Cited by 195Spam and Phishing DetectionUser Authentication and Security SystemsHate Speech and Cyberbullying Detection

DNA-Inspired Online Behavioral Modeling and Its Application to Spambot Detection

Open access
Cresci, Stefano, Di Pietro, Roberto, Petrocchi, Marinella, Spognardi, Angelo, Tesconi, Maurizio·2016·IEEE Intelligent Systems

Abstract

A novel, simple, and effective approach to modeling online user behavior extracts and analyzes digital DNA sequences from user online actions and uses Twitter as a benchmark to test the proposal. Specifically, the model obtains an incisive and compact DNA-inspired characterization of user actions. Then, standard DNA analysis techniques discriminate between genuine and spambot accounts on Twitter. An experimental campaign supports the proposal, showing its effectiveness and viability. Although Twitter spambot detection is a specific use case on a specific social media platform, the proposed methodology is platform and technology agnostic, paving the way for diverse behavioral characterization tasks.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper proposes modeling online user behavior as “digital DNA” sequences of action characters and applies DNA sequence analysis to detect Twitter spambots. It reports that DNA fingerprinting outperforms several state-of-the-art spambot detection approaches on two Twitter test sets.

Key findings

  • Digital DNA sequences encode user actions as strings; tweet type DNA (A = simple tweet, T = reply, C = retweet) better discriminated Bot2 spambots than tweet content DNA, while both showed long shared substrings for spambot groups and little to no similarity for genuine accounts.
  • In the LCS analysis, Bot1 had a group of 400 accounts with a common substring of length 774; in Test-set2, the suspicious group was 400 accounts with LCS around 1750, and in Test-set1 it was 983 accounts with LCS around 400.
  • DNA fingerprinting achieved MCC = 0.952 for Test-set1 and MCC = 0.867 for Test-set2, with Precision 0.982/1.000, Recall 0.972/0.858, Specificity 0.981/1.000, Accuracy 0.976/0.929, and F-Measure 0.977/0.923.
  • It outperformed Yang et al. (MCC 0.043/0.287), Miller et al. (MCC 0.059/−0.043), and Ahmed et al. (MCC 0.886/0.847) on the two test sets.

Methods

  • Unsupervised DNA fingerprinting: collect Twitter timeline behavioral data, extract digital DNA sequences up to 3,200 characters, compare sequences via Longest Common Substring using a linear-time generalized suffix tree algorithm, and identify steep drops in LCS curves as candidate splitting points.
  • Data: manually verified spambots and genuine accounts; 991 Bot1 accounts (50.05%) and 464 Bot2 accounts (89.29%) were certified as spambots, and 3,474 accounts that answered natural-language questions were certified as human, totaling 4,929 accounts. Bot1 retweeted an Italian political candidate; Bot2 spammed Amazon.com product URLs.
  • Evaluation: compared against supervised Yang et al. and unsupervised Miller et al. and Ahmed et al. using Precision, Recall, Specificity, Accuracy, F-Measure, and MCC; genuine accounts were randomly undersampled to match spambot group sizes for LCS comparisons.

Limitations

  • The paper states that detection used only one type of digital DNA, namely tweet type DNA, and suggests multiple DNA types could be combined in an ensemble or voting system as future work.
  • The paper notes Twitter spambot detection is a specific use case on a specific social media, though it argues the methodology is platform and technology agnostic.
  • Evident from the text: evaluation is limited to two spambot groups and Twitter timelines; splitting-point selection relies on visual/derivative analysis of LCS curves, and the approach’s reusability across other spambot behaviors is not empirically tested.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1109/mis.2016.29

Cites

11 of 11 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 8 cited sources checked · 0 supported · 0 flagged

  • Findingown data
    § B. Uncovering novel Twitter spambots · p. 5

    The supervised approach by Yang et al. [4] was unable to accurately distinguish spambots from genuine accounts, as shown by many false negatives and low recall.

    “The supervised approach by Yang et al. [4] proved unable to accurately distinguish spambots from genuine accounts, as demonstrated by the considerable number of false negatives ( FN ) and the resulting very low Recall .”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [4] [4] C. Yang, R. Harkreader, and G. Gu, 'Empirical evaluation and new design for fighting evolving twitter spammers,' Information Forensics and Security, IEEE Transactions on , vol. 8, no. 8, pp. 1280-1293, 2013. -

      Not checked in the free run.

  • Findingown data
    § A. Characterizing spambot behavior · p. 3

    In Figure 1(a), there exists a group of 400 accounts in Bot1 with a substring of length 774 in common.

    “for example, in Figure 1(a) there exists a group of 400 accounts in Bot1 with a substring of length 774 in common.”
    Quote in the paperNot a substantial claim
  • Findingreasoning
    § B. Uncovering novel Twitter spambots · p. 5

    The unsupervised approach in [8] provided unsatisfactory results.

    “Moreover, also the unsupervised approach in [8] provided unsatisfactory results.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [8] [8] Z. Miller, B. Dickinson, W. Deitrick, W. Hu, and A. H. Wang, 'Twitter spammer detection using data stream clustering,' Information Sciences , vol. 260, pp. 64-73, 2014. -

      Not checked in the free run.

  • Findingown data
    § V. CONCLUSION · p. 6

    Results show that the proposal outperforms best-of-breed algorithms commonly employed for spambot detection.

    “Results show that our proposal outperforms best-of-breed algorithms that are commonly employed for this task.”
    Quote in the paperSubstantial claim
  • Findingown data
    § A. Characterizing spambot behavior · p. 3

    Spambots present higher similarity in their digital DNA than genuine accounts.

    “From figures 1(a) and 1(b) it is clear that the LCS of both the groups of spambots are rather long even when the number of accounts grows. This is strikingly evident for Bot2 (spammers of Amazon.com products), see Figure 1(b). In contrast, genuine accounts show little to no similarity.”
    • Also stated in: § B. Digital DNA as a proxy of user online behavior · p. 2 · plain
      “We show how groups of spambots share common patterns, as opposed to groups of genuine accounts.”
    Quote in the paperSubstantial claim
  • May combine two claims. 9
  • Classified as probably not a substantial claim. 5
  • May combine two claims.

    Findingown data
    § DNA-inspired online behavioral modeling and its application to spambot detection · p. 1

    The experimental campaign supports the DNA-inspired proposal, showing its effectiveness and viability.

    “An experimental campaign supports our proposal, showing its effectiveness and viability.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § B. Uncovering novel Twitter spambots · p. 4

    In Test-set1, the LCS curve shows a continuous decrease and a sudden drop just before reaching 1,000 accounts; in Test-set2, there is a steep fall just before 400 accounts.

    “Observing Figure 2(a), we can see that there is a continuous decrease in the LCS length as the number of accounts grows, and a sudden drop occurs just before reaching the 1,000 accounts. The drop is even more evident in Figure 2(b) where there is a steep fall of the curve just before 400 accounts.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § A. Characterizing spambot behavior · p. 3

    For both spambot groups, there is a sudden drop in LCS length when k gets close to the group size, whereas the human group has an exponential decay.

    “For both the spambot groups we observe a sudden drop in LCS length when k gets close to the group size. Instead, the human group has an exponential decay and it rapidly reaches the smallest values of the LCS length.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § A. Characterizing spambot behavior · p. 3

    Tweet content DNA yields much lower LCS values than tweet type DNA; tweet type DNA models almost perfectly the high similarity of Bot2 accounts, while tweet content DNA cannot show a significant difference between genuine and bot accounts.

    “All the LCS curves have much lower values, however the biggest difference between tweet content DNA and tweet type DNA is shown for Bot2 . While tweet type DNA models almost perfectly the high similarity of Bot2 accounts, tweet content DNA is unable to show a significative difference between genuine and bot accounts.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Premisecitation
    § III. INTRODUCING DIGITAL DNA FINGERPRINTING · p. 2

    New waves of malicious accounts present different and advanced features, making their detection with existing systems extremely challenging.

    “New waves of malicious accounts present different and advanced features, making their detection with existing systems extremely challenging [4], [6].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [4] [4] C. Yang, R. Harkreader, and G. Gu, 'Empirical evaluation and new design for fighting evolving twitter spammers,' Information Forensics and Security, IEEE Transactions on , vol. 8, no. 8, pp. 1280-1293, 2013. - source

      Not checked in the free run.

    • cites [6] [6] X. Hu, J. Tang, and H. Liu, 'Online social spammer detection,' in AAAI Conference on Artificial Intelligence , 2014, pp. 59-65. - source

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data
    § B. Uncovering novel Twitter spambots · p. 5

    This result supports the initial claim that the new wave of bots is surprisingly similar to genuine accounts and exceptionally hard to detect one by one.

    “This result supports our initial claim that this new wave of bots is surprisingly similar to genuine accounts: they are exceptionally hard to detect if considered one by one.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given
    § V. CONCLUSION · p. 6

    The proposed methodology could be used in other contexts as well.

    “Finally, we also argue that the proposed methodology could be used in other contexts as well, hence paving the way for further research.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationreasoning
    § B. Uncovering novel Twitter spambots · p. 3

    Properly extracted digital DNA sequences provide evidence of similar activities in large groups, which can lead to suspect a high degree of automation for accounts behaving similarly.

    “As shown before, properly extracted digital DNA sequences provide evidence of similar activities in large groups. In turn, this can lead to suspect a high degree of automation for those accounts behaving in a similar way.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Similarity in digital DNA is a proxy for automation.
  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationcitation
    § B. Digital DNA as a proxy of user online behavior · p. 1

    Digital DNA is a flexible and compact way of modeling online user behaviors.

    “Different kinds of user behaviors can be observed on the Internet [6] and digital DNA is a flexible and compact way of modeling such behaviors.”
    • Also stated in: § B. Digital DNA as a proxy of user online behavior · p. 1 · plain
      “Similarly to its biological predecessor, digital DNA is a compact representation of information.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [6] [6] X. Hu, J. Tang, and H. Liu, 'Online social spammer detection,' in AAAI Conference on Artificial Intelligence , 2014, pp. 59-65. - source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Premisenone given
    § B. Digital DNA as a proxy of user online behavior · p. 1

    Many bioinformatics techniques developed for analyzing biological DNA can be carried over to study digital DNA.

    “Indeed, many of the techniques developed in the field of bioinformatics for the analysis of biological DNA can be carried over to study the characteristics of digital DNA as well.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim.

    Study design and conductnone given
    § A. Characterizing spambot behavior · p. 3

    To be statistically sound, groups of the same size were compared by randomly undersampling genuine accounts to match the number of spambots.

    “To be statistically sound, we compared groups of the same size by randomly undersampling genuine accounts to match the number of spambots.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning
    § B. Uncovering novel Twitter spambots · p. 6

    The DNA fingerprinting technique only exploits Twitter timeline data, does not require a training phase, and can be employed in an unsupervised fashion.

    “Instead, the DNA fingerprinting technique only exploits Twitter timeline data to perform spambots detection. Furthermore, it does not require a training phase and can be employed pretty much like a clustering algorithm, in an unsupervised fashion.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning
    § DNA-inspired online behavioral modeling and its application to spambot detection · p. 1

    The proposed methodology is platform and technology agnostic.

    “While Twitter spambot detection is a specific use case on a specific social media, our proposed methodology is platform and technology agnostic, hence paving the way for diverse behavioral characterization tasks.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Study design and conductown data
    § A. Characterizing spambot behavior · p. 3

    All accounts in the datasets underwent manual verification; 991 Bot1 and 464 Bot2 accounts were certified as spambots, and 3,474 human accounts were certified as human.

    “All the accounts of our datasets have undergone manual verification. Specifically, 50.05% (991 accounts) of Bot1 accounts and 89.29% (464 accounts) of Bot2 accounts were certified as spambots. Then, we built a dataset of human accounts by randomly contacting Twitter users and by asking them simple questions in natural language. All the 3,474 accounts that answered were certified as human.”
    Quote in the paperSubstantial claim
14 of 14
  • The authors state this as an assumption.

    Similarity in digital DNA is a proxy for automation.

    “We consider similarity as a proxy for automation and, thus, an exceptionally high level of similarity among a large group of accounts serves as a red flag for anomalous behaviors.”
  • The authors state this as an assumption.

    The suspiciously similar accounts are the ones that share the longest LCS just before the identified splitting points.

    “we assumed that the suspiciously similar accounts are the ones that share the longest LCS just before such splitting points”
  • The paper relies on this without support.

    The authors are the first to identify and adapt DNA-inspired techniques to online user behavioral modeling.

    “To the best of our knowledge, we are the first ones to identify and adapt DNA-inspired techniques to online user behavioral modeling.”
  • The paper relies on this without support.

    The definition of a unifying approach is an open challenge.

    “The definition of a unifying approach is an open challenge.”
  • The authors state this as an assumption.

    The basic assumption of digital DNA fingerprinting is to consider behaviors as sequences of actions and to characterize and detect social spambots by grouping similar sequences.

    “The basic assumption of the digital DNA fingerprinting technique is to consider behaviors as sequences of actions and to characterize and detect social spambots by grouping similar sequences.”
5 of 5

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Test-set1 detected group size differs from the results table

    Minor

    The text says 983 Test-set1 accounts were identified as suspicious, but the DNA fingerprinting row reports 963 true positives and 18 false positives, totaling 981 detected accounts.

  • Test-set2 detected group size differs from the results table

    Minor

    The text says 400 Test-set2 accounts were identified as suspicious, but the DNA fingerprinting row reports 398 true positives and no false positives, totaling 398 detected accounts.

2 of 2

Cites

Flagged first, then by citations

2 of the 13 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Authors
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M.
Affiliations
  • Institute of Informatics and Telematics (IT)
  • Technical University of Denmark (DK)
Venue
IEEE Intelligent Systems
Published
2016-09
Volume
31
Issue
5
Pages
58-64
ISSN
  • 1541-1672 (ISSN-L)
  • 1941-1294
OpenAlex
W2269924745
Cited by
194
References
13
Citations by year
2026: 14 · 2025: 15 · 2024: 20 · 2023: 32 · 2022: 19 · 2021: 21 · 2020: 34 · 2019: 18 · 2018: 12 · 2017: 8 · 2016: 1
FWCI
29.09
Type
journal article
Language
en
Open access
Locations
  • IEEE Intelligent Systems (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • CINECA IRIS Institutial research information system (University of Pisa) (submittedVersion)
  • IRIS Research product catalog (Sapienza University of Rome) (submittedVersion)
  • Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) (submittedVersion, other-oa)
  • Padua Research Archive (University of Padova) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
Keywords
Twitter, social bots, behavioral characterization

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review