RTbust: Exploiting Temporal Patterns for Botnet Detection on Twitter

TL;DR

This paper introduces RTbust, a novel bot detection method on Twitter that exploits temporal retweeting patterns using unsupervised learning, effectively identifying malicious accounts and uncovering new botnets.

Contribution

The paper presents a new visualization and an unsupervised detection technique leveraging LSTM autoencoders and clustering to identify social bots based on retweeting behavior.

Findings

RTbust achieves an F1 score of 0.87, outperforming competitors.

Identified 2 previously unknown active botnets.

Uncovered distinct retweeting patterns for bots and humans.

Abstract

Within OSNs, many of our supposedly online friends may instead be fake accounts called social bots, part of large groups that purposely re-share targeted content. Here, we study retweeting behaviors on Twitter, with the ultimate goal of detecting retweeting social bots. We collect a dataset of 10M retweets. We design a novel visualization that we leverage to highlight benign and malicious patterns of retweeting activity. In this way, we uncover a 'normal' retweeting pattern that is peculiar of human-operated accounts, and 3 suspicious patterns related to bot activities. Then, we propose a bot detection technique that stems from the previous exploration of retweeting behaviors. Our technique, called Retweet-Buster (RTbust), leverages unsupervised feature extraction and clustering. An LSTM autoencoder converts the retweet time series into compact and informative latent feature vectors, which are then clustered with a hierarchical density-based algorithm. Accounts belonging to large clusters characterized by malicious retweeting patterns are labeled as bots. RTbust obtains excellent detection results, with F1 = 0.87, whereas competitors achieve F1 < 0.76. Finally, we apply RTbust to a large dataset of retweets, uncovering 2 previously unknown active botnets with hundreds of accounts.