Details of the sybil risk report

When you submit a sybil risk query request of a single address, or click the "Details" link of a line in the sybil risk infomation list page of batch query, you will access the "Sybil Risk Report" page and get detailed sybil information there.

Based on the on-chain data, TrustScan uses AI algorithms to assess the sybil risk and produce detailed information of each wallet address, then presents the results from different levels and perspectives in a variety of forms such as "figures" + "charts" + "words".

The following is a detailed description of the contents of the sybil risk report.

1. Sybil risk score and level

Sybil risk score and level reveals the overall assessment results of sybil risk for wallet addresses.

In this section of the report, TrustScan provides three assessment results:

• Sybil Risk Score

• Sybil Risk Level

• Sub Score

(1) Sybil risk score

Sybil Risk Score is a comprehensive assessment of sybil risk of wallet addresses. Basing on the public historical data on the blockchain and using AI algorithm, TrustScan maps the sybil risk of a wallet address into a score, whose range is [0, 100]. The higher the score, the higher the sybil risk.

(2) Sybil risk level

Sybil Risk Level shows the sybil risk in a more intuitive way and is divided into three levels: "high", "medium" and "low". There is a definite correspondence between Sybil Risk Level and Sybil Risk Score.

The corresponding relationship between Sybil Risk Score and Sybil Risk Level, as well as sybil risk description of different risk levels are described as follows:

Sybil Risk Score	Sybil Risk Level	Sybil Attack Risk
[80, 100]	High	Sybil risk is high and there are some solid factual evidence.
[60, 80)	Medium	Sybil risk is medium. There are some evidence, but not solid.
[0, 60)	Low	Sybil risk is low and not find evidence related to sybil attack.

(3) Sub score

Sub Score is the result of sybil risk assessment of wallet address in multiple behavioral categories. Like Sybil Risk Score, each Sub Score is represented by a score, and the score range is [0, 100]. For each Sub Score, the higher the score, the higher the sybil risk associated with that behavior category.

TrustScan offers 5 Sub scores that represent sybil risk across 5 behavioral categories, including:

• Bulk Operation Risk. Indicates the extent to which the current wallet address and multiple other wallet addresses have bulk and highly similar behavior. The more such behaviors exist, the higher the score of Bulk Operation Risk, and the higher the sybil risk.

• Blacklist Risk. Whether the wallet address had confirmed sybil attack behaviors and be added into blacklist of certain projects. The more confirmed attacks, the higher the Blacklist Risk score, and the higher the sybil risk.

• Similar Behavior Risk. Whether the historical on-chain behavior sequence of the current wallet address is similar to the historical behavior sequence of other wallet addresses, and the degree of the similarity (e.g., the similarity degree of the behavior sequence and the number of wallet addresses with similar behavior sequence). The higher the degree of Similar Behavior sequence, the higher the score of Similar Behavior Risk, and the higher the sybil risk.

• Starlike Assets Network. On the network formed by the on-chain assets transfer behaviors of the current and other wallet addresses, whether there are star-like network structures which include current wallet address, and the extent to which star-like networks structures exist(e.g., network size and number of these networks). The more serious the existence of star-like assets network, the higher the score of Starlike Assets Network, and the higher the sybil risk.

• Chainlike Assets Network. On the network formed by the on-chain assets transfer behaviors of the current and other wallet addresses, whether there are chain-like network structures which include current wallet address, and the extent to which chain-like networks structures exist(e.g., network size and number of these networks). The more serious the existence of chain-like assets network, the higher the score of Chainlike Assets Network, and the higher the sybil risk.

2. Sybil risk facts

Sybil Rsik Facts are the main behavioral facts of current wallet address that may be related to sybil attacks. TrustScan uses text, charts, figures to summarize and display these behaviors and help you easily and intuitively understand them.

All of the behavior facts presented in the report come from the on-chain behavior of current wallet address. In addition, these behaviors are also closely related to the Sub Score in the report. TrustScan summarized 4 typical kind of behaviors as follows:

• Bulk Operation. Sybil attack behaviors in "Bulk Operation“ category.

• Starlike Assets Network. Sybil attack behaviors in “Starlike Assets Network“ category.

• Chainlike Assets Network. Sybil attack behaviors in “Chainlike Assets Network“ category.

• Similar Behavior Sequence. Sybil attack behaviors in “Similar Behavior Sequence“ category.

• Not all sybil attack behaviors are shown in the report. Some professional attackers may have a large number of sybil attack behaviors, but only the most representative cases are shown on the page.

• Not all wallet addresses have sybil attack behaviors. In fact, most normal wallet addresses don't have any sybil attack behaivors at all. Therefore, in the sybil risk report for many wallet addresses, the section of Sybil Risk Facts contains only a small amount of content or even a complete blank.

(1) Bulk operation

Sybil attack behaviors in "Bulk Operation“ category. Bulk operation means that this wallet address, along with some other wallet addresses, receives(sends) funds from(to) the same source(target) and interacts with a smart contract in bulk.

Bulk Operation presents three parts of content:

1) Key factors

Core factors corresponding to the current Bulk Operation behavior fact. Including:

• EOA count

• Time range

2) Graphical display of bulk opertion

Use graphics to display the detailed process of Bulk Opertion.

3) Description

A short text description of the current Bulk Operation fact.

(2) Starlike assets network

Sybil attack behaviors in “Starlike Assets Network“ category. Starlike assets network means that this wallet address, along with some other wallet addresses, receives funds from the same source and then sends the funds to the same target.

Starlike Assets Network presents three parts of content:

1) Key factors

Core factors corresponding to the current Starlike Assets Network behavior fact. Including:

• Cluster size

• Token

• Amount

• Time range

2) Graphical display of starlike assets network

Use graphics to display the detailed process of Starlike Assets Network.

3) Description

A short text description of the current Starlike Assets Network fact.

(3) Chainlike assets network

Sybil attack behaviors in “Chainlike Assets Network“ category. Chainlike assets network means that this wallet address, along with some other wallet addresses, transfers tokens in chain-like shape within a short time.

Starlike Assets Network presents three parts of content:

1) Key factors

Core factors corresponding to the current Chainlike Assets Network behavior fact. Including:

• Cluster Size

• Token

• Amount

• Time Range

2) Graphical display of chainlike assets network

Use graphics to display the detailed process of Chainlike Assets Network.

3) Description

A short text description of the current chainlike assets network fact.

(4) Similar behavior sequence

Sybil attack behaviors in “Similar Behavior Sequence“ category. Similar behavior sequence means that this wallet address has a high similarity with multiple other wallets in the behavior sequence.

Similar Behavior Sequence presents two parts of content:

1) Graphical display of similar behavior sequence

Use graphics to display the detailed process of Similar Behavior Sequence.

2) Description

A short text description of the current similar behavior sequence fact.