Uncovering Coordinated Networks on Social Media: Methods and Case Studies¶

Authors: Diogo Pacheco, Pik-Mai Hui, Christopher Torres-Lugo, Bao Tran Truong, Alessandro Flammini, Filippo Menczer

Venue: ICWSM 2020 (The International AAAI Conference on Web and Social Media)

TL;DR¶

This paper proposes a general, unsupervised, network-based methodology to detect coordinated inauthentic behavior on social media. The approach identifies behavioral traces (handle changes, image sharing, hashtag sequences, co-retweets, synchronized actions) and constructs bipartite networks to discover clusters of accounts likely controlled by a single entity. Five case studies—U.S. elections, Hong Kong protests, Syrian civil war, cryptocurrency manipulation, and 2016 midterm elections—demonstrate the method's generality across political, protest, and financial manipulation contexts.

Contributions¶

General methodology: Unsupervised, no labeled training data required; applicable to any social media platform and any behavioral modality
Multiple modalities: Detects coordination via five distinct behavioral signals—not restricted to a single trace type
Scalable approach: Network-based method scales efficiently to millions of accounts
Broad validation: Case studies spanning geopolitics (Syria), electoral politics (U.S., Hong Kong), and financial manipulation (cryptocurrency) show applicability
Open code and data: GitHub repository enables reproducibility and extension to new contexts

Method¶

The detection pipeline consists of four phases:

1. Behavioral Trace Extraction¶

Identify suspicious behavioral patterns that may indicate coordination. Traces fall into five categories:

(a) Content traces: Shared words, n-grams, hashtags, links, user mentions—coordination based on content similarity
(b) Activity traces: Shared spatio-temporal patterns—accounts posting at similar times, locations, or geo-coordinates
(c) Identity traces: Shared account descriptors—name, handle, profile picture, account creation date; detects reused identities
(d) Combination traces: Jointly consider multiple dimensions to reduce false positives from naturally popular content
(e) Synchronization traces: Temporal clustering—accounts posting within narrow time windows (e.g., 30 minutes)

2. Bipartite Network Construction¶

Build a bipartite graph with two node types: - Layer 1: Accounts (user IDs) - Layer 2: Behavioral features extracted from the traces

Edges connect accounts to the features they exhibit. Preliminary data cleaning filters low-support accounts (e.g., few tweets, sparse activity).

3. Projection onto Account Network¶

Project the bipartite network onto the account layer, creating an account-to-account coordination network. Edge weights represent the strength of association between accounts: - Simple co-occurrence: Count shared features (e.g., number of shared URLs) - Jaccard similarity: Normalize for account-specific popularity - Cosine similarity: Account similarity matrices for image-based coordination - TF-IDF: Reduce weight of universally popular features

Filter edges to retain only the most suspicious connections, focusing on high-weight edges to improve precision.

4. Cluster Analysis¶

Apply community detection algorithms (connected components, Louvain, MCL) to identify groups of tightly coordinated accounts. Evaluate clusters for evidence of coordination through metrics including: - Network centralization and density - Account creation dates (coordinated timing) - Behavioral diversity (distinct roles within network) - Bot scores (if applicable)

Case Studies¶

Finding: Detected 1.5M Twitter accounts with 23 accounts sharing multiple handles.

Method: Identity traces via screen name co-occurrence. Unweighted bipartite network; connected-component analysis.

Results: Identified three major clusters representing hub nodes (name squatting), giant component (casual handle changes), and specific coordinated groups. Manual inspection confirmed suspicious clusters corresponding to political campaign account takeovers.

Case Study 2: Image Coordination (Hong Kong Protests)¶

Finding: 313 accounts coordinating during Hong Kong 2019 pro- and anti-protest campaigns via shared images.

Method: Image traces using RGB color histograms binned into 128 dimensions; Jaccard similarity on image feature vectors.

Results: Distinct pro- and anti-protest clusters visible. Shared images revealed strategic use of protest narratives. Anti-protest group focused on images with English text; pro-protest group on Chinese-language images and in-person photography.

Case Study 3: Hashtag Sequences (2018 U.S. Midterms)¶

Finding: 1,809 accounts coordinating through 39.3M tweets; 32 coordinated communities detected.

Method: Hashtag sequence traces (ordered sequences of hashtags within a 24-hour window). Bipartite network connecting accounts to ordered hashtag sequences; cosine similarity on sequence frequency vectors.

Results: Largest component (1,175 accounts) split into 13 sub-groups representing distinct coordinated campaigns (pro- and anti-Trump variants). Smaller clusters matched known disinformation campaigns targeting gun control and other policy debates.

Finding: Detected coordinated amplification of specific narratives through shared retweet targets.

Method: TF-IDF weighted co-retweet similarity; connected-component filtering.

Results: Identified pro- and anti-White Helmets campaigns during Syrian conflict. High overlap in retweet targets revealed coordinated narratives (e.g., "fake rescue operations"). Bot scores show majority are human-controlled accounts, not fully automated bots.

Case Study 5: Synchronized Actions (Cryptocurrency Pump & Dump)¶

Finding: 1,175 accounts coordinating cryptocurrency promotion; 887.2K tweets analyzed.

Method: Timestamp traces with 30-minute temporal windows; TF-IDF on tweet timestamps.

Results: Identified large central component (404 accounts) coordinated around cryptocurrency "pump & dump" schemes. Temporal clustering reveals discrete campaigns (e.g., "Backfire Trump" campaign Dec 2017, coordinated price manipulation). Mixed human and bot accounts; bots post at high volume but humans drive initial narrative seeding.

Connections¶

Astroturfing — Classic form of coordinated inauthentic behavior that mimics grassroots support; this paper's methods generalize beyond astroturfing to detect diverse coordination tactics
Bot detection — Complementary to account-level bot detection; group-level coordination analysis can reveal human-coordinated accounts missed by individual classifiers
Computational Propaganda — Coordination is a key tactic in state-sponsored and political disinformation campaigns
Information operations — Coordinated networks are the operational arm of information warfare
Network analysis of misinformation — Core methodology; uses bipartite projection and community detection

Notes¶

Strengths: - Unified framework applicable across multiple behavioral modalities (handles, images, hashtags, retweets, timing) - Unsupervised; requires no labeled training data, making it portable across contexts - Case studies span diverse scenarios (electoral politics, protests, financial manipulation, state information warfare) - Demonstrates that coordination detection can identify mixed human-bot networks where bots alone don't explain the pattern - Open code and data released for reproducibility

Weaknesses: - Parameter tuning (support thresholds, similarity cutoffs, temporal window size) is dataset- and modality-specific; paper shows parameter choices affect precision/recall tradeoff but limited guidance on selection - Manual inspection required for ground truth validation; no large-scale labeled benchmark for coordinated networks across modalities - False positives possible when naturally popular content (memes, hashtags, URLs) are shared coincidentally; content-based traces more prone to false positives than identity/timing traces - Limited discussion of adversarial robustness—do sophisticated operators deliberately alter behavioral patterns to evade detection? - Timestamps and temporal patterns (Case Study 5) may be sensitive to timezone effects or platform throttling

Extensions and open questions: - Can multi-modal combination (e.g., hashtag sequences + co-retweets + synchronized actions) reliably reduce false positives without sacrificing recall? - How do temporal window parameters (length, stride, overlap tolerance) interact with coordination detection in different modalities? - What is the minimum "network size" below which coordinated groups are indistinguishable from coincidental overlap? - How do coordinated networks adapt when detection methods become public knowledge?