Skip to content
On the Detection of Disinformation Campaign Activity with Network Analysis

On the Detection of Disinformation Campaign Activity with Network Analysis

Authors: Luis Vargas, Patrick Emami, Patrick Traynor

Venue: Cloud Computing Security Workshop, 2020 — arXiv:2005.13466

TL;DR

State-sponsored disinformation campaigns on Twitter exhibit distinct coordination patterns (shared messages, hashtags, URLs, retweet cascades) that differ from legitimate coordinated activity. The paper proposes using coordination network features—extracted from daily account interactions—to train a binary classifier that detects SIO-like activity with 0.71 F1 score out-of-distribution, demonstrating that network topology alone is sufficient evidence for identifying organized manipulation campaigns.

Contributions

  • Coordination network analysis as a forensic tool. First application of coordination network topology to detect state-sponsored information operations (SIOs) at scale, distinguished from prior bot-detection work by focusing on group-level coordination patterns rather than individual account behavior.
  • Binary classifier for coordinated activity. A Random Forest classifier using 42-dimensional feature vectors derived from six types of coordination networks (retweet, co-tweet, co-retweet, co-hashtag, co-mention, co-url).
  • Empirical validation on Twitter SIO campaigns. Evaluation on 10 labeled state-sponsored campaigns (1.6–36.5M tweets) versus four baseline communities (random, academic, political, Congressional), achieving strong discrimination without requiring content analysis.
  • Two realistic prediction tasks. Time series prediction (Task 1: classify future activity from past data) and cross-campaign generalization (Task 2: train on one SIO campaign, test on another).

Method

Coordination network extraction: For each SIO campaign and baseline community, the authors generate daily coordination networks by aggregating Twitter activity across a 7-day window. Six coordination patterns are tracked:

  • retweet: A retweets B's tweet within a time window
  • co-tweet: A and B tweet the same content (including retweets of a common original)
  • co-retweet: A and B retweet the same tweet
  • co-hashtag: A and B use the same hashtag within a time window
  • co-mention: A and B mention the same user within a time window
  • co-url: A and B post the same URL within a time window

Feature extraction: From each coordination network, seven metrics are computed and concatenated into a 42-dimensional vector (7 metrics × 6 network types): - Number of nodes and edges - Size of largest connected component - Average connected component size - Mean and standard deviation of node degree

Classification: A Random Forest classifier with 100 trees is trained on labeled SIO and baseline activity, using these coordination network statistics. Evaluation uses precision, recall, F1 score, and ROC curves, with majority voting to combine predictions from 100 sampled decision trees.

Results

Task 1 (time series prediction): Classification of future coordinated activity on SIO campaigns known at test time achieves substantially higher F1 (>0.98) than on random Twitter activity. Removing the first 60 days of data (to allow the classifier to settle) yields F1 ≈ 0.98.

Task 2 (cross-campaign generalization): Training on one SIO campaign and testing on another (the harder, more realistic setting) yields F1 ≈ 0.71. This indicates that while coordination patterns capture real SIO behavior, variation exists across campaigns—coordination intensity and type differ between campaigns based on targeting strategy and campaign lifecycle.

Coordination patterns vary by campaign: Different SIOs employ different coordination tactics. For example, the Saudi Arabia campaign relied heavily on co-tweeting for most of 2018, while the Turkey campaign used a steady mix of coordination types. Legitimate communities show lower coordination intensity and more intermittent activity.

Connections

  • Related to Propagation-based fake news detection via shared graph-feature framework for identifying inauthentic behavior.
  • Complements Bot detection by operating at the community level rather than individual account level.
  • Builds on the social network analysis literature, applying network topology to information integrity.
  • Part of the broader Computational Propaganda detection landscape.

Notes

Strengths: The use of coordination network topology as a signal for organized manipulation is novel and interpretable—clusters of synchronized accounts have different graph structure than organic communities. The paper directly addresses a forensic challenge: detecting SIO campaigns at scale using structural features alone, without requiring content analysis or sentiment. Evaluation on ground-truth state-sponsored campaigns from Twitter's disclosure archives provides genuine labeled data.

Limitations: Cross-campaign generalization (Task 2, F1=0.71) shows that coordination patterns vary enough that training on one campaign does not guarantee detection of another unseen campaign. The work is Twitter-specific; Facebook, Instagram, and other platforms have different coordination affordances. The paper does not deeply investigate which coordination types matter most (the feature importance analysis is brief), limiting understanding of what practitioners should monitor. Class imbalance in the data is addressed via sampling, but the robustness to different ratios of SIOs to non-SIOs in deployment is not explored. Finally, the paper does not address adaptive adversaries—SIO operators may modify tactics in response to known detection signatures.

Follow-ups: Investigating temporal dynamics of coordination (do campaigns ramp up before key events?) and adversarial robustness (can campaigns evade by mimicking legitimate coordination patterns?) would strengthen the approach.