Setting the clock: Evaluating temporal window parameters for coordinated behavior detection

Authors: Georgios Panayiotou, Lorenzo Mannoccci, Maurizio Tesconi

Venue: AIDEM Workshop, ECML-PKDD 2026 — arXiv 2609.21959

TL;DR

The paper systematically evaluates how temporal window parameters (length and stride) affect detection of coordinated communities in co-repost networks. Using 14 labeled information operation datasets, the authors find that window length is a central modeling parameter: short windows (seconds to minutes) detect tight, highly synchronized coordination; longer windows (hours to days) reveal slower, diffuse coordination patterns; window overlap has negligible effect on detection quality. These findings suggest temporal windowing choices directly determine which coordination scales become observable.

Contributions

1. First empirical analysis of temporal window parameters in coordinated behavior detection: systematically tests window lengths from 1 second to 1 day and stride overlaps (0%, 20%, 50%) across 14 real information operation campaigns.

2. Quantitative evidence that window length is a key modeling choice: demonstrates that window length substantially affects both community structure and the precision/recall tradeoff for recovering known coordinated actors.

3. Window stride has minimal impact: shows that overlapping windows (50% overlap) do not consistently improve detection over adjacent non-overlapping windows, despite higher computational cost.

4. Complementary metrics capture different coordination signals: IO precision (fraction of community members that are known coordinated actors) and community cohesion (frequency of repeated co-actions within detected groups) are largely decoupled, revealing that a high-precision group may exhibit low behavioral intensity and vice versa.

Method

The paper models coordinated behavior through co-actions: two accounts are connected when they perform the same action (e.g., retweet) on the same content within a shared temporal window. The method:

1. Constructs temporal co-repost networks by partitioning activity into consecutive temporal windows of length \(t_c\) and stride \(t_s\). Each window \(i\) produces a graph \(G_i\) where accounts are nodes and edges represent co-reposts within that window.

2. Flattens consecutive temporal layers: for each pair of consecutive layers \((G_i, G_{i+1})\), creates a merged graph \(G_{i,i+1}\) that captures co-posting spanning window boundaries—important for tightly-timed coordination that might otherwise be split across windows.

3. Applies community detection (Louvain algorithm) to each flattened graph to identify coordinated communities.

4. Evaluates against labeled information operation data: computes structural metrics (number of communities, relative community size, intra-community cohesion) and agreement metrics (IO precision, IO recall) relative to known coordinated actors in 14 ground-truth IO datasets.

Results

Effect of window length on community structure (Table 1): - Number of detected communities increases with window length (longer windows capture more repost actions, creating more coordination links). - Relative community size remains stable as windows grow, suggesting window length changes the granularity of detected coordination without collapsing all communities into a single giant component. - Cohesion (intra-community co-repost weight) increases with window length, as longer periods provide more opportunities for repeated co-actions.

Effect of window length on IO precision (Figure 1): - Short windows (1–15 minutes) achieve high precision (0.6–1.0) on campaigns with frequent, synchronous coordination (e.g., egypt_use, ghana_nigeria), but low activity rates when few accounts co-post rapidly. - Longer windows (1–6 hours) show more moderate and stable precision (0.2–0.8), capturing slower coordination but at cost of mixing in non-coordinated accounts sharing popular content. - Precision-recall tradeoff: small windows isolate tight, known-coordinated groups; large windows broaden membership but dilute signal with organic users.

Effect of window stride on detection performance (Figure 2): - Varying stride from 0% to 50% overlap produces only small variations in IO precision and recall (typically <0.05 difference). - No consistent improvement from overlapping windows. The paper concludes that window overlap does not substantially reduce boundary effects between adjacent windows.

IO precision and cohesion capture different signals (Figure 3): - For egypt_use (1-minute window): very high IO precision (~0.95) but low cohesion (~0.2), indicating known coordinated actors appear in the same detected community but rarely co-repost the same content repeatedly. - For china-1 (1-hour window): low precision (~0.2) but cohesion peaks mid-window, suggesting high behavioral synchrony among non-known actors. - Interpretation: precision measures whether coordinated actors cluster together; cohesion measures behavioral intensity. These are complementary rather than redundant.

Connections

• A Decade of Social Bot Detection — Decade-long review of bot and coordination detection evolution; emphasizes shift from individual to group-level detection.
• A Survey on Computational Propaganda Detection — Survey of propaganda and coordinated campaign detection using network and temporal methods.
• It takes a village to manipulate the media: coordinated link sharing behavior — Foundational work detecting coordinated link-sharing on Facebook; establishes temporal proximity as a core coordination signal.
• Disinformation Warfare: Understanding State-Sponsored Trolls on Twitter and — Empirical study of state-sponsored information operations; demonstrates temporal clustering of coordinated accounts.
• Rumor Detection Temporal — Related work on temporal dynamics in rumor propagation and verification.
• Network Dynamics — Broader topic on how networks evolve and reveal patterns over time.

Notes

Strengths: - Addresses a practical and long-overlooked methodological question: the choice of temporal window is usually treated as an implementation detail, but this work demonstrates it is a substantive modeling choice that changes the observable coordination patterns. - Ground-truth evaluation against labeled IO datasets is rare and valuable; provides empirical evidence rather than pure theory. - Clear presentation of complementary metrics (precision vs. cohesion) that can be misinterpreted as contradicting signals.

Limitations and open questions: - Single co-action modality: analysis focuses only on retweets. Real coordinated campaigns exploit multiple modalities (shared URLs, hashtags, mentions, comments). Generalization to multimodal co-actions is an important next step. - Community detection method fixed: uses Louvain algorithm; unclear whether findings generalize to other community detection approaches (e.g., Leiden, spectral clustering, flow-based methods). - Flattening of temporal layers: the paper flattens consecutive layer pairs to reduce boundary effects, but this design choice is not systematically ablated. Other temporal aggregation strategies might yield different results. - Computational cost of overlapping windows: while overlap does not improve quality, computational cost grows linearly; the paper mentions this but does not explore adaptive windowing or efficient approximations. - Platform-specific behavior: evaluation focuses on Twitter/X retweet networks. Social media-specific properties (e.g., timeline decay, retweet cascades) may make findings less portable to other platforms (Facebook, TikTok) or offline coordination.

Future work: - Test findings on multimodal coordination networks (URLs, hashtags, mentions). - Compare alternative community detection algorithms to determine whether temporal window effects generalize. - Explore adaptive window lengths that respond to observed activity rates or known event timing. - Investigate whether temporal window length affects robustness to adversarial obfuscation (e.g., deliberate desynchronization of coordinated accounts).