ND-Sync: Detecting Synchronized Fraud Activities

  • Maria Giatsoglou
  • Despoina Chatzakou
  • Neil Shah
  • Alex Beutel
  • Christos Faloutsos
  • Athena Vakali
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9078)


Given the retweeting activity for the posts of several Twitter users, how can we distinguish organic activity from spammy retweets by paid followers to boost a post’s appearance of popularity? More generally, given groups of observations, can we spot strange groups? Our main intuition is that organic behavior has more variability, while fraudulent behavior, like retweets by botnet members, is more synchronized. We refer to the detection of such synchronized observations as the Synchonization Fraud problem, and we study a specific instance of it, Retweet Fraud Detection, manifested in Twitter. Here, we propose: (A) ND-Sync, an efficient method for detecting group fraud, and (B) a set of carefully designed features for characterizing retweet threads. ND-Sync is effective in spotting retweet fraudsters, robust to different types of abnormal activity, and adaptable as it can easily incorporate additional features. Our method achieves a 97% accuracy on a real dataset of 12 million retweets crawled from Twitter.


Outlier Detection Anomaly Detection Twitter User Fraud Detection Outlier Detection Method 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Almaatouq, A., et al.: Twitter: who gets caught? observed trends in social micro-blogging spam. In: WebSci, pp. 33–41. ACM (2014)Google Scholar
  2. 2.
    Beutel, A., et al.: CopyCatch: stopping group attacks by spotting lockstep behavior in social networks. In: WWW, pp. 119–130. ACM (2013)Google Scholar
  3. 3.
    Breunig, M., et al.: LOF: identifying density-based local outliers. In: Proc. ACM SIGMOD Conf. 2000, pp. 93–104 (2000)Google Scholar
  4. 4.
    Brys, G., et al.: A Robust Measure of Skewness. Journal of Computational and Graphical Statistics 13, 996–1017 (2004)CrossRefMathSciNetGoogle Scholar
  5. 5.
    Chan, P. K., et al.:Modeling multiple time series for anomaly detection. In: ICDM, pp. 90–97. IEEE Computer Society (2005)Google Scholar
  6. 6.
    Chandola, V., et al.: Anomaly Detection: A Survey. ACM Comput. Surv. 41(3), 15:1–15:58 (2009)CrossRefMathSciNetGoogle Scholar
  7. 7.
    Chu, Z., et al.: Detecting Automation of Twitter Accounts: Are You a Human, Bot, or Cyborg? IEEE Trans. Dependable Secur. Comput. 9(6), 811–824 (2012)CrossRefGoogle Scholar
  8. 8.
    Cook, D., et al.: Twitter Deception and Influence: Issues of Identity, Slacktivism, and Puppetry. Journal of Information Warfare 13(1), 58–71 (2014)Google Scholar
  9. 9.
    Freitas, C.A., et al.: Reverse Engineering Socialbot Infiltration Strategies in Twitter. ArXiv e-prints (2014)Google Scholar
  10. 10.
    Garrett, R.G.: The Chi-square Plot: a Tool for Multivariate Outlier Recognition. Journal of Geochemical Exploration 32, 319–341 (1989)CrossRefGoogle Scholar
  11. 11.
    Ghosh, R., et al.: Entropy-based classification of ‘Retweeting’ activity on twitter. In: KDD Workshop on Social Network Analysis (SNA-KDD) (2011)Google Scholar
  12. 12.
    Ghoting, A., et al.: Fast mining of distance-based outliers in high-dimensional datasets. Data Mining and Knowledge Discovery 16(3), 349–364 (2008)CrossRefMathSciNetGoogle Scholar
  13. 13.
    Hazel, G.: Multivariate Gaussian MRF for Multispectral Scene Segmentation and Anomaly Detection. IEEE Transactions on Geoscience and Remote Sensing 38(3), 1199–1211 (2000)CrossRefGoogle Scholar
  14. 14.
    Hubert, M., et al.: ROBPCA: A New Approach to Robust Principal Component Analysis. Technometrics 47, 64–79 (2005)CrossRefMathSciNetGoogle Scholar
  15. 15.
    Hubert, M., et al.: Robust PCA for Skewed Data and its Outlier Map. Computational Statistics & Data Analysis 53(6), 2264–2274 (2009)CrossRefzbMATHMathSciNetGoogle Scholar
  16. 16.
    Jiang, M., et al.: CatchSync: catching synchronized behavior in large directed graphs. In: KDD, pp. 941–950. ACM (2014)Google Scholar
  17. 17.
    Jiang, M., Cui, P., Beutel, A., Faloutsos, C., Yang, S.: Inferring strange behavior from connectivity pattern in social networks. In: Tseng, V.S., Ho, T.B., Zhou, Z.-H., Chen, A.L.P., Kao, H.-Y. (eds.) PAKDD 2014, Part I. LNCS, vol. 8443, pp. 126–138. Springer, Heidelberg (2014) CrossRefGoogle Scholar
  18. 18.
    Jolliffe, I.T.: Discarding Variables in a Principal Component Analysis. II: Real Data. Journal of the Royal Statistical Society. Series C (Applied Statistics) 22(1), 21–31 (1973)Google Scholar
  19. 19.
    Noble, C.C., et al.: Graph-based anomaly detection. In: KDD (2003)Google Scholar
  20. 20.
    Papadimitriou, S., et al.: LOCI: Fast outlier detection using the local correlation integral. In: ICDE 2003 (2003)Google Scholar
  21. 21.
    Shah, N., et al.: Spotting suspicious link behavior with fBox: an adversarial perspective. In: ICDM (2014)Google Scholar
  22. 22.
    Stringhini, G., et al.: Follow the green: growth and dynamics in twitter follower markets. In: IMC, pp. 163–176. ACM (2013)Google Scholar
  23. 23.
    Tavares, G., et al.: Scaling-Laws of Human Broadcast Communication Enable Distinction between Human, Corporate and Robot Twitter Users. PLoS ONE 8(7), e65774 (2013)CrossRefGoogle Scholar
  24. 24.
    Twitter Inc. S-1 Filing, US Securities and Exchange Commission (2013).
  25. 25.
    Xiong, L., et al.: Group Anomaly Detection using Flexible Genre Models. Advances in Neural Information Processing Systems 24, 1071–1079 (2011)Google Scholar
  26. 26.
    Xiong, L., et al.: Efficient learning on point sets. In: ICDM, pp. 847–856 (2013)Google Scholar
  27. 27.
    Yang, C., et al.: Analyzing spammers’ social networks for fun and profit: a case study of cyber criminal ecosystem on twitter. In: WWW, pp. 71–80 (2012)Google Scholar
  28. 28.
    Yu, R., et al.: GLAD: group anomaly detection in social media analysis. In: KDD, pp. 372–381. ACM (2014)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  • Maria Giatsoglou
    • 1
  • Despoina Chatzakou
    • 1
  • Neil Shah
    • 2
  • Alex Beutel
    • 2
  • Christos Faloutsos
    • 2
  • Athena Vakali
    • 1
  1. 1.Informatics DepartmentAristotle University of ThessalonikiThessalonikiGreece
  2. 2.School of Computer ScienceCarnegie Mellon UniversityPittsburghUSA

Personalised recommendations