Strength in Numbers: Robust Tamper Detection in Crowd Computations

Popular social and e-commerce sites increasingly rely on crowd computing to rate and rank content, users, products and businesses. Today, attackers who create fake (Sybil) identities can easily tamper with these computations. Exist-ing defenses that largely focus on detecting individual Sybil identities have a fundamental limitation: Adaptive attack-ers can create hard-to-detect Sybil identities to tamper ar-bitrary crowd computations. In this paper, we propose Stamper, an approach for detect-ing tampered crowd computations that significantly raises the bar for evasion by adaptive attackers. Stamper design is based on two key insights: First, Sybil attack detection gains strength in numbers: we propose statistical analysis techniques that can determine if a large crowd computation has been tampered by Sybils, even when it is fundamentally hard to infer which of the participating identities are Sybil. Second, Sybil identities cannot forge the timestamps of their activities as they are recorded by system operators; Stam-per analyzes these unforgeable timestamps to foil adaptive attackers. We applied Stamper to detect tampered computa-tions in Yelp and Twitter. We not only detected previously known tampered computations with high accuracy, but also uncovered tens of thousands of previously unknown tam-pered computations in these systems