Source-linked AI summary
The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race
Stefano Cresci, Roberto Di Pietro, Marinella Petrocchi, Angelo Spognardi, Maurizio Tesconi
TL;DR
The paper addresses limited evidence about whether emerging social spambots can be detected reliably. It studies Twitter accounts using empirical evaluation, crowdsourcing, benchmarking, and dataset release, finding that Twitter, humans, and state-of-the-art applications do not accurately detect this new wave.
Problem
The study investigates the rise of social spambots and the limited evidence about detecting them on Twitter.
Method
The paper evaluates Twitter detection, human discrimination, and state-of-the-art detection techniques using datasets of genuine, traditional-spambot, and social-spambot accounts.
Results
Neither humans nor state-of-the-art spambot detection applications accurately detected accounts belonging to the new wave of social spambots.
Takeaways & Limitations
The findings call for new approaches and highlight collective-behavior analysis as an emerging direction for fighting social spambots.
Takeaways & Limitations
During the crowdsourcing campaign, 142 accounts, or 3.2%, were deleted, suspended, or protected and therefore excluded from the total considered.
Abstract
from arXiv · showhide
Recent studies in social media spam and automation provide anecdotal argumentation of the rise of a new generation of spambots, so-called social spambots. Here, for the first time, we extensively study this novel phenomenon on Twitter and we provide quantitative evidence that a paradigm-shift exists in spambot design. First, we measure current Twitter's capabilities of detecting the new social spambots. Later, we assess the human performance in discriminating between genuine accounts, social spambots, and traditional spambots. Then, we benchmark several state-of-the-art techniques proposed by the academic literature. Results show that neither Twitter, nor humans, nor cutting-edge applications are currently capable of accurately detecting the new social spambots. Our results call for new approaches capable of turning the tide in the fight against this raising phenomenon. We conclude by reviewing the latest literature on spambots detection and we highlight an emerging common research trend based on the analysis of collective behaviors. Insights derived from both our extensive experimental campaign and survey shed light on the most promising directions of research and lay the foundations for the arms race against the novel social spambots. Finally, to foster research on this novel phenomenon, we make publicly available to the scientific community all the datasets used in this study.
1. INTRODUCTION
Online social networks enable malicious accounts, whose evolving designs increasingly evade established detection methods. This paper documents a new wave of social spambots, evaluates detection capabilities, and identifies collective-behavior analysis as an emerging research direction.
- Online social networks provide an ideal setting for fictitious and malicious accounts that distribute spam, advertise dubious products, and bias public opinion.
- Spambots evolve by changing content, posting patterns, social relationships, and other behaviors to evade detection approaches.Researchers have responded with increasingly complex models, including interaction-graph analysis.
- A paradigm shift emerges toward using group-level account characteristics, rather than individual-account features, to identify anomalous behavior.The paper reviews these collective-behavior directions as promising dimensions for studying the new generation of spambots.
- The paper provides empirical evidence that a novel wave of Twitter social spambots exists and evaluates whether state-of-the-art techniques can detect them.
- The study uses crowdsourcing results to draw new annotation guidelines for datasets containing social spambots.
- The paper publicly releases an annotated dataset containing genuine accounts, traditional spambots, and social spambots.
2. DATASETS
The study combines genuine accounts with diverse traditional and social spambot datasets collected from real Twitter activity. Social spambots were manually identified through shared behaviors and similarities, capturing sophisticated political, promotional, and commercial campaigns.
- The study describes Twitter datasets by name, content, account and tweet counts, and average account-creation year.
- Genuine accounts were randomly sampled and verified through replies to natural-language questions, with 3,474 responding accounts certified as human-operated.
- Social spambots #1 came from an automated Twitter group discovered during Rome’s 2014 Mayoral election.The accounts used detailed fake profiles, credible follower networks, and apparently genuine daily tweeting while rapidly retweeting the candidate.
- Social spambots #3 promoted Amazon.com products through spam URLs while interleaving promotional tweets with harmless and genuine messages.
- Manual verification certified 50.05% of candidate retweeters, 94.50% of hashtag tweeters, and 89.29% of suspicious-URL tweeters as spambots.
- Internal annotation compared every account with all others to identify similarities and common behaviors, unlike one-account-at-a-time labeling.
- Traditional spambot datasets provide a strong baseline and include evolving bots, scam-URL bots, and bots promoting jobs or job offers.
- The dataset collection covers fake-follower fraud, retweet fraud, hashtag promotion, URL spamming, scamming, and generic-message spam.
3. REAL-WORLD EXPERIMENTATION
The experiments test Twitter’s detection of social spambots and humans’ ability to distinguish them from traditional spambots and genuine accounts. Social spambots closely resemble genuine accounts in survival and are difficult for human annotators to identify.
- 3.1 Twitter monitoring: Twitter’s monitoring experiment compares account survival and removal across genuine accounts, social spambots, traditional spambots, and fake followers.Accounts were observed over a long period, and Twitter API error codes distinguished suspended, deleted, and still-active accounts.
- 3.1 Twitter monitoring: 95.2%, 96.1%, and 99.6% were the survival rates of the three social-spambot groups.Their survival rates differed from genuine accounts by approximately ±3%, suggesting greater detection difficulty.
- 3.1 Twitter monitoring: Account type, design, and behavior—not account age—determined the observed differences in suspension outcomes.Traditional spambots #2 had a 99% suspension rate despite being younger than most social spambots.
- 3.2 Crowdsourcing: tasks and results: Human annotators achieved accuracy below 0.24 on social spambots, producing more than 1,000 false negatives.By contrast, their performance on traditional spambots and genuine accounts was described as satisfactory.
- 3.2 Crowdsourcing: tasks and results: Social-spambot classification yielded accuracy = 0.2355 and Fleiss’ κ = 0.186, while traditional-spambot accuracy was 0.91 and κ = 0.007.The results indicate that contributors often agreed when misclassifying social spambots, whereas traditional-spambot judgments were accurate but rarely agreed on the class.
- 3.2 Crowdsourcing: tasks and results: The study recommends group-level annotation using similarities and synchronized behaviors, rather than relying only on account-by-account inspection.The authors compared timelines of large account groups to identify tweeting similarities and released an annotated dataset containing genuine, traditional-spambot, and social-spambot accounts.
4. ESTABLISHED TECHNIQUES
This section evaluates whether established services and supervised or unsupervised techniques can detect social spambots, finding substantial difficulty for account-by-account methods and a successful modified clustering approach.
- RQ4 asks whether state-of-the-art scientific applications and techniques can detect social spambots.
- Established services: BotOrNot? applies supervised learning to more than 1,000 account features, trained on examples of human and bot behavior.It analyzes accounts individually and was specifically designed for social-spambot detection.
- Supervised classification: The supervised classifier failed to correctly classify novel social spambots, especially because recall errors labeled them as genuine accounts.
- Unsupervised detection: The study also tests unsupervised detection through Twitter stream clustering and graph clustering based on behavioral similarities among accounts.
- Unsupervised detection: MCC = 0.886 for test set #1 and MCC = 0.847 for test set #2 after replacing MCL with fastgreedy community detection.MCL assigned both test sets' accounts to a single cluster, while the modified implementation detected social spambots effectively.
5. EMERGING TRENDS
The paper reviews and experiments with emerging detection approaches that analyze groups of accounts rather than individuals, identifying collective behavior as a promising direction against social spambots.
- RQ5 asks whether new dimensions can be found to fight and overcome novel social spambots.
- Emerging trends: Established systems typically apply machine-learning algorithms to individual accounts, whereas emerging approaches examine characteristics of account groups.
- Tamper detection: Join-date and follower distributions are nearly uniform for genuine accounts but anomalous for social spambots, supporting group-based tamper detection.
- Digital DNA: Digital DNA compares behavioral sequences across accounts, and social spambots #1 and #3 show higher LCS similarity than genuine accounts.
- Collective behavior: Group-level analysis can expose automation traces through properties such as synchronicity and normality even when individual spambots are sophisticated.
- Emerging trends: The emerging techniques indicate a paradigm shift toward detection systems designed for greater resilience against future spambot evolution.
6. CONCLUDING REMARKS
The conclusion identifies social spambots as intrinsically harder to detect because they mimic genuine users, while experiments found that humans and existing automated systems commonly misclassified them.
- Spambot detection remains an open issue, and the emergence of social spambots makes the problem more difficult.
- Social spambots are harder to detect than earlier spambots because they accurately mimic genuine-user characteristics.
- Neither humans nor state-of-the-art detection applications accurately detected the new wave, with many labeling social spambots as genuine accounts.
- The paper highlights collective-behavior analysis as one promising research direction, examining groups rather than individuals.