RTbust: Exploiting Temporal Patterns for Botnet Detection on Twitter
Abstract
Within OSNs, many of our supposedly online friends may instead be fake accounts called social bots, part of large groups that purposely re-share targeted content. Here, we study retweeting behaviors on Twitter, with the ultimate goal of detecting retweeting social bots.We collect a dataset of 10M retweets. We design a novel visualization that we leverage to highlight benign and malicious patterns of retweeting activity. In this way, we uncover a ?normal" retweeting pattern that is peculiar of human-operated accounts, and suspicious patterns related to bot activities. Then, we propose a bot detection technique that stems from the previous exploration of retweeting behaviors. Our technique, called Retweet-Buster (RTbust), leverages unsupervised feature extraction and clustering. An LSTM autoencoder converts the retweet time series into compact and informative latent feature vectors, which are then clustered with a hierarchical density-based algorithm. Accounts belonging to large clusters characterized by malicious retweeting patterns are labeled as bots. RTbust obtains excellent detection results, with F1=0.87, whereas competitors achieve F1?0.76.Finally, we apply RTbust to a large dataset of retweets, uncovering 2 previously unknown active botnets with hundreds of accounts.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
These observations conform with previous observations by Cresci et al. about anomalous retweeting behaviors.
“These observations conform with the previous observations made by Cresci et al., where they observed several anomalous retweeting behaviors, including one in which a user retweets a large number of another user's tweets in a short time [30].”
From Unsupervised detection of coordinated fake-follower campaigns on social media (2024) · cites this paper as [30]
Our method finds the same patterns by looking at the retweeted user, uncovering all anomalous retweeters of that user, whereas RTBust looked at individual retweeters.
“While RTBust looked at individual retweeters, our method finds the same patterns by looking at the retweeted user, therefore uncovering all the anomalous retweeters of that user.”
From Unsupervised detection of coordinated fake-follower campaigns on social media (2024) · cites this paper as [30]
Cites
Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation
Powers, D. M. W. (2020) · arXiv · doi:10.48550/arxiv.2010.16061 · Cited by 5,440 · see citing works
A few useful things to know about machine learning
Domingos, P. (2012) · Communications of the ACM · doi:10.1145/2347736.2347755 · Cited by 3,326 · see citing works
Density-Based Clustering Based on Hierarchical Density Estimates
Campello, R. J. G. B., Moulavi, D., & Sander, J. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-37456-2_14 · Cited by 2,680 · see citing works
Fast Kd-Trees for the Kullback-Leibler Divergence and Other Decomposable Bregman Divergences
Pham, T., & Wagner, H. (2025) · Leibniz international proceedings in informatics · doi:10.4230/lipics.wads.2025.45 · Cited by 2,353 · see citing works
Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016) · Communications of the ACM · doi:10.1145/2818717 · Cited by 1,973 · see citing works
BotOrNot: A System to Evaluate Social Bots
Davis, C. A., Varol, O., Ferrara, E., Flammini, A., & Menczer, F. (2016) · Proceedings of the 25th International Conference Companion on World Wide Web - WWW 16 Companion · doi:10.1145/2872518.2889302 · Cited by 909 · see citing works
A Survey of Methods for Explaining Black Box Models
Guidotti, R., Monreale, A., Ruggieri, S., Turini, F., Giannotti, F., & Pedreschi, D. (2019) · ACM Computing Surveys · doi:10.1145/3236009 · Cited by 629 · see citing works
Fame for sale: Efficient detection of fake Twitter followers
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2015) · Decision Support Systems · doi:10.1016/j.dss.2015.09.003 · Cited by 461 · cited 1× · see citing works
“The classes of features exploited by the detection technique have a strong impact on both the performances of the detector as well as its efficiency [6].”
BackgroundSelf-citationThe Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Proceedings of the 26th International Conference on World Wide Web Companion - WWW '17 Companion · doi:10.1145/3041021.3055135 · Cited by 381 · see citing works
Self-citationTwitter spammer detection using data stream clustering
Miller, Z., Dickinson, B., Deitrick, W., Hu, W., & Wang, A. H. (2014) · Information Sciences · doi:10.1016/j.ins.2013.11.016 · Cited by 332 · see citing works
DeBot: Twitter Bot Detection via Warped Correlation
Chavoshi, N., Hamooni, H., & Mueen, A. (2016) · 2016 IEEE 16th International Conference on Data Mining (ICDM) · doi:10.1109/icdm.2016.0096 · Cited by 260 · see citing works
The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race
Cresci, S., Pietro, R. D., Petrocchi, M., Spognardi, A., & Tesconi, M. (2017) · Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) · doi:10.48550/arxiv.1701.03017 · Cited by 237 · see citing works
Self-citationRelational autoencoder for feature extraction
Meng, Q., Catchpoole, D., Skillicom, D., & Kennedy, P. (2017) · UTS ePRESS (University of Technology Sydney) · Cited by 218 · see citing works
Robust Online Time Series Prediction with Recurrent Neural Networks
Guo, T., Zhao, X., Yao, X., Chen, H., Aberer, K., & Funaya, K. (2016) · IEEE International Conference on Data Science and Advanced Analytics (DSAA) · doi:10.1109/dsaa.2016.92 · Cited by 179 · see citing works
Quantifying Information Overload in Social Media and Its Impact on Social Contagions
Gomez-Rodriguez, M., Gummadi, K. P., & Schölkopf, B. (2014) · Proceedings of the International AAAI Conference on Web and Social Media · doi:10.1609/icwsm.v8i1.14549 · Cited by 177 · see citing works
Variational encoding of complex dynamics
Hernández, C. X., Wayment-Steele, H. K., Sultan, M. M., Husic, B. E., & Pande, V. S. (2018) · Physical review. E · doi:10.1103/physreve.97.062412 · Cited by 176 · see citing works
Savage, S., Monroy‐Hernández, A., & Höllerer, T. (2016) · ACM Conference on Computer Supported Cooperative Work (CSCW) · doi:10.1145/2818048.2819985 · Cited by 120 · see citing works
Classification of Twitter Accounts into Automated Agents and Human Users
Gilani, Z., Kochmar, E., & Crowcroft, J. (2017) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1145/3110025.3110091 · Cited by 102 · see citing works
Catching Synchronized Behaviors in Large Networks: A Graph Mining Approach
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S. (2016) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2746403 · Cited by 88 · see citing works
Early filtering of ephemeral malicious accounts on Twitter
Lee, S., & Kim, J. K. (2014) · Computer Communications · doi:10.1016/j.comcom.2014.08.006 · Cited by 75 · see citing works
Liu, S., Hooi, B., & Faloutsos, C. (2017) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3132847.3133018 · Cited by 74 · see citing works
Retweeting Activity on Twitter: Signs of Deception
Γιάτσογλου, Μ., Chatzakou, D., Shah, N., Faloutsos, C., & Vakali, A. I. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-18038-0_10 · Cited by 49 · see citing works
Inferring lockstep behavior from connectivity pattern in large graphs
Jiang, M., Cui, P., Beutel, A., Faloutsos, C., & Yang, S. (2016) · Knowledge and Information Systems · doi:10.1007/s10115-015-0883-y · Cited by 43 · see citing works
Avvenuti, M., Bellomo, S., Cresci, S., Polla, M. N. L., & Tesconi, M. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3041021.3051155 · Cited by 42 · see citing works
Self-citationA Contrast Metric for Fraud Detection in Rich Graphs
Liu, S., Hooi, B., & Faloutsos, C. (2018) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2018.2876531 · Cited by 36 · see citing works
Almaatouq, A., Alabdulkareem, A., Nouh, M., Shmueli, E., Alsaleh, M., Singh, V. K., Alarifi, A., Alfaris, A., & Pentland, A. (2014) · ACM Web Science Conference (WebSci) · doi:10.1145/2615569.2615688 · Cited by 32 · see citing works
Revealing and Detecting Malicious Retweeter Groups
Vo, N., Lee, K., Cao, C., Tran, T., & Choi, H. (2017) · IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM) · doi:10.1145/3110025.3110068 · Cited by 30 · see citing works
Gupta, S. K., Kumaraguru, P., & Chakraborty, T. (2019) · Joint International Conference on Data Science & Management of Data (CODS-COMAD) · doi:10.1145/3297001.3297009 · Cited by 16 · see citing works
A Typology of Socialbots (Abbrev.)
Maus, G. (2017) · ACM Web Science Conference (WebSci) · doi:10.1145/3091478.3098860 · Cited by 8 · see citing works
Kater, C., & Jäschke, R. (2016) · doi:10.1145/2915368.2915370 · Cited by 4 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450 · see citing works
Explainable Artificial Intelligence in CyberSecurity: A Survey
Capuano, N., Fenza, G., Loia, V., & Stanzione, C. (2022) · IEEE Access · doi:10.1109/access.2022.3204171 · Cited by 330 · see citing works
“1339 In [189], the authors point out one of their proposal’s main 1340 cons, the framework’s non-Explainability.”
BackgroundA decade of social bot detection
Cresci, S. (2020) · Communications of the ACM · doi:10.1145/3409116 · Cited by 323 · see citing works
“Distance between accounts time series was computed as a warp-correlation coefficient based on dynamic time warping [2], or as the Euclidean distance between the feature vectors computed by an LSTM autoencoder [23], a type of deep neural network that is particularly suitable for extracting latent features from sequenti…”
MethodSelf-citationThe False positive problem of automatic bot detection in social science research
Rauchfleisch, A., & Kaiser, J. (2020) · PLOS ONE · doi:10.1371/journal.pone.0241045 · Cited by 184 · see citing works
Charting the Landscape of Online Cryptocurrency Manipulation
Nizzoli, L., Tardelli, S., Avvenuti, M., Cresci, S., Tesconi, M., & Ferrara, E. (2020) · IEEE Access · doi:10.1109/access.2020.3003370 · Cited by 132 · see citing works
Self-citationKalakoti, R., Bahsi, H., & Nõmm, S. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3360626 · Cited by 93 · see citing works
Emergent properties, models, and laws of behavioral similarities within groups of twitter users
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2020) · Computer Communications · doi:10.1016/j.comcom.2019.10.019 · Cited by 40 · see citing works
Self-citationA language framework for modeling social media account behavior
Nwala, A. C., Flammini, A., & Menczer, F. (2023) · EPJ Data Science · doi:10.1140/epjds/s13688-023-00410-9 · Cited by 21 · see citing works
Unsupervised detection of coordinated fake-follower campaigns on social media
Zouzou, Y., & Varol, O. (2024) · EPJ Data Science · doi:10.1140/epjds/s13688-024-00499-6 · Cited by 19 · see citing works
- Authors
- Mazza, M., Cresci, S., Avvenuti, M., Quattrociocchi, W., & Tesconi, M.
- Affiliations
- Institute of Informatics and Telematics (IT)
- University of Pisa (IT)
- Ca' Foscari University of Venice (IT)
- Venue
- Proceedings of the 10th ACM Conference on Web Science
- Publisher
- ACM
- Published
- 2019-06-26
- Pages
- 183-192
- OpenAlex
- W2963806301
- Cited by
- 163
- References
- 30
- Citations by year
- 2026: 11 · 2025: 23 · 2024: 21 · 2023: 29 · 2022: 21 · 2021: 27 · 2020: 27 · 2019: 4
- FWCI
- 15.73
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Web Science Conference (WebSci) (publishedVersion)
- CINECA IRIS Institutial research information system (University of Pisa) (submittedVersion)
- IRIS Research product catalog (Sapienza University of Rome) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Physical Sciences › Physics and Astronomy › Statistical and Nonlinear Physics › Complex Network Analysis Techniques
- Keywords
- social bots, bot detection, retweeting behavior, Twitter, LSTM autoencoder, unsupervised clustering, density-based clustering, botnets, social networking sites
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
