Source-linked AI summary
DNA-inspired online behavioral modeling and its application to spambot detection
Stefano Cresci, Roberto Di Pietro, Marinella Petrocchi, Angelo Spognardi, Maurizio Tesconi
TL;DR
Existing online-behavior research uses heterogeneous representations, while evolving spambots can be difficult to distinguish from genuine accounts. The paper models actions as flexible digital DNA sequences, applies DNA-analysis techniques to Twitter spambot detection, and reports strong benchmark performance, including MCC = 0.952 for Test-set1 and MCC = 0.867 for Test-set2. The methodology is presented as applicable beyond this Twitter use case.
Problem
Online behavior lacks a unifying representation, and evolving spambots can closely resemble genuine accounts, making detection challenging.
Method
The paper encodes user actions as digital DNA sequences and applies sequence analysis, including alignment and LCS-curve methods, to compare account behavior.
Results
MCC = 0.952 for Test-set1 and MCC = 0.867 for Test-set2, with DNA fingerprinting outperforming the compared approaches.
Takeaways & Limitations
Digital DNA provides a compact, flexible behavioral representation that supports spambot detection and can be used in other behavioral-characterization contexts.
Abstract
from arXiv · showhide
We propose a strikingly novel, simple, and effective approach to model online user behavior: we extract and analyze digital DNA sequences from user online actions and we use Twitter as a benchmark to test our proposal. We obtain an incisive and compact DNA-inspired characterization of user actions. Then, we apply standard DNA analysis techniques to discriminate between genuine and spambot accounts on Twitter. An experimental campaign supports our proposal, showing its effectiveness and viability. To the best of our knowledge, we are the first ones to identify and adapt DNA-inspired techniques to online user behavioral modeling. While Twitter spambot detection is a specific use case on a specific social media, our proposed methodology is platform and technology agnostic, hence paving the way for diverse behavioral characterization tasks.
I. ONLINE INTERACTIONS: THE MIRROR OF THE SOUL
Online behavioral modeling can support public-interest analysis, prediction, and detection of fictitious or deceitful accounts. The paper proposes digital DNA sequences as a flexible, unifying representation that enables DNA-alignment analyses and behavioral taxonomies.
- Online behavioral analysis supports event mining, future prediction from past ground truth, and detection of deceptive accounts.These applications include identifying accounts that may distribute spam or bias public opinion.
- Existing approaches use social graphs, interaction graphs, textual content, and other complex representations, but a unifying approach remains open.
- Digital DNA sequences are introduced as a flexible model for characterizing online user behaviors across different scenarios.The authors also connect the approach to decades of bioinformatics research.
- Standard DNA sequence-alignment tools can reveal behavioral patterns across crowds without requiring account-by-account human inspection.
- Digital DNA can support behavioral taxonomies that classify social-media users into categories such as compulsive, curious, lazy, or inactive.Such classifications could inform targeted marketing campaigns and messaging.
A. Biological DNA
Biological DNA is a nucleotide sequence encoding genetic information, and bioinformatics analyzes these sequences for commonalities, repetitions, and relationships. Such analyses can also support predictions about individual characteristics.
- DNA sequences are strings of characters that encode the order of nucleotides in DNA molecules.The four nucleotide bases are adenine, cytosine, guanine, and thymine.
- Biological DNA stores information that directs the functions and characteristics of living organisms.
- Bioinformatics uses sequence alignment and motif elicitation to identify commonalities and repetitions.
- Common subsequences can help predict individual characteristics and uncover relationships between different individuals.
B. Digital DNA as a proxy of user online behavior
Digital DNA represents online actions as character strings, adapting the alphabet and granularity to the behavior being modeled. The paper applies this compact representation to uncover recurrent spambot patterns and distinguish bots from genuine accounts.
- Digital DNA encodes each online action type as a character in a sequence representing a user’s behavior.Examples include posting, following, and replying.
- The digital-DNA alphabet can be selected for the target behavior, making the representation flexible and compact.
- Facebook interactions can use C, L, S, and M for comments, likes, shares, and mentions, while e-commerce sequences can encode product categories.
- Unlike biological DNA, digital DNA allows both the number and meaning of bases to change with the behavior being modeled.
- Twitter account timelines can be represented as strings of up to 3,200 characters, enabling reuse of bioinformatics algorithms.
- Using known genuine and spambot datasets, the paper extracts recurrent patterns and demonstrates classification within an unknown account set.
III. INTRODUCING DIGITAL DNA FINGERPRINTING
Digital DNA fingerprinting adapts forensic-DNA intuition to detect social spambots by comparing behavioral sequences. The approach addresses evolving bots that can closely resemble genuine accounts in profiles and ordinary tweeting patterns.
- Digital DNA fingerprinting is proposed as a practical application of digital DNA for detecting spambots on social media.
- Existing systems struggle with evolving spambots because newer malicious accounts exhibit different and more advanced features.
- A Rome election campaign used almost 1,000 automated accounts that had detailed profiles, thousands of genuine connections, and apparently ordinary tweeting behavior.
- These accounts retweeted a candidate’s posts within minutes, helping expand reach and alter engagement metrics during the campaign.
- The proposed detection is unsupervised: it compares digital-DNA sequences to identify similarities among automated accounts relative to genuine accounts.
A. Mining groups of digital DNA sequences
Digital DNA fingerprinting represents behavior as ordered, variable-length symbol sequences and groups accounts by sequence similarity. This differs from traditional clustering of unordered, fixed-length numeric vectors, whose metrics do not directly apply.
- Digital DNA fingerprinting groups accounts by similarity between ordered action sequences.
- Unlike traditional clustering vectors, these sequences preserve the order of behavioral symbols.Traditional feature vectors are unordered, so their feature ordering is not exploited.
- Variable-length symbol strings require alternatives to standard numeric-vector distance and similarity metrics.
A. Characterizing spambot behavior
The paper evaluates digital DNA fingerprinting by extracting behavioral sequences from verified Twitter accounts and comparing their shared subsequences. Spambots exhibit substantially stronger sequence similarity than genuine accounts, especially when behavior is modeled by tweet type rather than content.
- The fingerprinting workflow comprises behavioral-data acquisition, DNA extraction, sequence comparison, and evaluation.
- The evaluation uses manually verified datasets containing 991 Bot1 accounts, 464 Bot2 accounts, and 3,474 genuine accounts.Spambots constituted 50.05% of Bot1 and 89.29% of Bot2 accounts.
- Two encodings represent each Twitter timeline: tweet type DNA and tweet content DNA.Tweet type DNA encodes simple tweets, replies, and retweets; content DNA encodes URLs, hashtags, mentions, media, combinations, and plain text.
- Similarity is quantified with the Longest Common Substring across groups of digital DNA sequences.A generalized suffix-tree algorithm finds the longest substring shared by at least k of m strings.
- Spambot groups retain long common substrings as group size grows, whereas genuine accounts rapidly approach minimal similarity.The spambot curves show a sudden drop near the group size, while the human curve decays exponentially.
- Tweet type DNA discriminates Bot2 spambots from genuine accounts more effectively than tweet content DNA.Content DNA produces much lower LCS values and fails to show a significant Bot2 difference that tweet type DNA models closely.
B. Uncovering novel Twitter spambots
The method detects Twitter spambots by finding groups of accounts with highly similar digital DNA, using LCS curves and their steep drops to identify suspicious group boundaries. It outperforms the compared approaches on both test sets while requiring only timeline data and no training phase.
- Detection methodology: LCS curves reveal homogeneous groups of highly similar accounts through plateaux and steep drops that mark boundaries between dissimilar groups.Multiple plateaux can indicate multiple subgroups, while more pronounced drops separate more different account groups.
- Detection methodology: The method uses negative peaks in the LCS-curve derivative as candidate splitting points, then selects suspiciously similar accounts sharing the longest LCS before each point.The selected groups contained 983 accounts in Test-set1 and 400 accounts in Test-set2.
- Test sets: 983 accounts with LCS around 400 were selected in Test-set1, while 400 accounts with LCS around 1750 were selected in Test-set2.These groups were treated as the suspiciously similar accounts immediately before the best splitting points.
- Evaluation: DNA fingerprinting achieved MCC = 0.952 for Test-set1 and MCC = 0.867 for Test-set2, outperforming the compared state-of-the-art approaches.The comparison included Yang et al.’s supervised method and Miller et al.’s and Ahmed et al.’s unsupervised methods.
- Evaluation: The approach may generalize better than feature-specific detection because it identifies suspicious similarities without focusing on particular behavioral characteristics.The paper contrasts this flexibility with an approach centered on retweets, hashtags, mentions, and URLs, which may be less reusable for different spambots.
- Practical properties: DNA fingerprinting uses only Twitter timeline data and does not require a training phase, unlike more data-demanding approaches based on graph mining.The supplied passage ends while describing the method’s deployment properties.
V. CONCLUSION
The paper introduces DNA-inspired modeling for online user behaviors and demonstrates it through Twitter spambot detection. Its experiments show that the proposal outperforms commonly used best-of-breed algorithms, while the methodology could support other contexts.
- Conclusion: The paper introduces a novel methodology for characterizing and studying online user behaviors in a DNA-inspired fashion.This framing lets analysts use tools developed for DNA analysis to examine online behaviors.
- Conclusion: An extensive Twitter experiment targeting spambot detection shows that the proposal outperforms commonly employed best-of-breed algorithms.Twitter is used as the benchmark for demonstrating the proposal’s viability.
- Conclusion: The methodology could be used in other contexts, providing a basis for further research.The conclusion presents this as a possibility beyond the demonstrated Twitter application.