Airdrop Sybil Attack Detection Framework Supported by Machine Learning (International Journal of Electronics and Telecommunication Systems)

Summary

• A single hunter accumulated 933,365 Arbitrum tokens valued at nearly $1 million in 2023.p.1
• The ZKsync team allocated 17.5% of the total ZKsync token supply for a retroactive airdrop program.p.2
• The proposed detection framework classified 76% of examined accounts on ZKsync as Sybils.p.1
• Out of 49,249 analyzed EOAs, 37,563 addresses exceeded the safe threshold to be marked as Sybils.p.8
• The framework detected 342 addresses that were included in the official ZKsync eligibility list but flagged as Sybils by the solution.p.1
• The 342 flagged eligible addresses received 1,571,708 ZK tokens, worth between $270,000 and $300,000 at the time.p.9

Key insights

1. Training a Graph Isomorphism Network exclusively on synthetic graph data caused severe overfitting and poor classification performance on real blockchain transaction networks.p.7
2. The best Graph Isomorphism Network configuration achieved an accuracy of 0.98252 and an F1 score of 0.98861 over 100 training epochs.p.6
3. Analysis of ZKsync blocks 1 to 29,710,000 identified 1,565 maximally connected components, 1,529 of which were labeled as Sybil topologies containing 29,889 addresses.p.7
4. In phase three of the framework, 24,651 of the 26,493 marked addresses recorded 0 gas usage, indicating they generated zero active transactions.p.8
5. A Sybil score threshold of 0.6 yielded an optimal F1 score of 0.9492 when separating legitimate addresses from Sybils.p.8
6. Among the 37,563 addresses classified as Sybils by the framework, 37,221 were not present in the official ZKsync eligibility list.p.9
7. Sybil hunters typically form funding transfer clusters that manifest as star, chain, or hybrid topological patterns.p.3