Abstract:Coordinated reply attacks are a tactic observed in online influence operations and other coordinated campaigns to support or harass targeted individuals, or influence them or their followers. Despite its potential to influence the public, past studies have yet to analyze or provide a methodology to detect this tactic. In this study, we characterize coordinated reply attacks in the context of influence operations on Twitter. Our analysis reveals that the primary targets of these attacks are influential people such as journalists, news media, state officials, and politicians.
We propose two supervised machine-learning models, one to classify tweets to determine whether they are targeted by a reply attack, and one to classify accounts that reply to a targeted tweet to determine whether they are part of a coordinated attack. The classifiers achieve AUC scores of 0.88 and 0.97, respectively. These results indicate that accounts involved in reply attacks can be detected, and the targeted accounts themselves can serve as sensors for influence operation detection.
What problem does this paper attempt to address?
The main problem that this paper attempts to solve is to identify and detect coordinated reply attacks that occur on social media platforms. Specifically, the author focuses on how to use machine - learning models to identify tweets that are subject to coordinated reply attacks and the accounts involved in these attacks. The following are the specific problems and goals of this study:
1. **RQ1: Who are the targets of coordinated reply attacks?**
- The study aims to determine which types of users or entities are most likely to be the targets of coordinated reply attacks.
- The author also hopes to understand whether the tweets of these target users have certain specific topic characteristics.
2. **RQ2: How to identify tweets that have received coordinated replies from a set of tweets of potential targets?**
- The study proposes a classifier model to distinguish between ordinary tweets and tweets that are subject to coordinated reply attacks.
3. **RQ3: How to detect accounts involved in coordinated replies from a set of attacked tweets?**
- The study proposes another classifier model to identify accounts involved in coordinated reply attacks.
### Main contributions of the paper
- **Target analysis**: The study shows that the main targets of coordinated reply attacks are usually influential individuals, such as journalists, news media, government officials, and politicians. Most targets are only attacked once, and these attacks are usually concentrated in specific situations, such as political events.
- **Tweet classification model**: The author proposes a general classifier model that can identify tweets that are subject to coordinated reply attacks. This model does not rely on specific influence operation (IO) features, so it can be generalized to other contexts and can be used for the development of monitoring and security tools.
- **Account detection model**: The author also proposes a classifier model with good performance for detecting accounts involved in reply attacks. This model has an AUC score of 0.97, indicating its high accuracy.
### Method overview
To achieve the above goals, the author adopts the following methods:
1. **Data collection**: Use 43 state - sponsored influence operation data sets provided by the Twitter Moderation Research Consortium. These data sets contain accounts marked as coordinated attacks and their tweets.
2. **Feature extraction**: For each tweet, multiple features are extracted, including interaction features (such as the number of likes, retweets, and replies), entity features (such as the number of mentions, hashtags, and URLs), delay features (reply time difference), and similarity features (cosine similarity calculated based on the LaBSE model).
3. **Model training and evaluation**: Use machine - learning models such as logistic regression, random forest, AdaBoost, decision tree, and naive Bayes for training, and evaluate the model performance through 10 - fold cross - validation. Finally, the random forest model with the best performance is selected.
### Results
- **Tweet classification model**: The random forest model has an F1 score of 0.80 and an AUC score of 0.88, indicating that this model can effectively distinguish between tweets that are subject to coordinated reply attacks and ordinary tweets.
- **Account detection model**: The account detection model has an AUC score of 0.97, indicating that it can accurately identify accounts involved in coordinated reply attacks.
### Conclusion
This study provides the first large - scale quantitative analysis of coordinated reply attacks and proposes effective detection methods. The research results show that coordinated reply attacks are mainly targeted at influential individuals, and these attacks can be effectively detected by machine - learning models. This provides important tools for social media platforms to respond to and prevent such malicious behaviors.