Characterizing and Detecting Propaganda-Spreading Accounts on Telegram

TL;DR

The paper tackles propaganda on Telegram by building a large labeled dataset and introducing a Telegram-tailored automated detector. It identifies two large coordinated propaganda networks (pro-Russian and pro-Ukrainian) and demonstrates that a detector based on textual embeddings that links trigger messages with propaganda replies can outperform human moderators, generalize to new topics, and operate in near-real-time. The approach uses API-visible data and combines propaganda-message embeddings, trigger-message embeddings, and their interactions, achieving up to 97.4% overall accuracy. The study highlights Telegram-specific moderation challenges, provides deployment guidance, and emphasizes the need to broaden anti-propaganda research beyond Western social networks to mitigate information-based attacks more effectively.

Abstract

Information-based attacks on social media, such as disinformation campaigns and propaganda, are emerging cybersecurity threats. The security community has focused on countering these threats on social media platforms like X and Reddit. However, they also appear in instant-messaging social media platforms such as WhatsApp, Telegram, and Signal. In these platforms information-based attacks primarily happen in groups and channels, requiring manual moderation efforts by channel administrators. We collect, label, and analyze a large dataset of more than 17 million Telegram comments and messages. Our analysis uncovers two independent, coordinated networks that spread pro-Russian and pro-Ukrainian propaganda, garnering replies from real users. We propose a novel mechanism for detecting propaganda that capitalizes on the relationship between legitimate user messages and propaganda replies and is tailored to the information that Telegram makes available to moderators. Our method is faster, cheaper, and has a detection rate (97.6%) 11.6 percentage points higher than human moderators after seeing only one message from an account. It remains effective despite evolving propaganda.

Figures (14)

• Figure 1: Repeated texts length for propaganda accounts and user accounts. Users tend to repeat short messages such as emojis, single words, and short phrases, while propaganda accounts mostly repeat relatively long texts.
• Figure 2: Word graph for propaganda messages and user messages. All the stems are translated by the authors. people1("народ") and people2("люди") are two Russian words for people. SMO("СВО") -- Special Military Operation, official title in Russia for the Russian-Ukrainian war. On the left side of this graph are the words that are more prevalent for the propaganda messages, while on the right side are the words typical for user messages.
• Figure 3: Effectiveness of propaganda messages is comparable to the effectiveness of messages by actual users. The distributions are similar, indicating that users are unlikely to distinguish propaganda accounts from other users.
• Figure 4: Community structures for users and propaganda accounts. Nodes are accounts, and edges represent accounts that use the same message text (more than 10 characters long). Nodes are colored by community Louvain (modularity 0.17 for propaganda accounts and 0.787 for users). Propaganda accounts are connected, and their degree is mostly associated with the volume of messages they send. This volume is positively correlated with the number of days they are active. Users rarely repeat each other messages. They mostly repeat "meme" phrases and the foreign agent messageforeign_agent, which is the most repeated text across different users.
• Figure 5: Minimal Lifespan distribution for propaganda accounts and user accounts. Lifespan is measured as a period between the first and the last message in the real-time dataset. The last percentile on the histogram contains "persistent" accounts since the duration of the study was $\sim$1100 hours. Overall, we see that most propaganda accounts live less than one day, and no propaganda accounts are present for the duration of the study.