between Sybils and non-Sybils are in the tens of thousands.