  In this paper, we describe a new algorithm called Preferential Attachment
k-class Classifier (PreAttacK) for detecting fake accounts in a social network.
Recently, several algorithms have obtained high accuracy on this problem.
However, they have done so by relying on information about fake accounts'
friendships or the content they share with others--the very things we seek to
prevent. PreAttacK represents a significant departure from these approaches. We
provide some of the first detailed distributional analyses of how new fake (and
real) accounts first attempt to request friends after joining a major network
(Facebook). We show that even before a new account has made friends or shared
content, these initial friend request behaviors evoke a natural multi-class
extension of the canonical Preferential Attachment model of social network
growth. We use this model to derive a new algorithm, PreAttacK. We prove that
in relevant problem instances, PreAttacK near-optimally approximates the
posterior probability that a new account is fake under this multi-class
Preferential Attachment model of new accounts' (not-yet-answered) friend
requests. These are the first provable guarantees for fake account detection
that apply to new users, and that do not require strong homophily assumptions.
This principled approach also makes PreAttacK the only algorithm with provable
guarantees that obtains state-of-the-art performance on new users on the global
Facebook network, where it converges to AUC=0.9 after new users send + receive
a total of just 20 not-yet-answered friend requests. For comparison,
state-of-the-art benchmarks do not obtain this AUC even after observing
additional data on new users' first 100 friend requests. Thus, unlike
mainstream algorithms, PreAttacK converges before the median new fake account
has made a single friendship (accepted friend request) with a human.
