투표 경쟁에서 사기꾼 사냥

투표 경쟁에서 사기꾼 사냥

---

현재 우리는 매우 잘 진행되는 대회를 운영하고 있습니다. 불행히도 우리는 그들의 항목에 자동으로 투표하는 스크립트를 실행하는 모든 사기꾼을 사업에 복귀 시켰습니다. 우리는 이미 데이터베이스 항목을 손으로보고 일부 사기꾼을 보았습니다. 예를 들어 정확히 70 분 동안 동일한 브라우저에서 별 5 개 등급을 받았습니다. 이제 사용자 기반이 성장함에 따라이를 식별하기가 점점 더 어려워집니다.

지금까지 우리가하는 일 :

1. IP와 브라우저를 저장하고 해당 조합을 1 시간 동안 차단합니다. 쿠키는이 사람들에게 도움이되지 않습니다.
2. 우리는 또한 깨진 Captcha를 사용하고 있습니다.

PHP 스크립트를 사용하여 데이터베이스에서 패턴을 찾는 방법이나 패턴을보다 효율적으로 차단할 수있는 방법을 아는 사람이 있습니까?

어떤 도움이라도 대단히 감사하겠습니다 ...

---

직접적인 피드백 제거

이것은 다른 많은 방법과 결합 할 수있는 일반적인 전략에 가깝습니다. 스패머에게 성공 여부를 알리지 마십시오.

현재 결과를 모두 숨기거나 절대 투표 수없이 백분율 만 표시하거나 투표 표시를 지연 할 수 있습니다.

• 장점 : 모든 방법에 적합
• 단점 : 사기가 큰 경우 백분율 표시 및 지연이 효과적이지 않습니다.

투표 신고

또한 일반적인 전략입니다. 스패머가 투표했다고 가정 할 이유가있는 경우 투표를 세고 유효하지 않은 것으로 표시하고 마지막에 유효하지 않은 투표를 삭제합니다.

• 장점 : 탐지 가능한 모든 스팸 공격에 적합
• 단점 : 투표를 왜곡하고 설정하기 어렵고 오 탐지

Captcha

CAPTCHA를 사용하십시오 . 보안 문자가 손상된 경우 더 나은 보안 문자를 사용하십시오.

• 장점 : 모든 자동화 된 스크립트에 적합합니다.
• 단점 : 인두 형성 에 대해 쓸모 없음

IP 확인

IP 주소가 일정 시간 동안 캐스트 할 수있는 투표 수를 제한합니다.

• 장점 : 브라우저에서 지속적으로 F5 키를 누르는 무작위 친구에게 적합합니다.
• 장점 : 간편한 구현
• 단점 : 프록시 서버를 사용하는 Pharyngulation 및 정교한 스크립트에는 쓸모가 없습니다.
• 단점 : IP 주소는 때때로 여러 다른 사용자에게 매핑됩니다.

리퍼러 확인

한 사용자가 하나의 IP 주소를 매핑한다고 가정하는 경우 해당 IP 주소로 투표하면 숫자를 제한 할 수 있습니다. 그러나이 가정은 일반적으로 개인 가정에만 적용됩니다.

• 장점 : 간편한 구현
• 장점 : 단순한 인두 형성에 어느 정도 좋습니다
• 단점 : 자동화 된 스크립트로 매우 쉽게 우회

이메일 확인

이메일 확인을 사용하고 이메일 당 하나의 투표 만 허용하십시오. 데이터베이스를 수동으로 확인하여 일회용 이메일을 사용하고 있는지 확인하십시오.

+foo이메일 주소에서 사용자 이름에 추가 할 수 있습니다 . username@example.com그리고 username+foo@example.com모두 그래서 누군가가 이미 투표 한 경우 검사 할 때 기억, 같은 계정으로 메일을 제공합니다.

• 장점 : 간단한 스팸 스크립트에 적합
• 단점 : 구현이 더 어렵다
• 단점 : 일부 사용자는 그것을 좋아하지 않을 것입니다

HTML 양식 무작위 화

선택 순서를 무작위로 지정하십시오. 확인하는 데 시간이 걸릴 수 있습니다.

• 장점 : 어쨌든 좋은
• 단점 : 일단 감지되면 우회하기가 매우 쉽습니다.

HTTPS

투표 위조의 한 가지 방법은 Firefox와 같은 유효한 브라우저에서 http 요청을 캡처하고 스크립트로 모방하는 것입니다. 이는 암호화를 사용할 때 쉽게 작동하지 않습니다.

• 장점 : 어쨌든 좋은
• 장점 : 매우 간단한 스크립트에 적합
• 단점 : 설정이 더 어렵다

프록시 확인

스패머가 프록시를 통해 투표하는 경우 X-Forwarded-For 헤더를 확인할 수 있습니다 .

• 장점 : 프록시를 사용하는 고급 스크립트에 적합
• 단점 : 일부 합법적 인 사용자가 영향을받을 수 있음

캐시 검사

클라이언트가 캐시되지 않은 모든 리소스를로드하는지 확인하십시오. 많은 스팸봇이이를 수행하지 않습니다. 나는 이것을 시도한 적이 없으며, 투표 사이트에서 일반적으로 확인되지 않는다는 것을 알고 있습니다.

예를 들면 <img src="a.gif" />a.gif가 1x1 픽셀 이미지 인 HTML에 포함하는 것 입니다. 그런 다음 요청에 대한 HTTP 헤더를 설정해야 GET /a.gif와 Cache-Control "no-cache, must-revalidate". 당신은 당신의 아파치의 HTTP 헤더를 설정할 수 있습니다 .htaccess와 같은 파일 이 . (Jacco에게 감사드립니다)

• 장점 : 내가 아는 한 드문 방법
• 단점 : 설정이 약간 더 어렵습니다.

[2010-09-22 수정]

Evercookie

• A so-called evercookie can be useful to track browser-based spammers

---

Have you tried to do browser fingerprinting? Check this open source from EFF: https://panopticlick.eff.org/ Could be used to identify one person similar to 500-1500 in the world (!).

---

You may add captcha to voting form. Also requiring e-mail confirmation will be useful

---

If you're really worried about it then you have to do something like email verification, which might be sufficient to block most cheaters.

Also it depends whether multiple people behind a NAT are likely to want to vote for the same option (e.g. favourite school).

Any scheme you create can be gamed.

EDIT: As everyone else has suggested, you can use a CAPTCHA such as reCAPTCHA to block automated bots, and make humans less likely to repeat vote. At the cost of making humans less likely to vote at all.

---

The Vote to Promote pattern (you may be aware of it) has a section on how to mitigate against gaming - but it is a tricky one to avoid altogether. Given your actions to date I would consider using weighting, for example consider a reasonable level of voting over a time period, say 10 votes per ting per hour (just an example not a guide) and for surplus votes weight the next 10 at 90% (ie only count 9), the next 10 at 80% and so on. This is Yahoo's advice on gaming within this pattern:

Community voting systems do present a number of challenges. Particularly the possibility that members of the community may try to game the system, out of any number of motivations:

• malice - perhaps against another member of the community and that member's contributions.

• gain - to realize some reward, monetary or otherwise, from influencing the placement of certain items in the pool)

• or an overarching agenda - always promoting certain viewpoints or political statements, with little regard for the actual quality of the content being voted for.

There are a number of ways to attempt to safeguard against this type of abuse. Though nothing can stop gaming altogether. Here are some ways to minimize or hinder abusers in their efforts:

• Vote for things, not people. In keeping with Yahoo's general strategy, don't offer users the ability to directly vote on another user: their looks, their likeability, intelligence, or anything else. It's OK for the community to vote on a person's contributions, but not on the quality of their character.

  • Consider rate-limiting of votes. o Only allow the user a certain number of votes within a given time-period. o Limit the number of times (or the rate at which) a user votes down a particular user's content. (To prevent ad-hominem attacks.)

  • Weigh other factors besides just the number of votes. Digg, for instance, does not calculate their Digg-score solely on the number of votes a submission receives. Their algorithm also considers: "story source (is it a blog repost, or the original story), user history, traffic levels of the category the story falls under, and user reports." They update this algorithm frequently. Consider keeping the exact algorithm a secret from the community, or only discuss the factored inputs in general terms.

• If relationship information is available consider weighting user votes accordingly. Perhaps prohibit users with formal relationships from voting for each other's submissions.

While this is currently a popular pattern on the Web, it is important to consider the contexts in which we use it. Very active and popular communities (Digg is an excellent example) that enable community-voting can also engender a certain negativity of spirit (mean comments, opinionated cliques, group attacks on 'outlier' viewpoints).

---

Check out Asirra: http://research.microsoft.com/en-us/um/redmond/projects/asirra/ It's still in beta, but it's pretty cool.

---

To prevent the bots from voting you can use CAPTCHA.

---

The only thing that comes to mind is using a Captcha. Either an elaborate one with pictures and noise like the ReCaptcha service, or a very simple and unobtrusive one like "What is seven plus three?" or (If you're located in the US), "What is the last name of our President", simple common sense questions everybody can answer. If you change them often enough, this could even be more effective than a classic image-based CAPTCHA.

---

CAPTCHA's aren't a silver bullet, the user could have their script display the CAPTCHA to them and solve them manually for at least several votes per minute.

You need to use them in combination with other techniques mentioned here.

---

You could add a honeypot field like in Django. Most likely, this will not protect you from cheaters who deliberately want to change your competition, but at least you will have lesser 'drive-by' spammers to additionally take care of.

---

Sorry for the double post, but I wasn't allowed to post two URLs in the same post...

If you're looking at building your own tracking, maybe this link might provide some inspiration: https://panopticlick.eff.org/ Turns out that a lot of browsers can be uniquely identified, even without any form of tracking cookies. I'm guessing a vote-bot might give a very specific fingerprint?

---

So if everyone ever wants to make a competition where people can win something and wanna use a community driven rating system... here i share some experiences:

The bad:
1) First it cant be made secure for 100%
2) to reach a mass of users which filters out all the nonsense ratings is very hard 3) Forget about star ratings in that case... their is always either 5 Stars or 1 Star

The good
1) Dont give them orientation about where they stand... We replaced the "Order by place" view with a random presentation of the TOP 100 (only the top 30 wll win a price)... This really helped because a lot of users lost their interest as soon as they didnt see where they stood.

2) Don't allow votings like: 1x5_Stars 40x1_Star... Just allow users which vote in a fair way...

3) Most of them act a little bit stupid... You'll see them in your logs and can trace down who votes fair and who unfair... Search for patterns...

**GOOD LUCK ;-) **

---

CAPTCHA is always good, might be "disturbing" for some users though.

reCAPTCHA is a fairly used service

---

How about only allow users who logged in with openid and with reCaptcha before submitting the vote, and monitering the submitter list with same ip address.

---

We use a combination of CAPTCHA and email. The user receive a link with a GUID by mail. This one must be unique for each user that try to vote. www.votesite.com/vote.aspx?guid=..... By using this link the vote is confirmed or not. In database we check the combination of email address and GUID to be unique.

---

I use a combination of CAPTCHA, IP verification and LSO (Flash Local Shared Objects, hard to find and delete for common people).

---

1.Use recaptcha
2. Yes randomize your voting options but not like this:
      -> from vote_id_1 to asdsasd_1, grdsgsdg_2,
      Instead use session variables to set a mask from vote_id_1 to asgjdas87th2ad in the vote form.

---

What about some post hoc stochastic analysis, like time series analysis - looking for periodicity in events of particular (ip, browser, vote)? You could then assign probability to each such group of events that it belongs to 1 person and either discard all such groups of events beyond some probability level, or use some kind of weighting to lower the weight according to the probability.

Look in R, it contains A LOT of useful analysis packages.

---

Check the domain details of the email they are using. I had the same problem and found that all of them were registered to the same registrant. I wrote it up here: http://tincan.co.uk/659/news/competition-spammers.html

Now, I filter on the DNS information for the email used in the registration.

참고URL : https://stackoverflow.com/questions/2333054/hunting-cheaters-in-a-voting-competition