Malicious Bot Detection in Online Social Networks: Arming Handcrafted Features with Deep Learning

Abstract

Online social networks (OSNs) have long been suffering from various types of malicious bots (e.g., spammers, fake followers, social bots, and content polluters). Recent studies show that they have also been actively involved in delivering hate speeches and disseminating misinformation. Over several years, researchers have proposed multiple approaches to identify some types of them to lower their impact on the OSNs. However, their strategies mostly focused on handcrafted features to capture characteristics of malicious users, or their deep learning approaches may only work under certain situations (e.g., under the dense retweets/sharing behavior). To overcome the limitation of the prior work, in this paper, we propose a novel framework that incorporates handcrafted features and automatically learned features by deep learning methods from various perspectives. It automatically makes the balance between them to make the final prediction toward detecting malicious bots. In particular, we (i) combine publicly available 15 Twitter user datasets and categorize these accounts into two groups (i.e., legitimate accounts and malicious bot accounts); and (ii) propose a deep learning framework that jointly learns various features and detects malicious accounts. Our experimental results show that our proposed model outperforms 7 state-of-the-art methods, achieving 0.901 accuracy. Our ablation study shows that all types of our features positively contribute to enhancing the model performance.

A Appendix

1.1 A.1 Account Status

As we keep the original information of Lee’11, Cresci’15 and Cresci’17, we checked the current status of those malicious bots as shown in Table 6. Overall 68.3% malicious bots are still alive on Twitter, some of which lived more than ten years. This fact indicates that there is a great room to improve the current Twitter’s bot detection system.

1.2 A.2 Source Dataset Details

We list the original user types that each dataset contains as follows:

Lee’11 [29]: content polluters, and legitimate users

Cresci’15 [13]: various kinds of fake accounts

Cresci’17 [14]: traditional & social spambots, and legitimate users

Cresci’18 [15, 16]: stock related bots, and legitimate users

RTBust’19 [32]: retweet bots, and legitimate users

Gilani’17 [23]: bots, and legitimate users

Varol’17 [38]: bots, and legitimate users

Midterm’18 [42]: political bots, and legitimate users

Botwiki’19 [42]: social and bots

Political’19 [41]: political bots

Pronbots’19 [41]: bots advertising scam sites

Vendor’19 [41]: fake followers

Verified’19 [41]: verified legitimate users

Celebrity’19 [41]: celebrity accounts (legitimate)

Botometer’19 [41]: bots and legitimate users

We grouped legitimate users, verified accounts and celebrity accounts as legitimate, while other types of accounts as malicious bots.

Table 6. Recent status of malicious accounts.

1.3 A.3 Detailed Baseline Descriptions

Lee’11 [29]. Authors proposed handcrafted features extracted from user profiles, posting contents and the change of following/follower list over time. We built their best Random Forest model without the network features.

Kim’14 [25]. This is a convolutional text classification architecture that achieved comparable performance against state-of-the-art models. Its hyper-parameters are stable across different domains. We applied his work in using the tweets posted by each user for classifying the accounts.

Tweet2Vec’16 [20]. Tweet2Vec was proposed as a general-purpose tweet embedding framework, trained with neural networks for the hashtag prediction subtask. This work generates domain-specific feature representations of tweets. We constructed a bot detection model, following the proposed architecture, where the embedding layer is followed with fully connected layers.

Chavoshi’18 [11]. Authors proposed a method for mapping the posting timestamp pairs into 2D images to make better use of the temporal posting behavior information of each account. Convolutional neural networks can be applied for the downstream bot detection task.

Kudugunta’19 [28]. This is a framework using LSTM for learning content features and then combine them with several handcrafted features.

RTBust’19 [32]. RTBust is a framework using temporal retweet/tweet patterns for bot detection. Such a framework captures the information in tweet/retweet sequences and extracted features using the variational autoencoder (VAE) [26]. Then the feature embedding generated by the encoders is fed into HDBSCAN [8], an unsupervised clustering method. Outliers are treated as malicious bots.

Yang’19 [42]. Random Forest built on various authors’ proposed features.