Airdrop Sybil Attack detection framework supported by machine learning

Airdrop Sybil attacks can be a lucrative labour, and tokens received from one airdrop by an effective hunter can reach thousands of dollars. Sybil attacks in this context are not always desired by projects and are often seen by honest players as inappropriate behaviour, which can reflect badly on a project’s reputation. For such a reason, it is well expected that Sybil attacks detection systems will be constantly improved. In this work, a multistep framework is presented. Its idea is to sort blockchain addresses and assign them a score that will indicate if a given address is closer to a normal or a Sybil class. A graph isomorphism network was used to classify topologies, and its parameters were tuned on a dataset labelled by the authors. In other steps, a DBSCAN was used for the account clustering task. Users of the framework can assign arbitrary weights to each step, which will determine how important a step is to them and result in a different score for a given address. The best weights were found with a grid search method as well as a threshold after which the address is considered Sybil. In this paper a set of EOAs from ZKsync rollup was analyzed. In the end, 76% of all the accounts analyzed were marked as Sybils. Compared to the official ZKsync eligibility list, we found 342 addresses that received airdrop tokens but were marked as Sybil by our solution.