Airdrop Sybil Attack detection framework supported by machine learning

Abstract

A skilled hunter may earn thousands of dollars in tokens from a single airdrop, making airdrop Sybil assaults a profitable endeavor. In this situation, Sybil assaults are not always wanted by projects and are often seen as improper behavior by honest individuals, which may negatively impact a project's image. It is thus to be anticipated that detection methods for Sybil assaults would be continuously enhanced. This study presents a multistep structure. Its concept is to sort blockchain addresses and give each one a score that indicates whether it belongs to the Sybil or regular class. Topologies were classified using a graph isomorphism network, whose parameters were adjusted using a dataset that the authors labeled. In subsequent phases, the account clustering operation was performed using a DBSCAN. Each stage in the framework may be given arbitrary weights by users, which will decide how essential a step is to them and provide a different score for a particular address. A grid search strategy and a threshold after which the address is deemed Sybil were used to find the optimal weights. This article examined a collection of EOAs from the ZK sync rollup. Ultimately, 76% of the examined accounts were classified as Sybils. Compared to the official ZK sync eligibility list, we found 342 addresses that received airdrop tokens but were marked as Sybil by our solution.