  Livestreaming platforms have become increasingly popular in recent years as a
means of sharing and advertising creative content. Popular content streamers
who attract large viewership to their live broadcasts can earn a living by
means of ad revenue, donations and channel subscriptions. Unfortunately, this
incentivized popularity has simultaneously resulted in incentive for fraudsters
to provide services to astroturf, or artificially inflate viewership metrics by
providing fake "live" views to customers. Our work provides a number of major
contributions: (a) formulation: we are the first to introduce and characterize
the viewbot fraud problem in livestreaming platforms, (b) methodology: we
propose FLOCK, a principled and unsupervised method which efficiently and
effectively identifies botted broadcasts and their constituent botted views,
and (c) practicality: our approach achieves over 98% precision in identifying
botted broadcasts and over 90% precision/recall against sizable synthetically
generated viewbot attacks on a real-world livestreaming workload of over 16
million views and 92 thousand broadcasts. FLOCK successfully operates on larger
datasets in practice and is regularly used at a large, undisclosed
livestreaming corporation.
