Unmasking the Web of Deceit: Uncovering Coordinated Activity to Expose Information Operations on Twitter

TL;DR

This study reframes IO-detection on Twitter from single-edge strength signals to topology-aware coordination signals, introducing five behavioral traces to build similarity graphs. It demonstrates that edge-filtering is inconsistent across campaigns, while a node-centrality pruning approach, especially when fused across multiple traces, yields superior IO-driver identification. A supervised embedding pipeline (Node2Vec on a fused similarity network) achieves high AUCs (up to ~0.95) and enables global-scale classification and temporal forecasting of IO engagement. The work provides a scalable framework for uncovering state-backed information operations across countries and offers practical insights for enhancing platform defenses, while acknowledging dataset limitations and the need for careful ethical consideration.

Abstract

Social media platforms, particularly Twitter, have become pivotal arenas for influence campaigns, often orchestrated by state-sponsored information operations (IOs). This paper delves into the detection of key players driving IOs by employing similarity graphs constructed from behavioral pattern data. We unveil that well-known, yet underutilized network properties can help accurately identify coordinated IO drivers. Drawing from a comprehensive dataset of 49 million tweets from six countries, which includes multiple verified IOs, our study reveals that traditional network filtering techniques do not consistently pinpoint IO drivers across campaigns. We first propose a framework based on node pruning that emerges superior, particularly when combining multiple behavioral indicators across different networks. Then, we introduce a supervised machine learning model that harnesses a vector representation of the fused similarity network. This model, which boasts a precision exceeding 0.95, adeptly classifies IO drivers on a global scale and reliably forecasts their temporal engagements. Our findings are crucial in the fight against deceptive influence campaigns on social media, helping us better understand and detect them.

Figures (14)

• Figure 1: Construction of similarity graphs from behavioral traces
• Figure 2: Panel A: Co-Retweet similarity network of users from Egypt & UAE. Blue nodes indicate IO drivers, whereas orange nodes represent organic users. Panel B and C depict the CDF of edge weight and eigenvector centrality of the two classes of accounts, respectively
• Figure 3: Improvement in the classification performance by using node pruning instead of edge filtering
• Figure 4: Average NMI score between groups of users involved in different coordinated actions
• Figure 5: AUC ROC of siloed and fused similarity networks