TWC: Small: Understanding and Defending Against Crowdsourced Online Identities

利用群众的力量可以做成了不起的事情。通过分解任务并分配给用户，“众包”系统可以完成复杂的任务，如翻译书籍或创建3D照片之旅。不幸的是，反过来也成立：滥用这些系统会创建强大的工具，可能危及在线社区的安全性，因为今天的安全机制侧重于防御自动脚本和虚假帐户，而不是真实用户。在恶意的众包系统中，客户发起活动，员工通过创建Facebook账户、发布虚假Yelp评论或在Twitter上散布谣言等任务获得报酬，结果与正常用户无法区分。这种类型的恶意活动被称为crowdturfing，因为它与众包系统和“astroturfing”相似。如今，pi已经找到了一些例子网站，早期的测量显示，一些网站的年收入超过100万美元，同时用户和收入呈指数级增长。该项目通过测量和实验详细研究众筹系统，并利用这些结果开发针对它们的强大防御。测量和访谈将用于研究他们的支持结构和激励措施；开发基于终端的技术来标记他们的结果和经济解决方案，减少对客户和工人的激励；并建立有效的检测系统，使用每个用户的行为模型来识别不同领域的众筹。这项工作可以改变我们对在线社区安全的看法，其结果可以指导部署针对众包虚假用户账户和活动的新保护机制。

Remarkable things can be achieved by harnessing power of the masses. By breaking down tasks and distributing to users, "crowdsourcing" systems can accomplish complex tasks such as translating books or creating 3D photo tours. Unfortunately, the opposite also holds: misuse of these systems creates powerful tools that can compromise the security of online communities, since today's security mechanisms focus on defending against automated scripts and fake accounts, but not real users.In a malicious crowdsourcing system, customers initiate campaigns, and workers are paid for tasks such as creating Facebook accounts, posting fake Yelp reviews, or starting rumors on Twitter, with results indistinguishable from those of normal users. This type of malicious activity is called crowdturfing, because of its similarity to both crowd-sourcing systems and "astroturfing." The PIs have already found example sites today, and early measurements show some that generate over $1Million in annual revenue, while growing exponentially in users and revenue.This project studies crowdturfing systems in detail via measurements and experiments, and use those results to develop robust defenses against them. Measurements and interviews will be used to study their support structure and incentives; develop endhost-based techniques to mark their results and economic solutions that reduce incentives for customers and workers; and build effective detection systems that identify crowdturfing in different domains using per-user behavioral models.This work can change the way we view security in online communities, and its results can guide the deployment of new protection mechanisms that target crowdsourced fake user accounts and activities.