Characterizing, Detecting, and Predicting Online Ban Evasion

TL;DR

The paper addresses the challenge of ban evasion by presenting the first data‑driven study on how evaders operate, using Wikipedia sockpuppet data to build 8,551 parent–child ban evasion pairs. It analyzes behavioral and linguistic similarities between parent and child accounts, introduces the ban evasion lifecycle, and defines three predictive tasks (evasion prediction, early detection, and ban‑time detection/attribution) evaluated with logistic regression using diverse feature sets. The results show strong predictive and detection performance (e.g., AUCs up to 0.902 and MRR up to 0.969), and reveal actionable signals in edits, language, and username patterns that moderators can leverage. The work provides a practical framework and dataset that can extend to other platforms, offering tools to reduce moderator workload while maintaining fair handling of new evaders.

Abstract

Moderators and automated methods enforce bans on malicious users who engage in disruptive behavior. However, malicious users can easily create a new account to evade such bans. Previous research has focused on other forms of online deception, like the simultaneous operation of multiple accounts by the same entities (sockpuppetry), impersonation of other individuals, and studying the effects of de-platforming individuals and communities. Here we conduct the first data-driven study of ban evasion, i.e., the act of circumventing bans on an online platform, leading to temporally disjoint operation of accounts by the same user. We curate a novel dataset of 8,551 ban evasion pairs (parent, child) identified on Wikipedia and contrast their behavior with benign users and non-evading malicious users. We find that evasion child accounts demonstrate similarities with respect to their banned parent accounts on several behavioral axes - from similarity in usernames and edited pages to similarity in content added to the platform and its psycholinguistic attributes. We reveal key behavioral attributes of accounts that are likely to evade bans. Based on the insights from the analyses, we train logistic regression classifiers to detect and predict ban evasion at three different points in the ban evasion lifecycle. Results demonstrate the effectiveness of our methods in predicting future evaders (AUC = 0.78), early detection of ban evasion (AUC = 0.85), and matching child accounts with parent accounts (MRR = 0.97). Our work can aid moderators by reducing their workload and identifying evasion pairs faster and more efficiently than current manual and heuristic-based approaches. Dataset is available https://github.com/srijankr/ban_evasion.

Figures (3)

• Figure 1: The ban evasion lifecycle. Based on the key stages of ban evasion, we formulate three goals: (i) predict future ban evasion, (ii) detect ban evasion soon after creation of new accounts, and (iii) detection and matching at the time of banning of evasion child account.
• Figure 2: Ban Evasion Analysis. (a): Distribution of account duration of ban evasion parents versus non-evading malicious accounts. (b): Distribution of inter-account duration for ban evasion pairs versus matched pairs. (c): Correlation between inter-account duration and normalized Levenshtein distances between usernames. (d): Distribution of inter-account duration for ban evasion pairs. (e): Correlation between inter-account duration and title overlap.
• Figure 3: Performance on the detection, prediction, and attribution tasks. (A, B, C): The results demonstrate overall AUC after combining all the possible features, as well as using only specific type of features (temporal, edit, and language). (D, E): Attribution of detection evasion child account to the correct parent (MRR and Recall@5).