ND-Sync: Detecting Synchronized Fraud Activities

Given the retweeting activity for the posts of several Twitter users, how can we distinguish organic activity from spammy retweets by paid followers to boost a post’s appearance of popularity? More generally, given groups of observations, can we spot strange groups? Our main intuition is that organic behavior has more variability, while fraudulent behavior, like retweets by botnet members, is more synchronized. We refer to the detection of such synchronized observations as the Synchonization Fraud problem, and we study a specific instance of it, Retweet Fraud Detection, which is manifested in Twitter. Here, we propose: (A) ND-SYNC, an efficient method for detecting group fraud, and (B) a set of carefully designed features for characterizing retweet threads. ND-SYNC is effective in spotting retweet fraudsters, robust to different types of abnormal activity, and adaptable since it can easily incorporate more/different features. Focusing on the Retweet Fraud problem, ND-SYNC achieves a 97% accuracy on a real dataset of approximately 12 million retweets crawled from Twitter.