  As businesses increasingly rely on social networking sites to engage with
their customers, it is crucial to understand and counter reputation
manipulation activities, including fraudulently boosting the number of Facebook
page likes using like farms. To this end, several fraud detection algorithms
have been proposed and some deployed by Facebook that use graph co-clustering
to distinguish between genuine likes and those generated by farm-controlled
profiles. However, as we show in this paper, these tools do not work well with
stealthy farms whose users spread likes over longer timespans and like popular
pages, aiming to mimic regular users. We present an empirical analysis of the
graph-based detection tools used by Facebook and highlight their shortcomings
against more sophisticated farms. Next, we focus on characterizing content
generated by social networks accounts on their timelines, as an indicator of
genuine versus fake social activity. We analyze a wide range of features
extracted from timeline posts, which we group into two main classes: lexical
and non-lexical. We postulate and verify that like farm accounts tend to often
re-share content, use fewer words and poorer vocabulary, and more often
generate duplicate comments and likes compared to normal users. We extract
relevant lexical and non-lexical features and and use them to build a
classifier to detect like farms accounts, achieving significantly higher
accuracy, namely, at least 99% precision and 93% recall.
