IIT Home Page CNR Home Page

RTbust: Exploiting Temporal Patterns for Botnet Detection on Twitter

Within OSNs, many of our supposedly online friends may instead be fake accounts called social bots, part of large groups that purposely re-share targeted content. Here, we study retweeting behaviors on Twitter, with the ultimate goal of detecting retweeting social bots. We collect a dataset of 10M retweets. We design a novel visualization that we leverage to highlight benign and malicious patterns of retweeting activity. In this way, we uncover a “normal” retweeting pattern that is peculiar of human-operated accounts, and 3 suspicious patterns related to bot activities. Then, we propose a bot detection technique that stems from the previous exploration of retweeting behaviors. Our technique, called Retweet-Buster (RTbust), leverages unsupervised feature extraction and clustering. An LSTM autoencoder converts the retweet time series into compact and informative latent feature vectors, which are then clustered with a hierarchical density-based algorithm. Accounts belonging to large clusters characterized by malicious retweeting patterns are labeled as bots. RTbust obtains excellent detection results, with F 1 = 0.87, whereas competitors achieve F 1 < 0.76. Finally, we apply RTbust to a large dataset of retweets, uncovering 2 previously unknown active botnets with hundreds of accounts.

Proceedings of the 11th International ACM Conference on Web Science (WebSci'19), Boston, USA, 2019

External authors: Marco Avvenuti (University of Pisa), Walter Quattrociocchi (Ca' Foscari University of Venice)
IIT authors:

Type: Contributo in atti di convegno
Field of reference: Computer Science & Engineering

File: Mazza, 2019, RTbust - Exploiting Temporal Patterns for Botnet Detection on Twitter.pdf

Activity: Social Media Analysis