Characterizing and Detecting Propaganda-Spreading Accounts on Telegram

TL;DR

This paper analyzes propaganda spread on Telegram, introduces a novel detection method leveraging message relationships, and demonstrates high accuracy and efficiency in identifying coordinated disinformation campaigns.

Contribution

It presents a new propaganda detection mechanism tailored for Telegram, utilizing message relationships, achieving 97.6% accuracy and outperforming human moderators.

Findings

Detected two independent propaganda networks

Achieved 97.6% detection rate

Outperformed human moderators in speed and accuracy

Abstract

Information-based attacks on social media, such as disinformation campaigns and propaganda, are emerging cybersecurity threats. The security community has focused on countering these threats on social media platforms like X and Reddit. However, they also appear in instant-messaging social media platforms such as WhatsApp, Telegram, and Signal. In these platforms information-based attacks primarily happen in groups and channels, requiring manual moderation efforts by channel administrators. We collect, label, and analyze a large dataset of more than 17 million Telegram comments and messages. Our analysis uncovers two independent, coordinated networks that spread pro-Russian and pro-Ukrainian propaganda, garnering replies from real users. We propose a novel mechanism for detecting propaganda that capitalizes on the relationship between legitimate user messages and propaganda replies and is tailored to the information that Telegram makes available to moderators. Our method is faster, cheaper, and has a detection rate (97.6%) 11.6 percentage points higher than human moderators after seeing only one message from an account. It remains effective despite evolving propaganda.