[PDF] Uncovering Coordinated Networks on Social Media: Methods and

View - Download Uncovering Coordinated Networks on Social Media: Methods and

Previous PDF

Next PDF

UncoveringCoordinatedNetw orkson SocialMedia:

Methods andCase Studies

Diogo Pacheco,

fl1,2Pik-Mai Hui,fl1Christopher Torres-Lugo,fl1

Bao TranTruong,

1AlessandroFlammini, 1Filippo Menczer1

1Observatoryon SocialMedia, IndianaUni versity Bloomington,USA

2Department ofComputer Science,Uni versity ofExeter,UK

d.pacheco@exeter.ac.uk, f huip,torresch,baotruon,aflammin,fil g @iu.edu

Abstract

Coordinated campaignsare usedto influenceand manipulate social mediaplatformsand theirusers, acritical challengeto the freee xchangeofinformationonline. Herewe introduce a general,unsupervised network-bas edmethodologytoun- covergroupsof accountsthat arelik elycoordinat ed.The pro- posed methodconstructs coordinationnetw orksbased onar- bitrary behavioraltracesshared amongaccounts. We present fivecasestudies ofinfluence campaigns, fourof whichin the diversecontexts ofU.S.elections, HongK ongprotests, the Syrian civilwar ,andcryptocurrencymanipulation.In each of thesecases, wedetect networks ofcoor dinatedTwitter accounts bye xaminingtheiridentities, images,hashtag se- quences, retweets,or temporalpatterns. Theproposed ap- proach provestobe broadlyapplicabletounco ver different kinds ofcoordination acrossinformation warf arescenarios.

Introduction

Online socialmedia hav erevolutionizedhow peopleaccess newsand information,and formopinions. Byenabling ex- changes thatare unhinderedby geographicalbarriers, and by loweringthecost ofinformation productionand con- sumption, socialmedia hav eenormouslybroadenedpartici- pation inci vilandpoliticaldiscourse. Althoughthis could potentially strengthendemocratic processes,there isin- creasing evidenceofmalicious actorspolluting theinforma- tion ecosystemwith disinformationand manipulationcam- paigns (Lazeret al.2018; Vosoughi, Roy ,andAral2018; Bessi andFerrara 2016;Shao etal. 2018;Ferrara 2017; Stella, Ferrara,and DeDomenico 2018;Deb etal. 2019;

BovetandMakse 2019;Grinber get al.2019).

While influencecampaigns, misinformation,and propa- gandaha vealwayse xisted(JowettandO"Donnell2018), social mediaha vecreatednewvulnerabilities andab useop- portunities. Justas easilyas like-minded userscan connect in supportof legitimate causes,socangroups withfringe, conspiratorial, ore xtremistbeliefsreachcritical massand become imperviousto expert ormoderatingviews. Platform

APIs andcommoditized fak eaccountsmakeitsimple to

Equal contributions.

Copyrightc

2021, Associationfor theAdv ancementof Artificial

Intelligence (www.aaai.org).Allrightsreserv ed.developsoftware toimpersonateusersand hidethe iden-tity ofthose whocontrol thesesocial bots- whetherthe y

are fraudsterspushing spam,political operativ esamplifying misleading narratives,ornation-statesw agingonline war - fare(Ferrara etal. 2016).Cogniti ve andsocial biasesmake us evenmorevulnerableto manipulationby social bots: limited attentionf acilitatesthespreadof unchecked claims, confirmation biasm akesusdisregard facts, group-think and echochambers distortperceptions ofnorms, andthe bandwagonef fectmakesus payattentiontobot-amplified memes (Wengetal. 2012;Hills 2019;Ciampaglia etal.

2018; Lazeret al.2018; Pennycook etal. 2019).

Despite advancesincountermeasures suchas machine

learning algorithmsand humanf act-checkers employedby social mediaplatforms todetect misinformationand inau- thentic accounts,malicious actorscontinue toef fectiv elyde- ceivethepublic, amplifymisinformation, anddri ve polar- ization (Barrett2019). We observeanarms raceinwhich the sophisticationof attackse volv estoevadedetection. Most machinelearning toolsto combatonline abuse tar- get thedetection ofsocial bots,and mainlyuse meth- ods thatfocus onindi vidualaccounts (Davisetal. 2016; Varolet al.2017; Yang etal. 2019;2020;Sayyadiharikandeh et al.2020). Howe ver,maliciousgroupsmayemploycoor- dinationtactics thatappear innocuousat theindi vidualle vel, and whosesuspicious behaviors canbedetectedonly when observing networksofinteractions amongaccounts. For in- stance, anaccount changingits handlemight benormal, but a groupof accountsswitching theirnames inrotation isun- likelyto becoincidental. Here wepropose anapproach tore veal coordinatedbe- haviorsamong multipleactor s,re gardlessoftheir auto- mated/organicnatureor malicious/benignintent. Theidea is toextract featuresfromsoci almediadata tob uildaco- ordination network,wheretw oaccounts havea strongtie if theydisplay unexpectedly similarbehaviors.These similar- ities canstem froman ymetadata, suchascontententities and profilefeatures. Networks provideanef ficientrepresen- tation forsparse similaritymatrices, anda naturalw ayto detect significantclusters ofcoordinated accounts.Our main contributionsare: 455
which canin principlebe appliedto any socialmedia plat- form wheredata isa vailable. Sincethemethodiscom- pletely unsupervised,no labeledtraining datais required.

Using Twitterdata,we present ve casestudies byin-

stantiating theapproach todetect different typesof co- ordination basedon (i)handle changes,(ii) imageshar - ing, (iii)sequential useof hashtags,(i v)co-retweets, an d (v) synchronization.

The casestudies illustratethe generalityand effecti veness of ourapproach: weare ableto detectcoordinated cam-

paigns basedon whatis presentedas identity, shown in pictures, writtenin text, retweeted,orwhenthese actions are taken.

Wesho wthatcoordinatedbeha viordoes notnecessaril yimply automation.In thecase studies,we detecteda mixof likelybotand humanaccounts working togetherin ma-licious campaigns.

Code anddata area vailable atgithub.com/IUNetSci/coordination-detectionto reproducethe presentresults and applyour methodologyto othercases.

Related Work

Inauthentic coordinationon socialmedia canoccur among social botsaswellas human-controlledaccounts. How- ever,mostresearchto datehas focusedon detectingsocial els requirelabeled datadescribing how bothhumans and bots behave.Researcherscreateddatasets usingautomated honeypotmethods (Lee,Eof f,and Caverlee2011), human annotation (Varoletal. 2017),or likely botnets(Eche verria, Besel, andZhou 2017;Eche verria andZhou2017).These datasets haveproven usefulintrainingsupervisedmod- els forbot detection(Da viset al.2016;Varol etal. 2017;

Yanget al.2019).

One downsideofsupervised detectionmethods isthat

by relyingon featuresfrom asingle accountor tweet, theyare notas effecti ve atdetectingcoordinatedaccounts. This limitationhas beene xploredin thecontextof detect- ing coordinatedsocial bots(Chen andSubramanian 2018; Cresci etal. 2017;Grimme, Assenmacher, andAdam 2018). The detectionof coordinatedaccounts requiresa shiftto- wardthe unsupervisedlearning paradigm.Initial applica- tions focusedon clusteringor communitydetection algo- rithms inan attemptto identifysimilar featuresamong pairs ofaccounts (Ahmedand Abulaish 2013;Miller etal.

2014). Recentapplications lookat speciccoordination di-

mensions, suchas contentor time(Al-khateeb andAg ar- wal2019). Amethod namedDigital DNAproposed toen- code thetweet typeor contentas as tring,which was then used toidentify thelongest commonsubstring betweenac- counts (Cresciet al.2016). SynchroTrap(Cao etal. 2014) andDebot(Chavoshi,Hamooni,and Mueen2016) lev er- age temporalinformation toidentify clustersof accounts that tweetin synchrony .Content-basedmethodsproposed by Chenand Subramanian(2018) andGiglietto etal. (2020) consider co-sharingof linkson Twitter andF acebook,re-

spectively.Timestampand contentsimilaritywereboth usedto identifycoordinated accountsduring the2012 electionin

South Korea(Keller etal.2017;2019).

While theseapproaches canw orkwell, eachisdesigned to consideronly oneof theman ypossible coordinationdi- mensions. Furthermore,the yarefocusedon coordination features thatare likely observedamongautomated accounts; inauthentic coordinationamong human-controlledaccounts is alsoan importantchallenge. Theunsupervised approach proposed hereis moregeneral inallo wingmultiple similar- ity criteriathatcan detecthuman coordinationin additionto bots. Aswe willsho w, severaloftheaforementioned unsu- pervised methodscan beconsidered asspecial casesof the methodology proposedhere.

Methods

The proposedapproach todetect accountsacting incoor - dination onsocial mediais illustratedin Fig.1. Itcan be described byfour phases:

1.Behavioraltrace extraction:The startingpoint ofcoor -

behavior.Assumingthat authenticusers aresome whati n- dependent ofeach other, weconsiderasurprising lack of independenceas evidence ofcoordination.The imple- mentation ofthe approachis guidedby achoice oftraces that capturesuch suspiciousbeha vior. Forexample,ifwe conjecture thataccounts arecontrolled byan entitywith the goalof amplifyingthe exposure ofa disinformation source, wecould extract sharedURLsastraces. Coordi- nation scenariosmay beassociated witha few broadcat- egoriesof suspicioustraces: (a) Content:if thecoordination isbased onthe content being shared,suspicious tracesmay includew ords,n- grams, hashtags,media, links,user mentions,etc. (b) Activity:coordinationcould bere vealed byspati o- temporal patternsof activity. Examplesof tracesthat can revealsuspiciousbehaviors aretimestamps, places, and geo-coordinates. (c) Identity:accounts couldcoordinate onthe basisof per- sonas orgroups. Traces ofidentitydescriptors could be usedto detectthese kindsof coordination: name, handle, description,prole picture,homepage, account creation date,etc. (d) Combination:the detectionof coordinationmight re- quire acombinationof multipledimensions. For in- stance, insteadof tracingonly whichhashtags were used orwhen accountswere activ e,as wouldbethe case fora content-or activity-based suspicioustrace, one canc ombineboththesetracestoha ve atemporal- content detectionapproach. Thecombined version is more restrictiveand,therefore,can reducethe number of falsepositiv es. Once tracesof interestare identied,we canb uilda net- workof accountsbased onsimilar behavioral traces.Pre- liminary datacleaning maybe applied,ltering nodes with lackof support— lowacti vityorfewinteractions with thechosen traces— becauseof insufcient evidence to establishtheir coordination.F ore xample,anaccount456

Figure 1:A chartof ourproposed coordinationdetection approach.On theleft wesee behavioral tracesthat canbe extracted

from socialmedia prolesand messages.F oursteps describedin thetextlead toidentication ofsuspicious clustersof accounts.

sharing fewimageswill notal low areliabl ecalculationof image-based similarity. a bipartitenetw orkconnectingaccountsand featurese x- tracted fromtheir prolesand messages.In thisphase, we mayuse thebeha vioraltraces asfeatures,orengi- neer newfeatures derivedfromthe traces.F ore xample, content analysismay yieldfeatures basedon sentiment, stance, andnarrati veframes.Temporalfeatures suchas hour-of-dayand day -of-weekcouldbeextrapolatedfrom timestamp metadata.Features couldbe engineeredby ag- gregatingtraces,for example byconating locationsinto countries orimages intocolor proles.More comple x features couldbe engineeredby consideringsets orse- quences oftraces. Thebipartite networkmay beweighted based onthe strengthof associationbetween anaccount and afeature —sharing thesame imageman ytimes isa stronger signalthan sharingit justonce. Weights mayin- corporate normalizationsuch asIDF toaccount forpopu- lar features;it isnot suspiciousif many accountsmention the samecelebrity .

3.Projectiononto accountnetw ork:The bipartitenetw ork

is projectedonto anetw orkwhere theaccountnodesare preserved,and edgesare addedbetween nodesbased on some similaritymeasure ov erthefeatures.Theweightof an edgein theresulting undirectedcoordinationnetwork may becomputed viasimple co-occurrence,Jaccard co- efcient,cosine similarity, ormoresophisticatedstatis- tical metricssuch asmutual informationor 2. Insome cases, everyedgeinthe coordinationnetw orkis suspi- cious byconstruction. Inother cases,edges maypro vide noisy signalsabout coordinationamong accounts,lead- ing tof alsepositives. Forexample,accountssharing sev- eral ofthe samememes arenot necessarilysuspicious if those memesare very popular.Inthese cases,manualcu- ration maybe neededto filter outlow-weightedges inthe

coordination networktofocus onthe mostsuspicious in-teractions. Onew aytodothis isto preserve edgeswith atop percentileof weights.The Discussionsection presentsedge weightdistributionsis somecasestudies,illustrating howaggressi velteringallowsone toprioritize precisionoverrecall,thus minimizingf alsepositi ves.

4.Cluster analysis:The nalstep isto find groupsof ac-

counts whoseactions arelik elycoordinated ontheac- count network.Network communitydetectionalgorithms that canbe usedfor thispurpose includeconnected com- ponents,k-core,k-cliques, modularitymaximization, and label propagation,amongothers (Fortunato 2010).In the case studiespresented herewe useconnected components because weonly considersuspicious edges(by designor by ltering).

In summary,thefour phasesof theproposed approach

to detectcoordination aretranslated intoeight actionable steps: (i)formulate aconjecture forsuspicious behavior; (ii) choosetraces ofsuch behavior ,or (iii)engineerfea- tures ifnecessary; (iv) pre-lterthedatasetbased onsup- port; choose(v) aweight forthe bipartitenetw orkand (vi) asimilarity measureas weightfor theaccount coordina- tion network;(vii)lter outlo w-weightedges; andnally , (viii) extractthecoordinated groups.Although theproposed method isunsupervised andtherefore doesnot requiredla- beled trainingdata, werecommend amanual inspectionof the suspiciousclusters andtheir content.Such analysiswill providev alidationofthemethod ande videnceof whether the coordinatedgroups aremalicious and/orautomated. In thefollo wingsectionswepresent v ecase studies, in whichwe implementthe proposedapproach todetect coordination throughshared identities,images, hashtagse- quences, co-retweets,and activity patterns.

Case Study1: AccountHandle Sharing

On Twitterandsome othersocial mediaplatforms, although each useraccount hasan immutableID, many relation- on Twitter)thatis changeableand ingeneral reusable.An exceptionis thathandles ofsuspended accountsare not reusable onT witter.Usersmayhav ele gitimatereasons for changing handles.Ho wever,thepossibilityofchangingand reusing handlese xposesuserstoab usesuch asusername squatting cent example,multipleT witterhandles associatedwithdif- ferent personaswere usedby thesame Twitter accountto spread thename ofthe Ukrainewhistleblo werin theUS presidential impeachmentcase. 2 Fora concretee xampleof howhandlechanges canbe ex- ploited, considerthe following chronologicalevents:

1.user1(named@supercat) followsuser2(named

@kittie ) whoposts picturesof felines.

2.user3(named@superdog) postpictures ofcanines.

3.user1tweets mentioninguser2: "Ilo ve@kittie".

A mentionon Twitter createsalinkto thementioned ac- count prole.Therefore, attime step3, user1'stweet is linkedtouser2'sprole page.

4.user2renames itshandle to@tiger.

5.user3renames itshandle to@kittie, reusing

user2'shandle. Eventhough user1'ssocial network isunalteredreg ard- less ofthe namechange ( user1still followsuser2), name changesare notreected inpre viousposts, soan y- one whoclicks onthe linkat step3 willbe redirectedto user3'sprole insteadof touser2as originallyin- tended byuser1. Thistype ofuser squatting,in coordi- nation withmultiple accounts,can beused topromote en- tities, run“follo w-back"campaigns,inltratecommunities, or evenpromotepolarization(Mariconti etal. 2017).Since manipulations canbe usedto promotecontent beyond social media boundaries. Todetect thiskind ofcoordination onT witter, weapplie d our approachusing identitytraces, namelyT witterhandles. Westarted froma logof requeststo Botometer.or g,a so- cial botdetection serviceof theIndiana Univ ersityObser - vatoryon Social Media(Yanget al. 2019).Eachlogrecord consists ofa timestamp,the Twitter useridand handle, and thebot score.W efocus onuserswithat leastten en- tries (queries)such thatmultiple handlechanges couldbe observed.This yielded54 millionrecords with1.9 million handles. Forfurtherdetails seeT able1.

Coordination Detection

Wecreate abipartite network ofsuspicious handlesandac- counts. Weconsidera handlesuspicious ifit isshared by at leasttw oaccounts,andan accountsuspicious whenit has takenatleast onesuspicious handle.Therefore noedges are ltered.One couldbe morerestricti ve, fore xampleby considering anaccount suspiciousif ithas taken morethan 1 squatting names-ukraine-whistle-blower-in-a-retweet-he-later-deletedConjectureIdentities shouldnot beshared

Support filterAccounts with<10records

TraceScreen name

Eng. traceNo

Bipartite weightNA,the bipartiteis unweighted

Proj. weightCo-occurrence

Edge filterNo

ClusteringConnected components

Data sourceBotometer (Yangetal. 2019)

Data periodFeb 2017-Apr2019

No. accounts1,545,892

Table1: Casestudy 1summary

one suspicioushandle. To detectthesuspiciousclusters we project thenetw ork,connectingaccountsbased onthe num- ber oftimes they sharedaha ndl e.This isequivalenttousing co-occurrence, thesimples tsimilaritymeasure.Each con- nected componentin theresulting network identifiesa clus- ter ofcoordinated accountsas wellas theset ofhandles they shared. Table1summarizes themethod decisions.

Analysis

Fig. 2sho wsthehandlesharing network. Itis aweighted, undirected networkwith7,879 nodes(T witteraccounts). We can classifythe componentsinto threeclasses:

1.Star-likecomponentscapture themajor accounts(hub

nodes) practicingname squattingand/or hijacking.T o conrm this,we analyzedthe temporalsequence ofhan- dle switchesin volvingstar-likecomponents. Typically,a handle switchesfrom anaccount (presumablythe victim) to thehub, andlater (presumablyafter someform ofran- som ispaid) itswi tchesback fromthehubto theorigi - nal account.These kindsof reciprocalswitches occur12 times moreoften instars thanan yother components.

2.The giantcomponent includes 722accounts sharing181

names (orangegroup inthe centerof Fig.2). Usingthe Louvaincommunity detectionalgorithm (Blondelet al.

2008), wefurther divide thegiantcomponentinto 13s ub-

quotesdbs_dbs14.pdfusesText_20

[PDF] tef - livre d'entraînement pdf

[PDF] tef 250 activites pdf

[PDF] tef entrainement gratuit

[PDF] tef livre d entraînement download

[PDF] tef test d'evaluation de francais 250 activités (livre + audio)

[PDF] tele inscription lycee jules fil carcassonne

[PDF] télé jaugeage des cuves

[PDF] tele maroc nini

[PDF] télé série l échappée

[PDF] telechargement gratuit des documents scientifiques

[PDF] telechargement gratuit les livres de yasmina khadra en pdf

[PDF] telechargement wikipedia 2017 hors connexion

[PDF] telecharger 2015 kabyle mp3

[PDF] telecharger accuse de reception aadl 2013

[PDF] télécharger application météo gratuite