Modeling Temporal Activity to Detect Anomalous Behavior in Social Media

Abstract

Social media has become a popular and important tool for human communication. However, due to this popularity, spam and the distribution of malicious content by computer-controlled users, known as bots, has become a widespread problem. At the same time, when users use social media, they generate valuable data that can be used to understand the patterns of human communication. In this article, we focus on the following important question: Can we identify and use patterns of human communication to decide whether a human or a bot controls a user? The first contribution of this article is showing that the distribution of inter-arrival times (IATs) between postings is characterized by following four patterns: (i) heavy-tails, (ii) periodic-spikes, (iii) correlation between consecutive values, and (iv) bimodallity. As our second contribution, we propose a mathematical model named Act-M (Activity Model). We show that Act-M can accurately fit the distribution of IATs from social media users. Finally, we use Act-M to develop a method that detects if users are bots based only on the timing of their postings. We validate Act-M using data from over 55 million postings from four social media services: Reddit, Twitter, Stack-Overflow, and Hacker-News. Our experiments show that Act-M provides a more accurate fit to the data than existing models for human dynamics. Additionally, when detecting bots, Act-M provided a precision higher than 93% and 77% with a sensitivity of 70% for the Twitter and Reddit datasets, respectively.

Behavioral Security in Covert Communication Systems

“…A.F.Costa et al [18] and Y.T.Daniel et al [19] have found that for many ordinary users, when logging in and using these social media, their behavioral records have a significant time distribution. This shows that users may have their own habits of using these social media and these behavior on social media is likely to have a temporal correlation.…”

Detecting Malicious Social Bots Based on Clickstream Sequences

“…According to the social interactions between users of the Twitter user to identify the active, passive and inactive users, a supervised machine learning method was proposed to identify social bots on the basis of age, location and other static features of active, passive, and inactive users in the Twitter, as well as interacting person, interaction content, interaction theme, and some dynamic characteristics [23]. A time act model, namely, Act-M, was constructed focusing on the timing of user behavior activities [24], which can be used to accurately determine the interval between different behaviors of social media users to accurately detect malicious users. There have been focused on detecting semi-social bots too.…”

How modern news aggregators help development communities shape and share knowledge

“…ž Hacker News. Hacker News is a social news website focused on technology news [13], with functionality very similar to Reddit. The main diference between the two news aggregators is that Hacker News focuses on technology news and has no sub-communities, while Reddit, in general, does not focus on any topic, but supports sub-communities that do.…”