An Unsupervised Approach to Detect Spam Campaigns that Use Botnets on Twitter

Zhouhan Chen; Devika Subramanian

Home/Archive/arXiv

arXiv · 1804.05232

An Unsupervised Approach to Detect Spam Campaigns that Use Botnets on Twitter

Zhouhan Chen·Devika Subramanian

View original source ↗Read source document ↗Export metadata ↓

Abstract

In recent years, Twitter has seen a proliferation of automated accounts or bots that send spam, offer clickbait, compromise security using malware, and attempt to skew public opinion. Previous research estimates that around 9% to 17% of Twitter accounts are bots contributing to between 16% to 56% of tweets on the medium. This paper introduces an unsupervised approach to detect Twitter spam campaigns in real-time. The bot groups we detect tweet duplicate content with shortened embedded URLs over extended periods of time. Our experiments with the detection protocol reveal that bots consistently account for 10% to 50% of tweets generated from 7 popular URL shortening services on Twitter. More importantly, we discover that bots using shortened URLs are connected to large scale spam campaigns that control thousands of domains. There appear to be two distinct mechanisms used to control bot groups and we investigate both in this paper. Our detection system runs 24/7 and actively collects bots involved in spam campaigns and adds them to an evolving database of malicious bots. We make our database of detected bots available for query through a REST API so others can filter tweets from malicious bots to get high quality Twitter datasets for analysis.

Explore related subjects

cs.SI

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Zhouhan Chen, Devika Subramanian. 2018-04-14. An Unsupervised Approach to Detect Spam Campaigns that Use Botnets on Twitter. https://arxiv.org/abs/1804.05232

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

The Benefit of Collective Intelligence in Community-Based Content Moderation is Limited by Overt Political Signalling

Social media platforms face increasing scrutiny over the rapid spread of misinformation. In response, many have adopted community-based content moderation systems, including Community Notes (formerly Birdwatch) on X (formerly Twitter), Community Notes on Meta, and Footnotes on TikTok. However, research shows that the current design of these systems can allow political biases to influence both the development of notes and the rating processes, reducing their overall effectiveness. We hypothesise that enabling users to collaborate on writing notes, rather than relying solely on individually authored notes, can enhance the overall quality of their notes. To test this idea, we conducted an online experiment in which participants jointly authored notes on politically misleading posts. We find that collaboration improves the helpfulness of notes, although the average effect depends on the interactional context. In particular, the benefits of collaboration decline when participants are made aware of one another's political affiliations. We also find that politically diverse teams improve note quality when evaluating Republican posts, while team composition does not meaningfully affect note quality for Democrat posts. These findings underscore the complexity of community-based content moderation and highlight the importance of understanding group dynamics and political diversity when designing more effective moderation systems.

cs.SI↗

arXiv2026

The Same Ledger, Different Verdicts: How Measurement Specification Determines On-Chain Concentration

Whether a public blockchain is "decentralized" is routinely settled by citing a concentration statistic. On two ERC-20 ledgers, Chainlink (LINK) and Uniswap (UNI) over a 90-day window, we show that verdict depends on measurement specification rather than the ledger itself. Four discretionary choices (holder population, address type, temporal aggregation, and entity resolution) move the balance HHI for UNI from 109 to 2,336 (a factor of 21), with every specification defensible. Over the same range, the Gini coefficient moves by less than 0.003 and does not change under entity resolution, demonstrating that Gini and HHI answer different questions and cannot substitute for one another. We further document an implementation choice - summing versus overwriting repeated transfers - that discards roughly 85% of volume and overturns a finding on wealth and structural position. Substantively, both ledgers are extraordinarily unequal in ownership (balance Gini = 0.990 and 0.998) yet unconcentrated in routing (weekly flow HHI = 421 and 386), with the two dimensions close to statistically independent across addresses. A parameterized criterion for hidden brokers identifies 30 and 18 zero-balance intermediaries, 12 shared across ledgers; a matched control confirms that degree thresholding, rather than learned embeddings, drives the discovery. Finally, on the governance ledger, proposal-eligible addresses and routing intermediaries are almost disjoint, so routing contestability is held at the pleasure of a rule layer with a Nakamoto coefficient of two. We conclude that on-chain concentration should be reported as a specified range rather than a point estimate.

cs.SI↗

arXiv2026

Optimal and heuristic strategies for evaluating the influence of coordinated behavior in information cascades and retweet networks

Coordinated Inauthentic Behavior (CIB) has become a major concern in online social platforms, yet its actual impact on information diffusion remains poorly understood. Existing research has primarily focused on detecting coordinated activity, while comparatively little attention has been devoted to quantifying its influence once detected. In this work, we introduce two complementary frameworks for the post-hoc evaluation of coordinated accounts. First, we formulate the problem on information cascades as a constrained influence maximization problem over directed trees and develop a polynomial-time dynamic programming algorithm that computes the optimal placement of coordinated nodes, providing an upper bound on their achievable influence. Second, motivated by the limited availability of diffusion cascades in real-world platforms, we propose a network-based framework that estimates influence directly from retweet networks using the independent cascade model and compares the observed placement of coordinated accounts against established heuristic baselines. We evaluate both approaches on Twitter/X data from the 2019 UK General Election and on a collection of verified state-backed information operation campaigns spanning multiple countries. While coordinated accounts exhibit limited influence in the UK cascades, the network-based analysis reveals substantial differences across campaigns, with several operations achieving influence comparable to or exceeding that of structurally central seed sets. Finally, by reconstructing cascades from the retweet networks, we show that the two frameworks produce consistent results, suggesting that the observed effects reflect intrinsic structural properties of coordinated activity rather than artifacts of the underlying methodology.

cs.SI↗