  Sybil accounts are fake identities created to unfairly increase the power or
resources of a single malicious user. Researchers have long known about the
existence of Sybil accounts in online communities such as file-sharing systems,
but have not been able to perform large scale measurements to detect them or
measure their activities. In this paper, we describe our efforts to detect,
characterize and understand Sybil account activity in the Renren online social
network (OSN). We use ground truth provided by Renren Inc. to build measurement
based Sybil account detectors, and deploy them on Renren to detect over 100,000
Sybil accounts. We study these Sybil accounts, as well as an additional 560,000
Sybil accounts caught by Renren, and analyze their link creation behavior. Most
interestingly, we find that contrary to prior conjecture, Sybil accounts in
OSNs do not form tight-knit communities. Instead, they integrate into the
social graph just like normal users. Using link creation timestamps, we verify
that the large majority of links between Sybil accounts are created
accidentally, unbeknownst to the attacker. Overall, only a very small portion
of Sybil accounts are connected to other Sybils with social links. Our study
shows that existing Sybil defenses are unlikely to succeed in today's OSNs, and
we must design new techniques to effectively detect and defend against Sybil
attacks.
