Source-linked AI summary
An Army of Me: Sockpuppets in Online Discussion Communities
Srijan Kumar, Justin Cheng, Jure Leskovec, V. S. Subrahmanian
TL;DR
The paper addresses how sockpuppetry operates in online discussion communities and how it can be detected. It identifies and characterizes sockpuppets across nine communities, finding distinctive linguistic, behavioral, interactional, and network patterns, and applies these findings to prediction tasks. The resulting models distinguish sockpuppet pairs from ordinary-user pairs and identify individual sockpuppet accounts, while revealing differences in deceptiveness and supportiveness.
Problem
Sockpuppets can deceive users and manipulate discussions, but prior research provides limited behavioral and interactional evidence for identifying them across communities.
Method
The study uses IP addresses, session data, linguistic features, posting behavior, and reply-network structure to identify and analyze sockpuppets across nine communities.
Results
Prediction models achieve ROC AUC=0.90 for distinguishing sockpuppet pairs from ordinary-user pairs and ROC AUC=0.68 for identifying individual sockpuppet accounts.
Takeaways & Limitations
Sockpuppetry includes differing deceptive and supportive roles, and interactions between accounts and with the community are especially informative for automatic identification.
Takeaways & Limitations
The heuristics cannot identify throwaway sockpuppet accounts used only once, and the study focuses mainly on pseudonymous forums and pairs of sockpuppets.
Abstract
from arXiv · showhide
In online discussion communities, users can interact and share information and opinions on a wide variety of topics. However, some users may create multiple identities, or sockpuppets, and engage in undesired behavior by deceiving others or manipulating discussions. In this work, we study sockpuppetry across nine discussion communities, and show that sockpuppets differ from ordinary users in terms of their posting behavior, linguistic traits, as well as social network structure. Sockpuppets tend to start fewer discussions, write shorter posts, use more personal pronouns such as "I", and have more clustered ego-networks. Further, pairs of sockpuppets controlled by the same individual are more likely to interact on the same discussion at the same time than pairs of ordinary users. Our analysis suggests a taxonomy of deceptive behavior in discussion communities. Pairs of sockpuppets can vary in their deceptiveness, i.e., whether they pretend to be different users, or their supportiveness, i.e., if they support arguments of other sockpuppets controlled by the same user. We apply these findings to a series of prediction tasks, notably, to identify whether a pair of accounts belongs to the same underlying user or not. Altogether, this work presents a data-driven view of deception in online discussion communities and paves the way towards the automatic detection of sockpuppets.
1. INTRODUCTION
This study identifies and characterizes sockpuppetry across nine online discussion communities, showing differences in language, posting behavior, interaction patterns, and network structure. It further distinguishes deceptive and supportive roles and demonstrates automated prediction of sockpuppet accounts and pairs.
- Sockpuppetry can deceive users and manipulate public opinion or online content, motivating systematic detection in discussion communities.
- Using behavioral traces such as IP addresses and session data, the study identifies 3,656 sockpuppets in 1,623 groups across nine communities.
- Sockpuppets use more first-person pronouns, fewer negations and some parts of speech, start fewer discussions, and receive more downvotes, reports, and deletions.
- Pairs of sockpuppets interact more often in the same discussions and at the same time, have higher network centrality and clustering, and write more similarly than ordinary users.
- Sockpuppets vary in deceptiveness: pretenders post together and receive more negative moderation, whereas non-pretenders post separately and write longer, more readable posts.
- Supportive sockpuppet pairs occur 30% of the time and dissenting pairs 10%; supporters tend to be pretenders, linking deception to attempts to create public consensus.
- Prediction models distinguish sockpuppet pairs from ordinary-user pairs with ROC AUC=0.90 and individual sockpuppet accounts with ROC AUC=0.68.
2. DATA AND DEFINITIONS
This section defines sockpuppets and describes the data and multi-signal procedure used to identify them across nine online discussion communities. The method identifies accounts sharing IP addresses, discussions, and close posting times, then forms sockpuppet groups from linked accounts.
- Definitions: A sockpuppet is an account controlled by an individual who controls at least one other account; those accounts form a sockpuppet group.
- Data: The study analyzes nine online discussion communities containing 2,897,847 users, 2,129,355 discussions, and 62,744,175 posts.
- Identification: Sockpuppets are identified using shared IP addresses, posting times, and discussions rather than explicit labels.
- Identification: The procedure removes the most-used 5% of IP addresses and accounts with the most IP addresses to reduce spurious detections.
- Identification: Accounts qualify when they post from the same IP address in the same discussion within 15 minutes across at least three discussions.
- Identified groups: The procedure identifies 1,623 sockpuppet groups comprising 3,656 sockpuppets, and analyses focus mainly on pairs because most groups contain two accounts.
3. CHARACTERIZING SOCKPUPPETRY
Across nine discussion communities, sockpuppets exhibit distinctive linguistic, posting, interaction, and network patterns. Accounts controlled by the same puppetmaster often operate together, while their deceptiveness and supportiveness vary.
- Sockpuppets tend to be created early, with the second account beginning after a median of 18% of the first account’s posts.
- 3.1 Do puppetmasters lead double lives?: Sockpuppets resemble one another linguistically more than either resembles an ordinary user (p < 0.001), weakening the double life hypothesis.Similarity differences also hold for readability, word length, function words, personal pronouns, and assent words.
- 3.2 Linguistic Traits of Sockpuppets: Sockpuppets use more first-person pronouns and shorter sentences than ordinary users, while syllables per word remain similar.“I” occurs at 0.076 versus 0.074, and sentence length averages 12.4 versus 12.9 words.
- 3.3 Activity and Interactions: Sockpuppets start fewer discussions and concentrate more posts in existing discussions, with 65% of posts as replies versus 51% for ordinary users.The findings indicate that sockpuppets are mainly used to reply to other users and participate especially in controversial topics.
- 3.3 Activity and Interactions: Sockpuppets receive harsher community responses and have more tightly knit ego-networks, including greater downvotes, reports, deletions, and clustering.Their average clustering coefficient is 0.52 versus 0.49 for ordinary users; secondary accounts also tend to be used alongside primary accounts.
- 3.3 Activity and Interactions: Sockpuppet pairs interact more closely than ordinary-user pairs, posting in the same sub-discussions 6.57 versus 0.33 times and within 15 minutes 7.8 versus 4.28 times.They also vote on each other’s posts more often, 9.35 versus 0.40 votes, with largely positive votes.
4. TYPES OF SOCKPUPPETRY
The paper distinguishes sockpuppet pairs by deceptiveness and supportiveness. Pretenders use substantially different display names and often share discussions, while pairs may support, oppose, or remain neutral toward one another.
- Deceptiveness: Sockpuppet pairs divide into pretenders, who masquerade as separate users, and non-pretenders, who use accounts without masquerading.The distinction is based on display-name distance: Levenshtein distance ≥5 indicates pretenders, while distance <5 indicates non-pretenders.
- Deceptiveness: 947 pretender groups and 403 non-pretender groups were identified across all communities.
- Deceptiveness: Pretenders participate in more common discussions and have more dissimilar display names than non-pretenders.The likelihood of participating in the same discussion increases as display names become more different.
- Deceptiveness: Pretenders’ posts are reported more often, deleted more often, and receive fewer up-votes than non-pretenders.Reported posts: 0.06 versus 0.03; deleted posts: 0.11 versus 0.08; up-votes: 0.45 versus 0.53.
- Supportiveness: Sockpuppet pairs are classified as non-supporters, supporters, or dissenters according to whether one account agrees with or attacks the other.Across communities, 60% are non-supporters, 30% supporters, and 10% dissenters.
- Supportiveness: Supporters are more likely to be pretenders than dissenters, with 74% of supporters versus 58% of dissenters classified as pretenders.
5. DETECTING SOCKPUPPETS
The paper uses activity, community, and post features to detect sockpuppets. Detection is easier for sockpuppet pairs than for individual accounts, and activity and interaction features are especially predictive.
- Features: The detection framework uses activity, community, and post features to distinguish sockpuppets from ordinary users and identify sockpuppet pairs.
- Individual accounts: Individual-account detection achieved AUC=0.68, while activity features alone achieved AUC=0.59.
- Individual accounts: Activity and post features approached the final AUC of 0.68, whereas adding community features provided little additional lift.
- Sockpuppet pairs: Sockpuppet-pair detection achieved AUC=0.91, with activity features near AUC=0.86 and community features at AUC=0.56.
- Sockpuppet pairs: Interactions between sockpuppets are the strongest way to identify additional accounts in the same group.The paper reports that finding other sockpuppets after identifying one is significantly easier than detecting an individual sockpuppet from ordinary users.
6. RELATED WORK
The work connects sockpuppetry to research on online deception, Wikipedia sockpuppetry, and author identification. Its focus differs from Wikipedia studies because discussion-community sockpuppets primarily interact with one another.
- Deception detection: Prior deception research examines how anonymity enables deceptive agents and how deceptive behavior changes communication and presentation.
- Wikipedia sockpuppetry: Wikipedia sockpuppetry benefits from manually validated ground-truth data, but Wikipedia sockpuppets primarily edit articles rather than interact with one another.
- Author identification: Author-identification research traces document authors or users across platforms without assuming deception, unlike this work’s focus on sockpuppetry.
7. DISCUSSION AND CONCLUSION
The paper’s methodology identifies diverse sockpuppets and supports predictive modeling of their behavior. Its scope excludes some account types and settings, while the findings caution against treating every sockpuppet as malicious.
- Discussion and conclusion: The methodology identifies sockpuppets despite different creation times, usernames, email addresses, writing styles, or discussion participation.
- Discussion and conclusion: Sockpuppets use more singular first-person pronouns, shorter sentences, and more swear words, enabling models to detect accounts and pairs.
- Limitations: The study cannot identify throwaway sockpuppets used once before abandonment.
- Discussion and conclusion: The findings suggest that not all sockpuppets are malicious, because some accounts separate activity across different interest spheres.