CoChat
Sign Up
Cited by 19Spam and Phishing DetectionMisinformation and Its ImpactsComplex Network Analysis Techniques

Unsupervised detection of coordinated fake-follower campaigns on social media

Open access
Zouzou, Yasser, Varol, Onur·2024·EPJ Data Science
DOI 10.1140/epjds/s13688-024-00499-6
Open this paper in CoChat — free accountOpen PDF

Abstract

Automated social media accounts, known as bots, are increasingly recognized as key tools for manipulative online activities. These activities can stem from coordination among several accounts and these automated campaigns can manipulate social network structure by following other accounts, amplifying their content, and posting messages to spam online discourse. In this study, we present a novel unsupervised detection method designed to target a specific category of malicious accounts designed to manipulate user metrics such as online popularity. Our framework identifies anomalous following patterns among all the followers of a social media account. Through the analysis of a large number of accounts on the Twitter platform (rebranded as X after the acquisition of Elon Musk), we demonstrated that irregular following patterns are prevalent and are indicative of automated fake accounts. Notably, we found that these detected groups of anomalous followers exhibited consistent behavior across multiple accounts. This observation, combined with the computational efficiency of our proposed approach, makes it a valuable tool for investigating large-scale coordinated manipulation campaigns on social media platforms.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper proposes an unsupervised Sliding Histogram (SH) method to detect coordinated fake followers by finding dense batches of accounts with similar creation dates that follow a target consecutively in a follower map. Applied to 1,318 Turkish political/media Twitter accounts, it identifies anomalous follower groups that behave coordinately across accounts.

Key findings

  • On synthetic Dribbble data (2,834 users; 55 permutations), SH outperformed four feature-based anomaly detectors; e.g., at window W101 SH achieved AUC 0.87 (0.15), AP 0.71 (0.23), P@50 0.72 (0.39), vs best feature-based ECOD AUC 0.70 (0.21), AP 0.29 (0.13), P@50 0.21 (0.19).
  • On Twitter data with inserted synthetic anomalies, SH achieved average AUC 0.91 and average precision 0.61.
  • Manual annotation of anomalous accounts: annotator accuracy 0.93 and 0.98; inter-annotator agreement 87% percent agreement and Cohen’s Kappa 0.735.
  • Detected anomalous followers followed 13 accounts almost simultaneously, all between 2014 and 2016; SH assigned significantly higher anomaly scores in 10 of 13 cases. Also found retweeting anomalies: one user retweeted >300 tweets of another in <12 minutes, and one retweeted the same tweet up to 41 times.

Methods

  • Follower map plots followers by follow rank (x) and account creation date (y); follow times estimated using Meeder et al. method. SH slides a window along the rank axis, bins creation dates, computes median/IQR of follower counts across windows, and assigns anomaly scores to bins/followers.
  • Synthetic dataset: Dribbble followers of 2,834 users (follower counts 1,000–110,000), with two synthetic anomalous follower types and 55 permutations, yielding 55×2,834 datasets. Compared SH against Isolation Forest, LOF, ECOD, Gen2Out with engineered features.
  • Real dataset: 1,318 Turkish politicians/media outlets from #Secim2023 (follower counts 1,000–20 million); applied SH with window size 200; validated via manual annotation and network/community analysis of shared anomalous followers.

Limitations

  • Paper-stated: main limitation is higher false negatives when the ratio of anomalous followers is high; SH will not assign right scores when an account’s followers are dominated by anomalous followers.
  • Paper-stated: validating anomalous accounts in real-world datasets is challenging; false positives in synthetic Twitter experiments are probably real-world anomalous followers.
  • Evident from text: no labeled dataset of anomalous followers as defined; method selection used synthetic Dribbble data, and real Twitter validation relies on manual annotation and qualitative checks rather than ground-truth labels.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1140/epjds/s13688-024-00499-6

Cites

64 of 64 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

12 of 24 cited sources checked · 7 supported · 0 flagged · accuracy not yet measured

  • Premisecitation

    Accounts created on similar dates and following users successively are more likely to be automated.

    “While coordination in account activity does not necessarily coincide with automation [36,37], accounts created on similar dates and following users successively are more likely to be automated [3,48].”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites [3] Bellutta D, Carley KM (2023) Investigating coordinated account creation using burst detection and network analysis. J Big Data 10(1):1–17 source

      The Results section (‘Bot activity’; page unavailable) reports that account-creation burst days had a higher proportion of accounts classified as bots, supporting the similar-creation-dates part. The paper does not establish that accounts following users successively are more likely to be automated; its discussion of accounts following candidates in ‘Related work > Account creation bursts’ does not make that finding. (LLM, conf=0.88)

      Experimental — accuracy not yet measured
    • cites [48] Varol O, Uluturk I (2020) Journalists on Twitter: self-branding, audiences, and involvement of bots. J Comput Soc Sci 3(1):83–101 source
  • Findingown data

    Anomalous accounts show significant similarities in content-sharing behavior.

    “we examined the behavioral similarities between accounts during annotation as described in the literature [12] and noticed significant similarities in the content-sharing behavior of anomalous accounts”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [12] Cresci S, Di Pietro R, Petrocchi M, et al. (2017) The paradigm-shift of social spambots: evidence, theories, and tools for the arms race. In: Proceedings of the 26th international conference on world wide web companion, pp 963–972 source
  • Premisecitation

    Supervised methods' reliance on labeled datasets limits their ability to generalize to unseen types of bots.

    “The reliance of supervised methods on labeled datasets limits their ability to generalize to unseen types of bots [16].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [16] Echeverrìa J, De Cristofaro E, Kourtellis N (2018) LOBO: evaluation of generalization deficiencies in Twitter bot classifiers. In: Proceedings of the 34th annual computer security applications conference, pp 137–146 source
  • Findingown data

    Irregular following patterns are prevalent among the followers of Twitter accounts.

    “we demonstrated that irregular following patterns are prevalent and are indicative of automated fake accounts.”
    Quote in the paperSubstantial claim
  • Findingown data

    Detected groups of anomalous followers exhibited consistent behavior across multiple accounts.

    “Notably, we found that these detected groups of anomalous followers exhibited consistent behavior across multiple accounts.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. 14
  • May combine two claims. 16
  • The quote only partly states this claim. 1

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Automated accounts (bots) have been widely used on Twitter to efficiently spread disinformation.

    “To efficiently spread disinformation, automated accounts, known as bots, have been widely used on Twitter [10,17].”
    Quote in the paperNot a substantial claim2 of 2 sources checked
    • cites [10] Cresci S (2020) A decade of social bot detection. Commun ACM 63(10):72–83 source

      THE SOCIAL BOT PANDEMIC (p. 3) describes substantial bot presence on Twitter and their use in strategic information operations, including studies reporting increased disinformation spread. It also says bots did not always have a real impact and that studies disagree about their effect, so the claim’s unqualified implication that they efficiently spread disinformation overstates the source. (LLM, conf=0.84)

      Experimental — accuracy not yet measured
    • cites [17] Ferrara E, Varol O, Davis C, et al. (2016) The rise of social bots. Commun ACM 59(7):96–104 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Coordination in account activity does not necessarily coincide with automation.

    “While coordination in account activity does not necessarily coincide with automation [36,37], accounts created on similar dates and following users successively are more likely to be automated [3,48].”
    Quote in the paperNot a substantial claim2 of 2 sources checked
    • cites [36] Nizzoli L, Tardelli S, Avvenuti M, et al. (2021) Coordinated behavior on social media in 2019 UK general election. In: Proceedings of the international AAAI conference on web and social media, pp 443–454 source
    • cites [37] Pacheco D, Hui PM, Torres-Lugo C, et al. (2021) Uncovering coordinated networks on social media: methods and case studies. In: Proceedings of the international AAAI conference on web and social media, pp 455–466 source

  • May combine two claims.

    Premisecitation

    Bots are maliciously used on social media platforms to spread disinformation and manipulate user popularity and engagement metrics.

    “However, bots are also maliciously used on social media platforms to spread disinformation and manipulate user popularity and engagement metrics [6,39,48].”
    Quote in the paperSubstantial claim2 of 3 sources checked
    • cites [6] Bruno M, Lambiotte R, Saracco F (2022) Brexit and bots: characterizing the behaviour of automated accounts on Twitter during the uk election. EPJ Data Sci 11(1):17 source

      The Introduction describes malicious bot activity and says bots can increase users’ visibility and credibility. Results > Bots statistics reports that bots mainly retweeted genuine accounts, apparently to increase their visibility. The paper also discusses disinformation campaigns involving automated users, but these passages do not establish manipulation of user popularity and engagement metrics specifically. (LLM, conf=0.82)

      Experimental — accuracy not yet measured
    • cites [39] Shao C, Ciampaglia GL, Varol O, et al. (2018) The spread of low-credibility content by social bots. Nat Commun 9(1):1–9 source

      The Introduction and Discussion report that bots spread low-credibility content and amplify its reach. Results > Bot strategies describes bots creating the appearance that content is widely shared, and Results > Bot impact reports increased human engagement. These passages do not establish that bots manipulate users’ own popularity or engagement metrics. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites [48] Varol O, Uluturk I (2020) Journalists on Twitter: self-branding, audiences, and involvement of bots. J Comput Soc Sci 3(1):83–101 source

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation

    Accounts created in bursts in short periods exhibited similar behavior amongst themselves and were more likely to be bots.

    “A recent study on coordinated online influence campaigns indicated that accounts created in bursts in short periods exhibited similar behavior amongst themselves and were more likely to be bots [3].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [3] Bellutta D, Carley KM (2023) Investigating coordinated account creation using burst detection and network analysis. J Big Data 10(1):1–17 source

  • May combine two claims.

    Premisecitation

    BotometerLite only uses features extractable from account information, making it applicable to our dataset.

    “The BotometerLite only uses features that can be extracted from the account information, making it applicable to our dataset.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [51] Yang KC, Varol O, Hui PM, et al. (2020) Scalable and generalizable social bot detection through data selection. In: Proceedings of the AAAI conference on artificial intelligence, pp 1096–1103 source

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Premisecitation

    Detecting coordinated disinformation campaigns on social media platforms has become crucial in recent years.

    “Detecting coordinated disinformation campaigns on social media platforms has become crucial in recent years [52].”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [52] Zhang Y, Sharma K, Liu Y (2023) Capturing cross-platform interaction for identifying coordinated accounts of misinformation campaigns. In: European conference on information retrieval. Springer, Berlin, pp 694–702 source

      The Introduction and Research Question discusses digital browsing and information seeking, not coordinated disinformation campaigns. Searches for coordinated disinformation and social-media misinformation returned no passage addressing the claim in our copy. (LLM, conf=0.75)

      Experimental — accuracy not yet measured

  • May combine two claims.

    Findingown data

    In anomalous zones of the follower map, batches of follower accounts are created on similar dates and follow the user consecutively.

    “In the anomalous zones of the map (highlighted in orange), we see batches of follower accounts created on similar dates and following the user consecutively.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Cases were detected of a single user retweeting large numbers of tweets of the same user consecutively, including a user that retweeted more than 300 tweets of another user in less than 12 minutes.

    “Using this approach, we were able to detect cases of a single user retweeting large numbers of tweets of the same user consecutively, including a user that retweeted more than 300 tweets of a another user in less than 12 minutes.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    0 accounts are followed by anomalous followers of user A and 12 accounts are followed by anomalous followers of user B.

    “We found 0 accounts followed by the anomalous followers of user A and 12 accounts followed by the anomalous followers of user B.”
    Quote in the paperSubstantial claim

  • May combine two claims. The quote only partly states this claim.

    Findingown data

    Our model achieved an average AUC score of 0.91 and an average precision of 0.61 on the Twitter dataset with synthetic data.

    “Despite these limitations, our model achieved an average AUC score of 0.91 and an average precision of 0.61.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    Inter-annotator agreement scores were 87% for percent agreement and 0.735 for Cohen's Kappa.

    “Their inter-annotator agreement scores were 87% for percent agreement and 0.735 for Cohen's Kappa score.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    In anomalous zones, the upper boundary remains horizontal and then returns to its original slope after the anomalous follower batch.

    “In these anomalous zones, the upper boundary remains horizontal and then returns to its original slope after the anomalous follower batch, suggesting that this group followed the user within a short time.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    These results are comparable to the experimental results obtained from the Dribbble dataset.

    “These results are comparable to the experimental results obtained from Dribbble dataset.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Many anomalous accounts share the same tweets and share many of their friends.

    “We observed that many of these accounts share the same tweets and share many of their friends.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    One user would retweet the same tweet multiple times (up to 41 times in one case).

    “Additionally, we found another interesting behavior where one user would retweet the same tweet multiple times (up to 41 times in one case).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    47% of all Twitter accounts following US Senators before the 2018 elections were created within six months in 2017.

    “Another study showed that 47% of all Twitter accounts following US Senators before the 2018 elections were created within six months in 2017; 41% percent of these accounts never posted any tweets and had an average of 1.7 followers and 99 friends [41].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [41] Takacs R, McCulloh I (2019) Dormant bots in social media: Twitter and the 2018 us senate election. In: Proceedings of the 2019 IEEE/ACM international conference on advances in social networks analysis and mining, pp 796–800 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Twitter accounts following US Senators before the 2018 elections had an average of 1.7 followers and 99 friends.

    “Another study showed that 47% of all Twitter accounts following US Senators before the 2018 elections were created within six months in 2017; 41% percent of these accounts never posted any tweets and had an average of 1.7 followers and 99 friends [41].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [41] Takacs R, McCulloh I (2019) Dormant bots in social media: Twitter and the 2018 us senate election. In: Proceedings of the 2019 IEEE/ACM international conference on advances in social networks analysis and mining, pp 796–800 source

  • May combine two claims.

    Premisecitation

    Fake accounts sold in bulk as fake followers tend to have similar creation dates and follow the target user successively.

    “Furthermore, a New York Times investigation that tracked fake accounts sold in bulk as fake followers showed that these accounts tend to have similar creation dates and follow the target user successively [9].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [9] Confessore N, Dance GJ, Harris R, et al (2018) The follower factory. https://www.nytimes.com/interactive/2018/01/27/technology/social-media-bots.html [Online; accessed 04-December-2018]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    There is no reason for accounts created on similar dates to follow the same users simultaneously.

    “However, there is no reason for accounts created on similar dates to follow the same users simultaneously.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    41% of the Twitter accounts following US Senators before the 2018 elections never posted any tweets.

    “Another study showed that 47% of all Twitter accounts following US Senators before the 2018 elections were created within six months in 2017; 41% percent of these accounts never posted any tweets and had an average of 1.7 followers and 99 friends [41].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [41] Takacs R, McCulloh I (2019) Dormant bots in social media: Twitter and the 2018 us senate election. In: Proceedings of the 2019 IEEE/ACM international conference on advances in social networks analysis and mining, pp 796–800 source

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Detecting this type of behavior allows for understanding coordinated activities and disinformation-spreading campaigns that may have happened earlier on Twitter.

    “Furthermore, detecting this type of behavior allows for understanding coordinated activities and disinformation-spreading campaigns that may have happened earlier on Twitter.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationcitation

    These observations conform with previous observations by Cresci et al. about anomalous retweeting behaviors.

    “These observations conform with the previous observations made by Cresci et al., where they observed several anomalous retweeting behaviors, including one in which a user retweets a large number of another user's tweets in a short time [30].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [30] Mazza M, Cresci S, Avvenuti M, et al. (2019) Rtbust: exploiting temporal patterns for botnet detection on Twitter. In: Proceedings of the 10th ACM conference on web science, pp 183–192 source

  • May combine two claims.

    Interpretationown data

    Anomalous followers are automated accounts managed from one place.

    “Moreover, we showed that batches of anomalous followers tend to follow Twitter accounts almost simultaneously, suggesting that they are automated accounts managed from one place.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Our method finds the same patterns by looking at the retweeted user, uncovering all anomalous retweeters of that user, whereas RTBust looked at individual retweeters.

    “While RTBust looked at individual retweeters, our method finds the same patterns by looking at the retweeted user, therefore uncovering all the anomalous retweeters of that user.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [30] Mazza M, Cresci S, Avvenuti M, et al. (2019) Rtbust: exploiting temporal patterns for botnet detection on Twitter. In: Proceedings of the 10th ACM conference on web science, pp 183–192 source

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisereasoning

    Unsupervised detection methods do not require labeled datasets and are therefore not susceptible to the limitations of supervised methods that originate from biases in the available labeled datasets.

    “Unsupervised detection methods do not require labeled datasets and are therefore not susceptible to the limitations of supervised methods that originate from biases in the available labeled datasets.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductown data

    The approach was tested by sampling followers to simulate imperfect data collections and the model can still identify groups of anomalies.

    “We also tested our approach by sam-pling followers to simulate different scenarios of imperfect data collections and our model can still identify groups of anomalies as we presented in robustness analysis section on SI-Sect. 4 (Additional file 1).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    The false positives encountered in experiments on the Twitter dataset are probably real-world anomalous followers.

    “The false positives we encountered in these experiments are probably real-world anomalous followers.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Turkish politicians on Twitter have anomalous followers.

  • May combine two claims.

    Interpretationreasoning

    Platforms like Mastodon provide similar information about accounts and the proposed approach can be applied to these platforms.

    “Other than Twitter, platforms like Mastodon provides similar information about accounts and our proposed approach can be applied to these platforms.”
    Quote in the paperNot a substantial claim
28 of 28

  • The paper relies on this without support.

    Turkish politicians on Twitter have anomalous followers.

    “Although we know that Turkish politicians on Twitter have anomalous followers, we still conducted an experiment by inserting synthetic data on this dataset.”

  • The paper relies on this without support.

    The Dribbble platform is less susceptible to having fake followers.

    “We chose the Dribbble platform for two reasons: (i) As a professional network for designers, it is less susceptible to having fake followers (ii) Follower data collected from Dribbble includes following times, which allowed us to validate the follow-time estimation method [31] that we used in our analyses in the second part of the study.”
2 of 2

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Figure 3 caption gives a different panel for profile statistics

    Minor

    The results text identifies panels (d) and (h) as showing the profile-statistic distributions, while the Figure 3 caption identifies panels (d) and (e).

1 of 1

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Zouzou, Y., & Varol, O.
Affiliations
Sabancı Üniversitesi (TR)
Corresponding author
Varol, Onur
ORCID
Varol, Onur
Venue
EPJ Data Science
Publisher
Springer Science and Business Media LLC
Published
2024-10-07
Volume
13
Issue
1
ISSN
2193-1127 (ISSN-L)
DOI
10.1140/epjds/s13688-024-00499-6
OpenAlex
W4403187512
Semantic Scholar
79666999d24e499dfc8b6221f80b98797fa81b74
Cited by
19
References
45
Citations by year
2026: 12 · 2025: 5 · 2024: 2
FWCI
7.96
Type
journal article
Language
en
Open access
Licence
Locations
  • EPJ Data Science (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
Scientific and Technological Research Council of Türkiye (121C220, 222N311)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
  • Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
Keywords
bot detection, fake accounts, unsupervised anomaly detection, social media manipulation, online popularity, Twitter, X platform

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review