International Conference on Computing, Communication and Automation (ICCCA2017)

ANALYSIS AND DETECTION OF FAKE

PROFILE OVER SOCIAL NETWORK
Dr Vijay Tiwari
Ministry of Defence
[email protected]

Abstract Latest developments have seen exponential or have common backgrounds etc. User generated content
increase in clientele of social networks. Facebook has 1.5 is circulated over the network. Some of the examples of
billion users. More than 10 million likes and shares are current day social networks are Pinterest, Twitter,
executed daily. Many other networks like ‘linkedin’, Facebook, Google+, Instagram, Tumblr, Foursquare
‘Instagram’, ‘Pinterest’, ‘Twitter’ etc are fast growing.
andLinkedIn. As of end 2016, there were 1.5
Growth of social networkshas given rise to a very high
number of fake user profiles created out of ulterior motives. billionmonthly active people over Facebook of which 1.3
Fake profiles are also known as Sybils or social Bots. Many billion use Facebook on their mobile devices daily.
such profiles try and befriend the benign users with an Twitter is a Micro blogging social site with 289 million
ultimate aim of gaining access to privileged active users. It allows 140 characters and approximately
information.Social engineering is the primary cause of 9,100 tweets are reported every second. LinkedIn has 380
threats in any Online Social Network (OSN). Thispaper million (79% of them 35 years or older) users worldwide.
reviews many methods to detect the fake profiles and their LinkedIn is a professional/ business oriented social
online social bot. Multi agent perspective of online social network.Pinterest is a social site that deals in fashion,
networks has also been analysed. It also discusses the
health, décor, fitness and other multiple contemporary
Machine learning methods useful in profile creation and
analysis. areas. It has 70 million users predominantly female.
Instagram and Google+ have
Keywords-- Fake profile, online social network (OSN), approximately 300 million users[2]. Fake profile
Sybil region, honest region, network nodes, network edge, management is mostly an automated to cover large parts
benign nodes. of Online Social Networks (OSNs). Social bots can be
defined as semi-automatic or automatic computer
I. INTRODUCTION programs that represent thehuman behavior in OSN.
Fake profile over social networks is a serious problem. Social bots are the main tools used by hackers to attack
Social media is growing really fast and becoming OSNs. Recent use of Social bots in advertisement and
vulnerable to fake profiles. Many popular entities are election campaign has been highlighted. Twitter [3] and
taking to social media to gain popularity. Every day social Tumblr [4] have been effectively used to mould the public
sites generate large amount of data.Fake profiles are opinion.
mostly created in a pseudo name (of a person not liked)
and usually misleading and abusive posts and pictures are
created on their profiles to tarnish the image of a person.
The challenge remains identification of fake profiles
embedded within huge volumes of unstructured data. In
this paper we study previous work done in this field and
evolution of fake profile detection techniques. Fake
profiles are dangerous to the reputation of any
organization and cause unnecessary perplexity with
intermittent updates [1].

II. SOCIAL NETWORKS

Social networks are the social connection build over

online network among the people having similar interests
Fig 1. Online Social Network mapping

ISBN:978-1-5090-6471-7/17/$31.00 ©2017 IEEE 175

Authorized licensed use limited to: PES University Bengaluru. Downloaded on February 07,2024 at 12:21:51 UTC from IEEE Xplore. Restrictions apply.
 International Conference on Computing, Communication and Automation (ICCCA2017)

OSNs have their internal checks to detect to create a fictitious profile for which actual user does not
spamming and other fake activities. Facebook has exist.
Facebook Immune System (FIS) which does around 25
billion checks every day [5]. However FIS cannot detect III. DEFENCE AGAINST SYBIL IN OSN
the fake profiles and social bots. Naive Bayes
Classification, Decision Tree Classification and Support We may consider an online social network topology G =
Vector Machine are the common techniques used in (V,E). Network comprises of V nodes and E edges [7]. In
detection of spam emails. However, Support Vector OSN topologies, user is denoted by a node v ∈ V and
Machinewas reported to effective against fake profile [5]. friendship relationship between two user’s u and v is
denoted by an edge (u, v) ∈ E. Only mutual relationships
A. Social Proximity between u and v are considered. Every node v ∈ V in the
network is either a benign node, or a Sybil identity.
Finding the social proximity between two users
in any OSNs is a challenge. Many different ways have
been suggested. Profile matching is one of the suggested
ways for determining friendship between two people. It
involves ascertaining if they have common profile
attributes. Profile attribute may be interest [13],
symptoms [14], or some other social coordinates [15]. It
was reported that many a times a common friend can also
serve as the measure of proximity between two users [16].
Previously cryptographic tools were used to ensure
privacy of user profile.
Asymmetric Social Proximity was defined in
[17]. Asymmetric social proximity considered two users Fig 2. Attack Edges [7]
and their friends’ may share common perceptions of
All benign nodes are located in benign regions
communities. This asymmetry based private matching
and Sybil nodes are located in Sybil region. Sybil region
protocol can explain some of the tenets of social
edges and benign region edges are connected through
proximity leading to friendship in OSNs. Three different
attack edges. Sybil accounts are analysed based on their
private matching protocols, i.e., L1P, L2P/EL2P, and L3P
content. Contents may refer to new posts in Facebook or
were proposed in [17]. These offer users the different
hash tags on Twitter. These approaches incorporate white
privacy levels. Protocol L3P has the highest privacy level
listing and black listing of URLs, other machine learning
which ensures that two users only know their common
techniques such as Bayesian Reasoning, Support Vector
communities once they become friends.
Machines and Clustering [8]-[9]. Content based approach
may prove to be ineffective in case attacker mimics the
B. Private Set Intersection (PSI) protocols
behavior of benign user. To avoid this weakness, structure
based approach was proposed. Whenever there is a strong
Two or more parties on OSN interact in confidence
trust relationship between the users, setting up links to
without making public their input sets. Interaction leads to
benign users will be difficult. SybilGuard [10] and
an intersection set or the common ground. In a server and
SybilLimit [11] are based on the appreciation that random
a client model, as a two party interaction, client gets the
move among the benign networks is easier as compared
knowledge of what is common between the client input
with movement among the Sybil nodes and then to benign
and server data set and also the size of server data
nodes.SybilBelief [12]distinguishes pair wise nodes in the
set.Server however gets access to the size of client’s input
form of Markov Random space.
set.
A. SybilGuard
C. Major Threats over OSN

Four kinds of basic threats are envisaged in OSNs. Online Social networks whether peer-to-peer or
These could be enumerated as Classic threat, modern decentralised, are all vulnerable to Sybil attacks. A
Threat, Combination threats and threats targeting malicious user creates many fake profiles and acts as if to
children. Identity cloning attack poses a classical threat. be various, divergent nodes in the network.SybilGuard, is
As the name suggests, fake profile is created using the a protocol for preventive measure to counter Sybil
personal details of an honest user. Here fake user attacks. Protocol is based on the “social network”. In such
masquerades the actual user. Fake profile thus creates a network every edge represents the trust relationship.
confusion and defames the target. Further attempt is made Many malicious users are capable of

176
Authorized licensed use limited to: PES University Bengaluru. Downloaded on February 07,2024 at 12:21:51 UTC from IEEE Xplore. Restrictions apply.
 International Conference on Computing, Communication and Automation (ICCCA2017)

creatingfakeidentities but getting trust relationships over 2008 SybilLimit ʘ (sqrt (mn) log n)
social network is very difficult. There is thus, a distinct
drop in the graphical value between the Sybil nodes and 2009 SybilInfer ʘ (n (log n) 2)
the honest nodes[18]. SybilGuardworks on admission
control protocol, where it limits admission of fake nodes
2010 Mislove’s ʘ (n2)
to ʘ (√ n log n) for everyattack edge. Efficiency of
algorithm
SybilGuard can be greatly enhanced by limiting number
of attack edges. In order to avoid detection a malicious 2011 SybilRank ʘ (sn log n)
user may try and establish social trust by making many
friends. However, it may not be possible at a very large
scale and in an automated manner.Acceptable limit of F. Facebook
Sybil nodes in synthetic social network is nearly 2000.
SybilGuard was also experimented with Kleinberg’s FaceBook has 1.66 billion users of which 1.03
synthetic social network [19]. billion mobile users were active as per Jun 2016 figures.
10 million ‘like’ and ‘share’ buttons are in use on daily
B. Sybillimit basis. Another statistics reveals that 29.7% of the users
are young between the age group of 25-34 years. The
Another algorithm Sybil limit discussed in [11] network is expanding rapidly. Every second five users are
restrictsthe Sybil admission as ʘ (log n) for every attack added to the database.Highest traffic is recorded during
edge. To limit Sybils, a resilient admission control the lull hours between 1-3 pm in the afternoon. So people
method is proposed to ensure permission of entry only to prefer to check FaceBook while at rest. Another
honest nodes and limit the entry of Sybil nodes to a interesting statistics reveals that users are more active on
minimum. Whereas an attacker would be looking to Thursdays and Fridays (18% more usage). However it is
increase the entry of Sybil nodes to maximum and limit also reported that FaceBook may have 83 million fake
admission of honest nodes profiles [22].in order to check a profile we may work on
the profile picture of user. Download the picture and save
C. Sybilproof it on HDD. We run www.tineye.com this will check the
use of similar image at other places: say
Sybilproofconverts a peer to peer network in to a www.romance.com (dating site), sale pages etc. so it
confidence network and prevents attacker into creating indicates towards a fake profile. Similarly we may like to
many trust relationship [19]. check the person who is chatting is genuine and has
verified credentials. While we start the chat on Facebook,
D. SybilInfer open netstat-an. It will search IP address. We select one of
the established IP address and go to google- iplocation.net
As proposed in [20] SybilInfer is a centralized scheme. to explore iplocation finder. We paste the IP address to
SybilInfer algorithm proposed in [20] is more liberal in see the actual location of the user.Grabify IP logger is
terms of admission per attacker node. It queries about the also useful. It showsdate and IP address.
social network graph based on Bayesian approach.
Depending on the analysis of the conditional probabilities, IV. OSN BOT DETECTION
it makes a decision in favour or against the Sybil node.
Bot detection in the OSN has three primary
E. Sybil Rank techniques: Bot detection based on scrutiny of content,
detection based on Network graph and a combination or
SybilRank [21]is another proposal for detection of fake hybrid approach. Initially attempts to detect Bots were
profiles which outperforms other previous approaches. It limited primarily focused towards the relationship among
uses seed selection method and tends to rely on short the users. Quality of relationships was one of the
random walks. important indicators for the detection of malicious or fake
activity. This type of detection technique was focused on
Table 1. Comparative computational cost of Sybil detection algorithm the scrutiny of contents and admission control. Admission
control coupled with content scrutiny was effective
Year Detection Computational cost against fake profiles. Another way to facilitate detection
Model of Bots was to segment network into smaller private sub-
networks. These smaller networks were more aware about
2008 SybilGuard ʘ (sqrt (mn) log n) their relationships with members. Hence developing a
fake relationship was difficult in such a case. It is
assumed that in case large numbers of Sybil nodes are

177
Authorized licensed use limited to: PES University Bengaluru. Downloaded on February 07,2024 at 12:21:51 UTC from IEEE Xplore. Restrictions apply.
 International Conference on Computing, Communication and Automation (ICCCA2017)

created, online social network gets fragmented in to may contribute towards vital information. Multi-agent
smaller set of edgeslooking up such small edges over perspectiveis developed based on the relationship
global network. Hence a special kind of ‘random walk’ between social networks and multi-agent systems
was proposed to small quotient cut (attack edges) between [27].Online social networks can be differentiated as
an honest node and a benign Sybil node. Sybil nodes may cooperative, non-cooperative, and multiple social
gain legitimacy by befriending some benign nodes networks. This classification is based on synchronization
however doing this at a very large scale, in automated among various users in the network.Another
manner will be difficult.
classification of Application users is done as leaders and
followers as proposed using Longitudinal User Centered
A. Privacy
Influence (LUCI) in [28]. This classification relies on the
An experiment to analyse Social engineering attributes of the leaders as introvert leaders, extrovert
[23] intricacies in Facebook network was conducted. leaders. Users other than leaders are classified as
Number of users (including female and male followers and neutrals.
friends),records pertaining to honest users, common
interests of various users was analysed. Privacy awareness V. MACHINE LEARNING METHODS
and regulation was given a special emphasis to prevent
number of attackers. Facebook employs the Facebook Several machine learning algorithms have been outlined
Immune System [24] to detectuser behaviour patterns and during survey on efficient machine learning by Al- Jarrah
any type of spam. User privacy is mutually dependent on Efficiency in processing of big data contributes towards
them as friend of one can access the other. So befriending prediction accuracy. High prediction accuracy can be
is a responsible action.As evident Bots are [25], the expected based on high computational cost and memory.
fastest means through which any Sybil node can connect
to honest nodes.User clicks have also been proposed as a A. POST Method
medium to detect Sybil node as proposed in [26].
People, Objectives, Strategies and Technology are
four most relevant factors defining the use of OSNs.
1.8 People describe the platform over which the
1.6 communication has to commence. Objectives will define
1.4 the purpose of communication over OSNs. Strategy is to
AMU (bn users)

1.2 achieve more and more people and subscribers over the
1 social networks. Technology demands a tool that is most
0.8 appropriate to use. A combined effect of all these four
factors ensures efficient OSN with high number of
0.6
subscribers.
0.4
0.2 B. Accuracy of detection models
0
Most of the existing detection techniques use graph
features of networks to distinguish between real and fake
nodes. These techniques do not address scalability.
Analysis of user metadata and machine learning
OSN techniques has an edge over the graph technique in
detecting the fake profile. Active machine learning
algorithms are more apt in checking the modern day large
Fig 3. Average monthly user access scale bots. Bulk content posting from a node could easily
. be detected on any social network.

B. Multi-agent perspectives on social networks C. Supervised learning

Social network analysis means study of social Supervised learning could be represented in
relationships among the people of society. It analyses the many forms as done in logistic regression (SybilFrame
relational aspect of the structures. Direct interaction is 2015), Boosting, Naïve Bayes, Decision Tree, Decision
Table etc. Social engineering is the primary cause of
the best source of relational information however it is
threats in OSN. Many methods such as persistent threats,
not always available. In these situations the social agent
dumpster diving, phishing, shoulder surfing, water holing,

178
Authorized licensed use limited to: PES University Bengaluru. Downloaded on February 07,2024 at 12:21:51 UTC from IEEE Xplore. Restrictions apply.
 International Conference on Computing, Communication and Automation (ICCCA2017)

reverse social engineering, spamming, spear fishing, fake [11] H. Yu, P. B. Gibbons, M. Kaminsky, and F. Xiao,
“SybilLimit: A near-optimal social network defense against Sybil
identities etc. Social engineering is evolving and every
attacks,” in IEEE S & P, 2008.
such effort is appearing more realistic. [12] N. Z. Gong, M. Frank, and P. Mittal, “Sybilbelief: A semi-
supervised learning approach for structure basedsybil detection,” CoRR,
VI. CONCLUSION 2013.

[13] H. Lin, S. S. M. Chow, D. Xing, Y. Fang, and Z. Cao,

Fake profile over the online social networks is a “Privacy-Preserving Friend Search over Online Social Networks,”
reality. Fake profiles are sharply on the rise as people Cryptology ePrint Archive, Report 2011/445, 2011. [Online]. Available:
accept it as a common medium of communication. More http://eprint.iacr.org/.
and more personal details are now included on social [14] X. Liang, M. Barua, R. Lu, X. Lin, and X. Shen,
“HealthShare: Achieving Secure and Privacy-preserving Health
network profiles, causing enormous information content Information Sharing through Health Social Networks,” Computer
to be available for manipulation. Social engineering Communications, vol. 35, no. 15, pp. 1910–1920, 2012.
techniques and Fake profiles have really threatened [15] H. Zhu, S. Du, M. Li, and Z. Gao, “Fairness-aware and
privacypreserving friend matching protocol in mobile social networks,”
stealing of information and careful manipulation towards
IEEE Transactions on Emerging Topics in Computing, vol. 1, no. 1, pp.
furtherance of ulterior motives. In this paper we reviewed 192–200, June 2005.
various methods of detecting the fake profiles in existing [16] E. D. Cristofaro, M. Manulis, and B. Poettering, “Private
social networks. Impact of machine learning methods and Discovery of Common Social Contacts,” in Proceedings of the 9th
international conference on Applied cryptography and network security:
their impact on Bot detection have also been discussed. ACNS’11, Nerja, Spain, June 2011.
[17] Li, M.; Cao, N.; Yu, S. and Lou, W. Findu: Privacy-
VI. FUTURE WORK Preserving Personal Profile Matching for Proximity Based Mobile
Fake profiles will evolve further and will surely use Social Networks, In Proceedings IEEE INFOCOM, 2011, pp. 2435-2443
latest social engineering techniques. Attempts have also [18] Haifeng Yu, Michael Kaminsky, Phillip B. Gibbons,
Abraham Flaxman, “SybilGuard: Defending Against Sybil Attacks via
been reported to influence the popularity or a person or Social Networks”, Intel Research Pittsburgh Carnegie Mellon
product in the target market. A potent admission control University.
and content based detection technique will be a necessary [19] J. Kleinberg, “The small-world phenomenon: An algorithm
perspective,” in Proc. ACM STOC, 2000, pp. 163–170.
requirement which will demonstrate better performance in
[20] Danezis, G. and Mittal, P. Sybilinfer: Detecting sybil nodes
terms of false positive and false negatives. using social networks, in Proc. NDSS, 2009, The Internet Society.
[21] Cao, Q. Sirivianos, M. Yang, X. Pregueiro, T. Aiding the
REFERENCES detection of fake accounts in large scale social online services,
Proceedings of the 9th USENIX conference on Networked Systems
Design and Implementation, USENIX Association, 2012, pp. 15-15.
[1] Matt. Social Media Comparison Infographic.2014.at
[22] https:// zephoria. com/ top- 15- valuable- facebook-statistics.
https://leveragenewagemedia.com/blog/socialmediainfographic/.
[23] Hattingh, F.; Buitendag, A. and Thompson, W.
[2]Social Media comparison infographichttps://
Userwillingness to accept friend requests on SNS: A
leveragenewagemedia.com /blog /social-media-infographic/.
Facebookexperiment, In Proceedings of IST-Africa Conference,
[3] Tumblr. URL:www.tumblr.com/.
2014,pp. 1-8.
[4]Foursquare. URL:https://foursquare.com/.
[24] Ghorbani, S. and Ganjali, Y. Will you be my
[5]R. Nithin Reddy &Nitesh Kumar, “Automatic Detection of Fake
friend?Privacyimplications of accepting friendships in online
Profiles in Online Social Networks”, Department of Computer Science
socialnetworks, Proceedings of International Conference onInformation
and Engineering, National Institute of Technology, Rourkela.
Society (I-Society), 2012, pp. 340-345.
[6] Al-Jarrah, O.Y.; Yoo, P.D.; Muhaidat, S.; Karagiannidis,
[25] Gao, P.; Gong, N.Z.; Kulkarni, S.; Thomas, K. and
G.K. and Taha, K. Efficient Machine Learning for Big Data: A Review,
Mittal,P.SybilFrame: A defence-in Depth Framework for Structure-
Big Data Research, 2 (2015), pp. 87–93.
Based Sybil Detection, 2015.
[7] PengGao, Neil Zhenqiang Gong, SanjeevKulkarni, Kurt
[26] Londhe, A.D.; Bhalshinge, V.A.; Bhosale, R.V. and coer, P.
Thomas, and Prateek Mittal, “SybilFrame: A Defense-in-Depth
An Application of Clickstream Analysis for Sybil detection using
Framework for Structure-Based Sybil Detection”. URL https://arxiv.org
Hadoop Technology, International Journal of Engineering Development
/pdf/ 1503.02985v1.pdf dated 10 Mar 2015.
and Research, 3, 2015, pp. 126- 130.
[8] A. H. Wang, “Don’t follow me - spam detection in twitter,”
[27] Jin, L.; Chen, Y.; Wang, T.; Hui, P. and Vasilakos, A.V.
in SECRYPT 2010, 2010. [15] G.
Understanding user behaviour in online social networks: a survey, IEEE
[9] G. Stringhini, C. Kruegel, and G. Vigna, “Detecting
Communications Magazine, 51 (2013), pp. 144- 150.
spammers on social networks,” in ACSAC, 2010.
[28] Thapa, A.; Li, M.; Salinas, S. and Li, P. Asymmetric
[10] H. Yu, M. Kaminsky, P. B. Gibbons, and A. Flaxman.,
SocialProximity Based Private Matching Protocols for OnlineSocial
“SybilGuard: Defending against Sybil attacks via social networks,” in
Networks, IEEE Transactions on Parallel andDistributed Systems, 26,
SIGCOMM, 2006.
(2015),1547-1559.

179
Authorized licensed use limited to: PES University Bengaluru. Downloaded on February 07,2024 at 12:21:51 UTC from IEEE Xplore. Restrictions apply.