Behavior Change as a Signal for Identifying Social Media Manipulation

TL;DR

The degree to which change in behavior can serve as a signal for identifying automated or coordinated accounts is investigated, revealing that the distributions of behavioral changes tend to be consistent across authentic accounts, while social bots exhibit either very low or very high behavioral change.

Abstract

Social media accounts engaging in online manipulation can change their behaviors for re-purposing or to evade detection. Existing detection systems are built on features that do not exploit such behavioral patterns. Here we investigate the degree to which change in behavior can serve as a signal for identifying automated or coordinated accounts. First, we use Behavioral Languages for Online Characterization (BLOC) to represent the behavior of a social media account as a sequence of symbols that represent the account's actions and content. Second, we segment an account's BLOC strings and measure the changes between consecutive segments. Third, we represent an account as a feature vector that captures the distribution of behavioral change values. Finally, the resulting features are used to train and test supervised classifiers. We apply the proposed method to two detection tasks aimed at automated behavior (social bots) and coordinated inauthentic behavior (information operations). Our results reveal that the distributions of behavioral changes tend to be consistent across authentic accounts, while social bots exhibit either very low or very high behavioral change. Coordinated inauthentic accounts exhibit highly similar distributions of behavioral change within the same campaign, but diverse across campaigns. These patterns allow our classifiers to achieve good accuracy in both tasks, demonstrating the effectiveness of behavioral change as a signal for identifying online manipulation.

Figures (7)

• Figure 1: Overview of our Behavior Change methodology to identify social media manipulation. The feature vectors are used to train a model for a specific task, such as detecting automated or coordinated accounts.
• Figure 2: BLOC representation of the behaviors of three users, @NASA, @Alice, and @Bob using action/pause and content alphabets. For the action/pause alphabet, the sequence of three tweets (a reply, an original tweet, and a retweet) by @NASA can be represented by three letters $p.T.r$ separated by dots (long pauses). Using the content alphabet, it can be represented by three sets of strings $(Emt)(mmt)(mmmmmUt)$ enclosed in parentheses.
• Figure 3: Color-coding of BLOC action symbols of Twitter accounts to illustrate how their behaviors change (color switches). Each square represents an action. Color legend (non-exhaustive): Green - post, Red - retweet, Cyan - reply, Gray - pauses (Darker gray - longer pauses). (a) @FoxNews exhibits repetitive patterns, reflecting automated activity. (b) @elonmusk exhibits a mix of diverse actions (replies and posts) without repetitive patterns. (c) @TEN_GOP, a Russian troll account, exhibits sudden shifts between organic-looking and repetitive patterns.
• Figure 4: Three ways of segmenting a user's BLOC string. This example includes pauses less than an hour ($\Delta_h$), between an hour and a day ($\Delta_d$), and between a day and a month ($\Delta_m$). (a) pauses (longer than one hour). (b) weeks. (c) sets-of-k ($k=4$).
• Figure 5: Comparison of the distributions of (a) action and (b) content behavioral distances for human accounts, and (c) action and (d) content behavioral distances for bot accounts. Colors denote account classes (human in blue and bots in yellow) and patterns denote behavior types (solid for actions and hatched for content).