Towards Active Detection: Neutralizing Identity Clone Attacks on Social Networks

TL;DR

Identity Clone Attacks (ICAs) are no longer just about copying a profile picture. Modern attackers are "social engineers" who rebuild the victim's social graph to gain trust. This paper presents an active framework that uses Attribute Similarity and Friend Network Similarity (including recommended and excluded friends) to flag and validate clones before they can do damage.

Context: Why Passivity is Failing

Online Social Networks (OSNs) are built on trust. When you receive a friend request from someone you know, you are likely to accept it—even if you thought you were already friends. Attackers exploit this "awareness gap" to harvest sensitive data.

Current defenses are mostly passive:

1. User Education: Asking users to be more careful (rarely works).
2. Privacy Settings: Too complex for the average user.
3. Third-party Apps: Usually provide "badges" for the self, but don't actively hunt for clones of the self.

The authors argue for an active approach: the system should proactively search for similar profiles and subject them to "social authentication."

The Core Insight: The Tripartite Friend Network

The researchers' most significant contribution is moving beyond simple "Mutual Friends." They define a user's social footprint through three distinct lists:

• Friend List (FL): The obvious connections.
• Recommended Friend List (RFL): People the system thinks you should know. Attackers target these to look authentic to the victim's future connections.
• Excluded Friend List (EFL): People you know but don't want as "friends" (e.g., your boss or parents). If a clone adds your boss, it gains a bizarrely high level of perceived legitimacy among your other friends.

Methodology: From BPS to MFIPS

The paper proposes two layers of detection:

1. Basic Profile Similarity (BPS)

This assumes a simple attacker who clones the victim's attributes and adds a few mutual friends. It uses a weighted Cosine Similarity: $S_{BPS}=\frac{\sqrt{(\kappa S_{att}{)}^2+(\chi S_{bfn}{)}^2}}{\sqrt{{\kappa }^2+{\chi }^2}}$ This balances the "look" of the profile ($S_{att}$) with the "connections" of the profile ($S_{bfn}$).

2. Multiple-Faked Identities Profile Similarity (MFIPS)

This addresses the "Social Octopus" attack: where the adversary clones the victim and several of the victim's friends.

• Type A Attack: Attacker creates fakes of the victim's friends to act as "witnesses" for the victim's fake profile.
• Type B Attack: Attacker tricks the victim's real friends into adding the fake profile, creating a web of faked mutual connections.

Figure 1: Illustration of complex friend network cloning involving multiple faked identities.

Experiments: Performance on Facebook Data

Using an offline Facebook dataset of ~64k users, the authors simulated "victim" profiles (popular users with >25 friends) and injected clones.

Key Findings:

• Threshold Sensitivity: The detection rate is highly dependent on the threshold $\mu$. As $\mu$ increases, the filter becomes more "strict," potentially missing sophisticated clones.
• The Power of MFIPS: When the social graph becomes complex (attackers faking multiple identities), MFIPS consistently outperformed BPS.

Figure 2: Table showing that MFIPS (referred to as MFDM in experiments) identifies significantly more faked IDs as the threat model becomes more complex.

Conclusion and Future Outlook

This work provides a mathematical foundation for what we instinctively know: our identity is defined by the people we associate with (and those we avoid).

The Takeaway: Attributes (Name, Birthday) are easy to spoof, but the nuances of a social graph (Recommended vs. Excluded) provide a much more robust "Biological Signature" for the digital world. The authors suggest that the final step should be Social Authentication—challenging suspicious users to answer questions that only a real friend would know, rather than relying on credit cards or passports.

Limitations: The framework currently struggles with "Ghost Identities"—adversaries faking people who don't exist in the real world or aren't on social media yet. Addressing these will require cross-platform "Active Hunting" mechanisms.