## 4 Data Analysis  
### Steps, Results, and Validation  
This section reviews the steps and results of this empirical study's experiments using the dataset by [PERSON] and [PERSON] [66], previously utilized by [PERSON] and [PERSON] [16]. First, data were cleansed and reformatted so they could be used to train different ML algorithms to detect Sybil nodes. The Twitter user dataset consists of followers and followees, i.e., it indicates what accounts each account follows. Figure 3 signifies part of the [PERSON] and [PERSON] [66] dataset, indicating that user ID 1 is following 4, 5, 7, etc., up to the end of the dataset. Figure 8 depicts user 5's connections 1, 4, 7, etc. A separate dataset segment consists of a two-row file containing Sybil and legitimate node IDs. This study carefully processed and restructured the dataset for input into its ML algorithms, accompanied by the matrix generation process using pseudocode, portrayed earlier in this article. This entailed crafting a comprehensive matrix where rows represented user IDs, followed by followers' IDs in  
Figure 7: Three different sample subsets (**A**–**C**) are generated from the main dataset bootstrapping to test against overfitting. subsequent columns, and the last column indicated user legitimacy (0 for non-Sybil, 1 for Sybil), derived from '269640_test.txt' dataset row 2 ([PERSON] and [PERSON] (2016)). This study generated a single matrix for training ML algorithms, followed by experiments to optimize accuracy. Due to the dataset's extensive size, a need arose for significant computational resources, e.g., supercomputers, but, lacking access to one, we split the data into seventy-one samples to generate corresponding smaller matrices for training and testing. Such an approach eased the computational demands, crucial due to the initial matrix's massive 117 GB size. Each of the seventy-one matrices was approximately 299.62 MB, totaling 20.77 GB. Despite such a size reduction, the original data remained intact and, as a result, were organized into independent matrices, thus enhancing manageability and computational feasibility. Next was the ML algorithm phase in this study, where ML algorithms were deployed, i.e., KNN, SVM, and random forest algorithms, and the respective training was conducted to differentiate Sybil nodes from legitimate nodes on the previously mentioned seventy-one matrices. In the next section, this study reports the distinct accuracy outcomes of each algorithm. While training, a challenge was encountered when training the SVM on four matrices once extensive training times elapsed, though KNN and random forest trained successfully. Hence, this study opted to analyze the algorithms' results on sixty-seven matrices omitting the four problematic ones. All ML algorithms utilized the aforementioned seventy-one matrices as the input for training. Segmented data blocks served for training and testing, yielding high accuracy. The algorithms produced a uniform output format, enabling direct comparison with their outputs represented by a \(2\times 2\) matrix (Figure 9). In Figure 9, a common \(2\times 2\) output matrix is observed from the ML models and can be interpreted as follows:  
Figure 8: User ID number 5 and the user ID numbers that it follows. Figure 9: Output from three ML algorithms on matrix number 47. \[ \begin{bmatrix}I_{00}&I_{01}\\ I_{10}&I_{11}\end{bmatrix} \]  
1. **Element I00:** True positives for non-Sybil instances, a value representing legitimate nodes correctly detected by the algorithm as such. 2. **Element I01:** False positives for Sybil instances, signifying nodes falsely labeled as Sybil by the algorithm. Ideally, this value is minimal or zero, preventing the mislabeling of legitimate nodes as Sybil. 3. **Element I10:** Sybil nodes undetected by the algorithm. The general aim is to keep this count to a minimum to ensure Sybil detection. 4. **Element I11:** Sybil instances' true positives, indicating correctly identified Sybil nodes.