Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2407.11690

Using Causality to Infer Coordinated Attacks in Social Media

Isura Manchanayaka·Zainab Razia Zaidi·Shanika Karunasekera·Christopher Leckie
View original source ↗Read source document ↗Export metadata ↓

Abstract

The rise of social media has been accompanied by a dark side with the ease of creating fake accounts and disseminating misinformation through coordinated attacks. Existing methods to identify such attacks often rely on thematic similarities or network-based approaches, overlooking the intricate causal relationships that underlie coordinated actions. This work introduces a novel approach for detecting coordinated attacks using Convergent Cross Mapping (CCM), a technique that infers causality from temporal relationships between user activity. We build on the theoretical framework of CCM by incorporating topic modelling as a basis for further optimizing its performance. We apply CCM to real-world data from the infamous IRA attack on US elections, achieving F1 scores up to 75.3% in identifying coordinated accounts. Furthermore, we analyse the output of our model to identify the most influential users in a community. We apply our model to a case study involving COVID-19 anti-vax related discussions on Twitter. Our results demonstrate the effectiveness of our model in uncovering causal structures of coordinated behaviour, offering a promising avenue for mitigating the threat of malicious campaigns on social media platforms.

Explore related subjects

cs.SI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Isura Manchanayaka, Zainab Razia Zaidi, Shanika Karunasekera, Christopher Leckie. 2024-07-16. Using Causality to Infer Coordinated Attacks in Social Media. https://arxiv.org/abs/2407.11690

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Two Fault Lines: Latent Polarity Geometry in X Community Notes

Community Notes is X's crowdsourced fact-checking system. A note is published beneath the post it corrects only when raters who usually disagree both rate it helpful, a design called bridging. To apply that rule, the system learns who disagrees with whom from the ratings alone, placing every rater and note on one line, the polarity axis. Every scorer in the production pipeline uses a single axis. Refitting the base model these scorers share on the full public data (212.9M ratings, 2.33M notes, 1.07M raters), we find that one axis is too few. The space is at least two-dimensional. The first axis is left/right politics, while the second, which we interpret as trust in institutions, is largely independent of the first. A held-out test confirms that the second axis improves prediction of unseen ratings, while a third adds little. A second rater dimension learned from one set of topics predicts how raters judge COVID and Ukraine notes excluded from the fit, so it does not merely restate subject matter. Among heavily rated notes that barely divide raters politically, the published share falls from 71.5% to 11.7% as second-axis disagreement grows. A one-axis fit records these notes only as weakly polarised and less helpful; the information that raters at one end of the second axis support them is lost. Authors write notes matching their own position on both axes (r = 0.538 and 0.358), and a small minority of raters cast most ratings (Gini = 0.718). Fewer notes are published in the smallest language communities, but the shortfall is in ratings received, not in how the rule treats them. Keeping ratings per note constant, only Hindi stays below the global rate of 10.85%, and Greek moves from 7.76% to 11.68%. We argue for a bridging model with more than one axis of disagreement, and for recruiting raters in the languages the current design reaches least.

cs.SI↗
arXiv2026

Setting the clock: Evaluating temporal window parameters for coordinated behavior detection

Coordinated behavior is a central mechanism of online collective action. On social media platforms, it can support legitimate mobilization, but it can also be exploited in disinformation campaigns, astroturfing, and information operations. Detecting coordinated behavior on social media platforms typically relies on coordination networks, where users are linked when they perform similar actions within shared temporal windows. While the temporal window is central to how coordination is operationalized, it is often treated as an implementation detail rather than as a substantive modeling decision. This paper presents a first analysis of how two key temporal parameters, window length and stride, affect the detection of coordinated communities within information operation campaigns. We find that window length determines which coordination patterns are detectable, while window stride has negligible effect on precision and recall. Our analysis highlights selecting appropriate temporal window parameters as an open methodological challenge requiring careful treatment.

cs.SI↗
arXiv2026

Auditing bipartite motif interpretations: a worked example with conservation checks and open-path decomposition

Motif profiles of bipartite agent-object networks, such as tourist-site visits and customer-item transactions, are read as evidence about structural roles and about differences between networks, often without asking what the two degree sequences already fix. In a simple bipartite graph the induced k-fan count on one node type is a sum of degree combinations, so it has zero variance under a null that preserves both degree sequences. We apply this known result to a reconstructed tourism rating network of 17 tourists, 80 sites and 637 edges, the sole inferential worked example, and, as a provenance-limited illustration, to published motif-instance aggregates over 36 monthly luxury customer-item networks. The four fan classes are exact functions of the degree sequences: in the tourism network the raw fan counts and the size-3 two-fan ratio (84.7% fan-out) restate those sequences. The published luxury counts require at least 89,502 customer-item edges against 26,451 reported transactions, so their 99.8% fan-in is reported as a descriptive value only. Against a hard bipartite configuration null, the four-cycle count is degree-consistent (z about +1.0) and the open path is deficient (z about -5.8) by 2,243 instances, 2.4% of the null mean; the deficit survives every leave-one-tourist-out re-run (z -4.5 to -8.1). An exact identity splits it at the point estimate into 64.4% mixing and 35.6% four-cycle, but that split is not an attribution: the observed mixing term lies below all 500 null samples, the two components are almost collinear under the null (r = 0.968), and the mixing share ranges from 36.6% to 116.5% under leave-one-tourist-out deletion. The deficit is extreme relative to the sampled null, while its class-level interpretation is undetermined and unstable. We give a four-step pre-interpretation check and a reference implementation.

cs.SI↗