Coordinated Reply Attacks in Influence Operations: Characterization and Detection

TL;DR

Results indicate that accounts involved in reply attacks can be detected, and the targeted accounts themselves can serve as sensors for influence operation detection.

Abstract

Coordinated reply attacks are a tactic observed in online influence operations and other coordinated campaigns to support or harass targeted individuals, or influence them or their followers. Despite its potential to influence the public, past studies have yet to analyze or provide a methodology to detect this tactic. In this study, we characterize coordinated reply attacks in the context of influence operations on Twitter. Our analysis reveals that the primary targets of these attacks are influential people such as journalists, news media, state officials, and politicians. We propose two supervised machine-learning models, one to classify tweets to determine whether they are targeted by a reply attack, and one to classify accounts that reply to a targeted tweet to determine whether they are part of a coordinated attack. The classifiers achieve AUC scores of 0.88 and 0.97, respectively. These results indicate that accounts involved in reply attacks can be detected, and the targeted accounts themselves can serve as sensors for influence operation detection.

Figures (11)

• Figure 1: Data collection for the classifiers. The dashed line separated the last IO reply and the first successive tweet by the target.
• Figure 2: Complementary cumulative distribution functions (CCDF) of statistics describing target accounts and their tweets. (A) Numbers of followers and following (friends) of targets. (B) Number of targeted tweets per target. (C) Number of coordinated replies received by each targeted tweet. (D) Time delay between targeted tweets and their coordinated replies.
• Figure 3: Characterization of the Serbia campaign. Distributions of (A) countries and (B) professions of the targets. (C) Wordshift graph comparing the most frequent words in targeted and non-targeted tweets.
• Figure 4: Characterization of the Egypt campaign. Distributions of (A) countries and (B) professions of the targets. (C) Wordshift graph comparing the most frequent words in targeted and non-targeted tweets.
• Figure 5: Engagement received by targeted and control tweets. (A) Replies, (B) retweets, and (C) likes.