Source-linked AI summary
Online Human-Bot Interactions: Detection, Estimation, and Characterization
Onur Varol, Emilio Ferrara, Clayton A. Davis, Filippo Menczer, Alessandro Flammini
TL;DR
Social media can be exploited by automated or hybrid accounts, motivating reliable detection of bots and their interactions. The paper builds a Twitter framework from over a thousand behavioral and metadata features, benchmarks it on bot and manually annotated accounts, and estimates that 9%–15% of active English-speaking Twitter accounts are bots. It further characterizes interaction strategies and behavioral subclasses.
Problem
Social media enables automated or hybrid accounts to generate content and interactions, creating a need to identify bots and study their communication modes.
Method
The framework uses more than a thousand features from user metadata, friends, tweet content and sentiment, network patterns, and activity time series, evaluated with annotated Twitter datasets and multiple classifiers.
Results
9%–15% of active English-speaking Twitter accounts were estimated to be bots, while merged training data achieved 0.94 AUC for detecting simple and sophisticated bots.
Takeaways & Limitations
Bot behavior varies across interaction strategies and account subclasses, including spammers, self promoters, and connected-application accounts.
Takeaways & Limitations
Sophisticated bots may have been mislabeled as humans, and the scope of hybrid human-bot accounts remains unclear.
Abstract
from arXiv · showhide
Increasing evidence suggests that a growing amount of social media content is generated by autonomous entities known as social bots. In this work we present a framework to detect such entities on Twitter. We leverage more than a thousand features extracted from public data and meta-data about users: friends, tweet content and sentiment, network patterns, and activity time series. We benchmark the classification framework by using a publicly available dataset of Twitter bots. This training data is enriched by a manually annotated collection of active Twitter users that include both humans and bots of varying sophistication. Our models yield high accuracy and agreement with each other and can detect bots of different nature. Our estimates suggest that between 9% and 15% of active Twitter accounts are bots. Characterizing ties among accounts, we observe that simple bots tend to interact with bots that exhibit more human-like behaviors. Analysis of content flows reveals retweet and mention strategies adopted by bots to interact with different target groups. Using clustering analysis, we characterize several subclasses of accounts, including spammers, self promoters, and accounts that post content from connected applications.
Introduction
Social bots use software to generate content and interactions, creating both useful services and opportunities for manipulation. The paper introduces detection and characterization methods for identifying diverse bot behaviors and groups.
- Social media connections facilitate information dissemination, making online networks vulnerable to actors seeking to promote content or influence public opinion.
- Social bots are software-controlled accounts that algorithmically generate content and establish interactions.
- Bots can support news dissemination and volunteer coordination, but malicious applications include political manipulation, propaganda, market manipulation, and rumor diffusion.
- The framework extracts user, content, network, and activity features to train supervised models that assign users a bot-likelihood score.
- Interaction analysis links bot-likelihood to friend and follower selection and identifies distinct retweet and mention strategies toward humans and bots.
- Clustering identifies three bot groups: spammers, self promoters, and accounts posting content from connected applications.
Bot Detection Framework
The Twitter bot detection framework combines 1,150 features from account metadata, connected users, networks, temporal activity, language, sentiment, and tweet data. It benchmarks several classifiers and uses Random Forests for the reported best performance.
- The framework distills Twitter API data into 1,150 features organized into six classes.
- User-based features describe account metadata including friends, followers, tweet counts, profile descriptions, and settings.
- Connected-user features summarize retweeting, mentioning, being retweeted, and being mentioned, including language, local time, and popularity.
- Network features reconstruct retweet, mention, and hashtag co-occurrence networks to represent information-spreading structure.
- Temporal, content, language, and sentiment features capture activity rates, event intervals, tweet statistics, part-of-speech distributions, and emotional characteristics.
- 0.95 AUC was the best classification performance, obtained by Random Forests using 5-fold cross validation.
Large-Scale Evaluation
The evaluation combines older honeypot data with newer manually annotated accounts to test and update bot classifiers. Performance remains high, while newer and more sophisticated bots are harder to detect and some account types produce systematic errors.
- Cross-dataset evaluation: 86% overall classification accuracy was achieved on the manually annotated dataset, exceeding 90% for mostly human accounts and exceeding 70% for mostly bots.Accuracy in the challenging 0.4–0.8 score range fluctuated between 60% and 80%.
- Manual annotations: Human annotators agreed less on bot-like than human-like behavior, with average labeling times of 37 seconds for bots and 33 seconds for humans.Average pairwise annotation agreement was 75%, with Cohen’s κ = 0.41.
- Cross-dataset evaluation: 0.85 AUC was obtained when the honeypot model was tested on newer manually annotated accounts, versus 0.95 AUC in honeypot cross-validation.The lower cross-dataset performance reflects the absence of newer bots from the original training data.
- Updated training data: 0.94 AUC was achieved by the merged honeypot-and-annotation classifier, while annotation-only training yielded 0.89 AUC and mixture models ranged from 0.90 to 0.94 AUC.The merged dataset included a variety of more recent bots.
- Feature analysis: User meta-data and content features each yielded AUC above 0.9, while other feature classes yielded AUC above 0.8.The top 10 features were sufficient to reach performance of 0.9 AUC.
- Error analysis: Organizational, promotional, unusually active, multilingual, and connected-application accounts generated classification errors through misleading behavioral or language cues.The public system added a classifier that ignores language-dependent features to mitigate multilingual errors.
Estimation of Bot Population
The paper estimates Twitter bot prevalence by selecting accuracy-maximizing score thresholds and comparing models trained on datasets with different bot sophistication. Estimates range from 9% to 15%, and the authors caution that prevalence depends on bot definitions and sophistication.
- Threshold selection: The threshold separating humans from bots was selected by maximizing classification accuracy across varying bot-score thresholds.Accounts scoring below each candidate threshold were treated as human.
- Prevalence estimates: 9% to 15% of Twitter accounts were estimated to be bots, depending on the training model and dataset mixture.Annotated-only models yielded estimates up to 15%, honeypot-only models yielded 9%, and mixtures fell between these bounds.
- Interpretation: The authors state that bot-prevalence estimates depend strongly on how bots are defined and on their behavioral sophistication.Newer, more sophisticated bots are less represented in the older honeypot dataset.
- Scope limitations: Very sophisticated bots may have been mislabeled as humans, making even the 15% estimate potentially conservative.The authors also note that hybrid human-bot accounts remain difficult to label and quantify.
Characterization of User Interactions
The paper characterizes how accounts with different bot scores form social ties, exchange content, and cluster into behavioral groups. These analyses reveal homophily, distinct interaction strategies, and recognizable bot subclasses.
- Social connectivity: 46 billion social ties, including 7 billion among initially collected users, were analyzed to characterize connectivity.The study collected friend and follower relations through the Twitter API.
- Social connectivity: Human accounts mostly follow and are followed by humans, while bots tend to connect with other bots; simple bots can also attract human attention.This pattern produces a homophily effect, with benign bots accounting for some human attention.
- Social connectivity: Human accounts reciprocate more, whereas increasing bot scores correlate with lower reciprocity.Simple bots show bimodal reciprocity, including mostly low reciprocity and a smaller high-reciprocity mode possibly linked to coordinated botnets.
- Information flow: Simple bots retweet each other but frequently mention sophisticated bots, while sophisticated bots retweet without mentioning humans.Humans may retweet bots posting interesting content but generally do not mention bots directly.
- Clustering accounts: K-Means clustering of 100 important feature vectors identified 10 behavioral clusters, visualized with a two-dimensional t-SNE projection.Clusters were selected using criteria including silhouette scores and explained variance.
- Clustering accounts: Manual inspection identified bot groups comprising self-promoters, spammers, and accounts posting content through connected applications.Other clusters included sophisticated bots, cyborg-like accounts, and predominantly human users with differing activity styles.
Related Work
Related research studies social-bot detection, network structure, targeting, and collaborative evaluation. The paper builds on platform-scale analyses, supervised learning, sybil defenses, and efforts to improve public research resources.
- Motivation and scope: Social bots can pollute online discussion by lending false credibility to messages and influencing users, while botnets coordinate large-scale activities.Prior work describes variation in bot behavior, intent, and vulnerabilities across advertising, propaganda, and other applications.
- Platform-scale detection: Much previous bot-detection research assumes platform operators have full access to data for clustering behavior or classifying accounts.Examples include decomposing event data across time, users, and activities to identify similar behaviors.
- Network-based defenses: Network structure provides detection cues, but sophisticated sybils can build normal-looking ties or infiltrate targeted organizations.Prior systems such as SybilRank leverage social-graph topology, and surveys trace the evolution of sybil defenses.
- Learning-based detection: Earlier learning-based studies used human and bot accounts, including systems distinguishing humans, bots, and cyborgs and evaluations based on expert and crowdsourced annotations.These contributions motivate the paper’s supervised detection framework.
- Targeting and future strategies: Research has also examined why particular users become targets, pointing toward strategies that future social bots might develop.This perspective complements detection-focused work by studying bot appeal and targeting.
- Research infrastructure: DARPA challenges, publicly released detection systems, and expanding datasets have supported collaboration and the development of systems that adapt to newer bots.The cited efforts include an anti-vaccine campaign challenge and the authors’ publicly available system.
Conclusions
The paper presents a Twitter bot-detection framework that combines extensive user, content, network, and activity features with classification, estimation, and behavioral analysis. It reports strong detection performance across simple and sophisticated bots, estimates that 9%–15% of active English-speaking Twitter accounts are bots, and identifies distinct interaction patterns and behavioral subclasses.
- Detection framework: More than 1,000 features from user metadata, tweet content and sentiment, network patterns, and activity time series support Twitter bot classification.The framework was initially evaluated at 0.95 AUC using 5-fold cross-validation.
- Detection performance: 0.94 AUC was achieved after merging training datasets, enabling detection of both simple and sophisticated bots.Performance fell to 0.85 AUC when the initial classifier was tested on a more challenging bot sample before retraining.
- Population estimate: 9%–15% of active English-speaking Twitter accounts were estimated to be bots, with sensitivity depending strongly on the training data.The estimate was based on classifying nearly 14 million accounts with several models.
- Interaction patterns: Bots exhibit distinct retweet and mention strategies when interacting with humans or other bots, while friendship and follower selection correlate with bot likelihood.The analysis examined social connectivity and information flow between user groups.
- Behavioral subclasses: Clustering identified three main bot groups: spammers, self promoters, and accounts posting content from connected applications.The analysis also found diverse behaviors among both humans and bots, with some accounts exhibiting characteristics of both.