ALETHEIA: Combating Social Media Influence Campaigns with Graph Neural Networks

TL;DR

ALETHEIA leverages graph neural networks and temporal link prediction to effectively detect and forecast malicious influence campaigns on social media, improving accuracy and scalability over previous methods.

Contribution

The paper introduces ALETHEIA, a novel system that combines graph-based features, GNNs, and RNNs for enhanced detection and prediction of influence campaigns on social media.

Findings

GNN-based detection improves F1-score by 3.7% over standard methods.

Temporal link prediction achieves an average AUC of 96.6%.

Graph structural features outperform interaction-only features.

Abstract

Influence campaigns are a growing concern in the online spaces. Policymakers, moderators and researchers have taken various routes to fight these campaigns and make online systems safer for regular users. To this end, our paper presents ALETHEIA, a system that formalizes the detection of malicious accounts (or troll accounts) used in such operations and forecasts their behaviors within social media networks. We analyze influence campaigns on Reddit and X from different countries and highlight that detection pipelines built over a graph-based representation of campaigns using a mix of topological and linguistic features offer improvement over standard interaction and user features. ALETHEIA uses state-of-the-art Graph Neural Networks (GNNs) for detecting malicious users that can scale to large networks and achieve a 3.7% F1-score improvement over standard classification with interaction features in prior work. Furthermore, ALETHEIA employs a first temporal link prediction mechanism built for influence campaigns by stacking a GNN over a Recurrent Neural Network (RNN), which can predict future troll interactions towards other trolls and regular users with an average AUC of 96.6%. ALETHEIA predicts troll-to-troll edges (TTE) and troll-to-user edges (TUE), which can help identify regular users being affected by malicious influence efforts. Overall, our results highlight the importance of utilizing the networked nature of influence operations (i.e., structural information) when predicting and detecting malicious coordinated activity in online spaces.