Research talk:Sockpuppet detection in Wikimedia projects
Wikimania presentation and dewiki guidelines
FWIW, I gave an overview talk about Checkuser and sockpuppet detection at Wikimania years ago (as a volunteer who altogether served as Checkuser on dewiki for half a decade, until I retired after starting to work for WMF).
The slide deck (or its extended version from a later conference) may still be of some use. It presents the tools in some detail, including screenshots (which, considering the sadly slow technical progress in this area since then, should still be largely up to date), makes a case to think about sockpuppet probabilities using simple Bayesian statistics (which did not really catch on as far as I'm aware), and compiled several real-life cases where Wikipedians went to considerable length to develop non-Checkuser techniques for obtaining sockpuppet evidence.
(I would also be happy to answer questions about the German Wikipedia's guidelines on requests for Checkuser, in particularly how they came to be and how they differ from practices on e.g. enwiki. I authored much of the text back then, and they essentially haven't changed since. But presumably you have by now gotten hold of currently active Checkusers from dewiki, who should be the first stop for questions about the current practices.)
Some earlier research
By the same team: