In online discussion communities, users can interact and share information and opinions on a wide variety of topics. However, some users may create multiple identities, or sockpuppets, and engage in undesired behavior by deceiving others or manipulating discussions. In this work, we study sockpuppetry across nine discussion communities, and show that sockpuppets differ from ordinary users in terms of their posting behavior, linguistic traits, as well as social network structure. Sockpuppets tend to start fewer discussions, write shorter posts, use more personal pronouns such as I'', and have more clustered ego-networks. Further, pairs of sockpuppets controlled by the same individual are more likely to interact on the same discussion at the same time than pairs of ordinary users. Our analysis suggests a taxonomy of deceptive behavior in discussion communities. Pairs of sockpuppets can vary in their deceptiveness, i.e., whether they pretend to be different users, or their supportiveness, i.e., if they support arguments of other sockpuppets controlled by the same user. We apply these findings to a series of prediction tasks, notably, to identify whether a pair of accounts belongs to the same underlying user or not. Altogether, this work presents a data-driven view of deception in online discussion communities and paves the way towards the automatic detection of sockpuppets.
 Users of social media sites can use more than one account. These identities have pseudo anonymous properties, and as such some users abuse multiple accounts to perform undesirable actions, such as posting false or misleading remarks comments that praise or defame the work of others. The detection of multiple user accounts that are controlled by an individual or organization is important. Herein, we define the problem as sockpuppet gang (SPG) detection. First, we analyze user sentiment orientation to topics based on emotional phrases extracted from their posted comments. Then we evaluate the similarity between sentiment orientations of user account pairs, and build a similar-orientation network (SON) where each vertex represents a user account on a social media site. In an SON, an edge exists only if the two user accounts have similar sentiment orientations to most topics. The boundary between detected SPGs may be indistinct, thus by analyzing account posting behavior features we propose a multiple random walk method to iteratively remeasure the weight of each edge. Finally, we adopt multiple community detection algorithms to detect SPGs in the network. User accounts in the same SPG are considered to be controlled by the same individual or organization. In our experiments on real world datasets, our method shows better performance than other contemporary methods. Recently, there has been much excitement in the research community over using social networks to mitigate multiple identity, or Sybil, attacks. A number of schemes have been proposed, but they differ greatly in the algorithms they use and in the networks upon which they are evaluated. As a result, the research community lacks a clear understanding of how these schemes compare against each other, how well they would work on real-world social networks with different structural properties, or whether there exist other (potentially better) ways of Sybil defense. In this paper, we show that, despite their considerable differences, existing Sybil defense schemes work by detecting local communities (i.e., clusters of nodes more tightly knit than the rest of the graph) around a trusted node. Our finding has important implications for both existing and future designs of Sybil defense schemes. First, we show that there is an opportunity to leverage the substantial amount of prior work on general community detection algorithms in order to defend against Sybils. Second, our analysis reveals the fundamental limits of current social network-based Sybil defenses: We demonstrate that networks with well-defined community structure are inherently more vulnerable to Sybil attacks, and that, in such networks, Sybils can carefully target their links in order make their attacks more effective.  On virtual spaces, some individuals use multiple usernames or copycat forge other users (usually called ''sock puppet'') to communicate with others. Those sock puppets are fake identities through which members of Internet community praise or create the illusion of support for the product or one's work, pretending to be a different person. A fundamental problem is how to identify these sock puppets. In this paper, we propose a sock puppet detection algorithm which combines authorship-identification techniques and link analysis. Firstly, we propose an interesting social network model in which links between two IDs are built if they have similar attitudes to most topics that both of them participate in; then, the edges are pruned according a hypothesis test, which consider the impact of their writing styles; finally, the link-based community detection for pruned network is performed. Compared to traditional methods, our approach has three advantages: (1) it conforms to the practical meanings of sock puppet community; (2) it can be applied in online situation; (3) it increases the efficiency of link analysis. In the experimental work, we evaluate our method using real datasets and compared our approach with several previous methods; the results have proved above advantages. In this paper we discuss a piece of work which intends to provide some insights regarding the resolution of the hard problem of multiple identities detection. Based on hypothesis that each person is unique and identifiable whether in its writing style or social behavior, we propose a Framework relying on machine learning models and a deep analysis of social interactions, towards such detection. One common trick to cheat people to believe fake products or a high-return low-risk investment scheme in the online discussion groups is t0 make use of sock puppets (i.e., use different fake identities pretending to be different persons to praise or create the illusion of support for the product). A fundamental problem is how to identify these sock puppets. In this paper, we propose two approaches to identify these puppet pairs that occur in the same forum as well as cross forum. The evaluation based on millions of real posts in two popular discussion forums in Hong Kong shows that the methods are effective.