Our Paper to CSCW 2015 on Dissecting a Social Bot

Happy New Year! I hope your year is off to a great start…

I would like to share the great news that our paper “Dissecting a Social Botnet: Growth, Content and Influence in Twitter” got accepted at The 18th ACM Conference on Computer-Supported Cooperative Work and Social Computing (CSCW 2015) which will be held March 14-18, 2015 in Vancouver, Canada.

The paper focuses on one specific social botnet in Twitter to understand how it grows over time, how the content of tweets by the social botnet differ from regular users in the same dataset, and lastly, how the social botnet may have influenced the relevant discussions. Our analysis is based on a qualitative coding for approximately 3000 tweets in Arabic and English from the Syrian social bot that was active for 35 weeks on Twitter before it was shutdown. We find that the growth, behavior and content of this particular botnet did not specifically align with common conceptions of botnets. Further we identify interesting aspects of the botnet that distinguish it from regular users.

If you are attending CSCW 15 this year and you are interested in topics around social technical platforms and automated agents please plan to attend our presentation on Tuesday the 17th of March at 10am (More information on CSCW program page). If you are not planing on attending CSCW15 please feel free to download the paper from the ACM Library and read it. Our team welcomes your questions and comments, therefore don’t hesitate to contact us.

P.S. If you dont have access to ACM Library get in touch with me to provide you a copy.

The ACM citation is

Norah Abokhodair, Daisy Yoo, and David W. McDonald. 2015. Dissecting a Social Botnet: Growth, Content and Influence in Twitter. In Proceedings of the 18th ACM Conference on Computer Supported Cooperative Work & Social Computing (CSCW ’15). ACM, New York, NY, USA, 839-851. DOI=10.1145/2675133.2675208 http://doi.acm.org/10.1145/2675133.2675208

Thank you!

On the article: The Rise of Twitter Bots : The New Yorker

I spent some time reading the article The Rise of Twitter Bots published in the New Yorker. I very much recommend reading it if the word BotNet is new to you. The author – Bob Dubbin –  spends sometime briefing the reader on what Twitter bots are and includes some anecdotes on different twitter bots and how they were developed ( This is especially  important for me because of my work with Twitter bots and the lack of academic writing on social bots) . It was eye-opening for me to learn how some of these Twitter bots get developed and then sent into the wild to spam users. In the article, Exosaurs , (which is a bot created on Twitter) was given as an example of such bots. However, there are a lot more (e.g. @everyunicode) out there that were developed to spam users by integrating available datasets. Personally, the most interesting example shown in this article was the twitter bot that praises Fox new  and includes the #PraiseFox: RealHumanPraise. The bot gained 31,000 followers in no time by real account.

It is important to realize that when bots like these might not be very harmful – other than spamming your twitter feed with a random tweet every 2 min – it could still harm or impact public opinion when used by governments in political unrest (e.g. Syrian Civil war) . Also, Bot creators are now becoming very good at developing extremely sophisticated  Bots in a way that would make the tweets sound human-like.

I am excited that the Twitter bots are being brought to surface because I am sure with the rise of twitter bots we will encounter different ways in which these Bots will be employed in non traditional ways (e.g. marketing, politics ). As I mentioned earlier, this article  is  important to me and to other researchers working in this field because of the lake of reporting in this relatively new phenomenon. Currently, I am working on what we assume to be a Political  Twitter BotNet with my team at the University of Washington.

I would like to hear from you, what did you think of the article?

 

Discovering the Twitter Botnet

In my last  blog post, I discussed our data preparation and collection. In this blog post I will start talking about 1- a brief of some of our preliminary findings 2- The discovery of the botnet in our dataset.

To recap my last two blog posts, I want to remind you that we first, collected tweets from twitter to analyze tweets from the Syrian civil war. We did that by selecting 3 violent and 3 nonviolent events, after that we conducted 2 different kinds of analyses: log analysis (from the most re-tweeted tweets based on content) and network analysis (from the high account influence on a network diagram) on the re-tweeted tweets. In the last step, we compared the top retweeted accounts (twitter handles) from the log analysis and the network analysis then we conducted a comparative analysis between the top re-tweeted accounts across the different event types (3 violent and 3 nonviolent events).

The results from these 2 different analyses were:

1- In the nonviolent events data set, people were not tweeting about the salient events we selected (3 violent and 3 nonviolent events). For example, Angelina Jolie’s visit to the Syrian refugees’ camp in Jordan on September 11, 2012, wasn’t discussed in the tweets, however, people were tweeting about war-related issues (e.g., chemical bombs), comparing 9/11 and Syria Civil War.

2- From the salient violent events, we picked Houla Massacre that occurred on 5/25/2012 and compared the authors of top most retweeted tweets from the Log Analysis and the top retweeting accounts (we identified these by looking at the node size a.k.a node centrality) in the Network Analysis. The results of our analysis showed that they were totally different (Top retweeting authors’ ≠ Top retweeting nodes)

3- We compared our findings with the Influence Matrix (Source: Klout.com) Just to better understand our results. We found that we were interested in 3 different types of Twitter users: Curators, Celebrity, and Activist.

Picture23

We were curious to know if we could find any celebrity type in the data set, someone who has both high content influence and high account influence. So we compared top retweeted nodes to the entire log analysis (450 posts), searching for any overlapping cases. We found one such user account: @g1. 

We wanted to learn more about this user’s attributes however, the account was suspended. Therefore, we started browsing the name associated to the bot, both in English and Arabic, on the Internet. We found some interesting information, however, none was related to the war. We suspected that this person might be the human user behind @g1. However, she did not have much of an online presence, which made us suspect that she is the one running her account (at that time we started suspecting that we might be dealing with a fake account of a celebrity)

In the network graph, @g1 was clustered with 19 other users, 17 of whom were suspended. Wondering what might be the reason behind this large number of account suspensions, we started following @g1 across different events in the data set.

Content Analysis

To better understand what might be the reason for suspending @g1 account we conducted a high-level content analysis on her tweets archived during the period of April to December 2012. We found that the account had stopped posting (therefore, presumably had been suspended) on November 20, 2012. Also, from our high level content analysis we discovered that most of tweets are highly political, so this wasn’t the reason for suspension by twitter.

From there, we started conducting the same analyses on the accounts clustered with @g1 across all of the six events. As a result, we identified 42 Twitter handles that had stopped posting on November 20, 2012. Interestingly, we found that the majority of these accounts got suspended on the same date, November 20, 2012. Moreover, we found that all of their last tweets were around 6:30 AM UTC indicating a systemic ban. Lastly, we discovered that they all shared the same last tweet.

Additional analyses on the data set and we discovered

  1.  21 additional accounts that had stopped posting at that time, (thus 63 accounts in total).
  2. All of the accounts were retweeting, specifically with RT, the one unique account: @h1
  3. All shared the same last retweet content.
  4. All stopped tweeting almost at the same time around 6:30 AM UTC, November 20, 2012.
  5. Each user was tweeting  continuously round the clock.

Why is this network a botnet?

What made us suspect that this might be a botnet were the following indicators:

  1. The links attached to tweets
  2. The links attached to RT
  3. The frequency of tweeting
  4. Tweet text (The 3 letter random hashtag)

An example is this tweet: “RT @h1: #سوريا #Syria لوهان ستمثّل في أغنية مصوّرة لليدي غاغا http://t.co/uv2e3OGV #xmy” (English translation: RT @h1: Lindsay Lohn to appear on Lady Gaga’s next music video #Syria ##سوريا http://t.co/uv2e3OGV #xmy).

When we searched for the sentence “Lindsay Lohan to appear on Lady Gaga’s next music video” in Arabic, we found a news headline on the website http://www.elnashrafan.com with the exact text. However, when clicking on the link, we got redirected to http://alwatan.sy.

Another example is: “#سوريا #Syria بدء امتحانات الفصل الثاني للمرحلة الجامعية الأولى في جامعة #دمشق http://t.co/OTUpaarW #dmq” (English translation: The second midterms starts for University of # Damascus #Syria #سوريا http://t.co/OTUpaarW #dmq).

The botnet was using a random 3 letter hashtag in all it’s tweets #xmy #dmq . Why were they adding this hashtag is something we still don’t know. We are assuming that this is their tracking method or reach testing technique.

Lastly, clicking on the link embedded in this tweet redirects to an article on the a new website,  which is an Arabic independent news forum.

These are the two examples of many similar incidents. Most of the tweets that were randomly tested lead to one of three websites.

Currently, we are still conducting content and network analyses to understand this botnet behavior and the motives behind its creation. One of the things we are pretty confident about is the botnet tweets were all in support of Alasad’s government and that it was followed by real people, who also supports the current Syrian regime. We asked ourselves: Was this twitter botnet created at the time when the majority of tweets on the Syrian civil war were against the regime to influence the public opinion and to amplify the voices of the people who are pro-regime, maybe?

In the meantime, stay tuned for further results of this project.

*The following and follower data was collected on March 18, 2013, not on the date of the event. For the top RT nodes, we only used data for 3 accounts because 17 accounts were suspended.)

** This project is in collaboration with Daisy Yoo and David McDonald from the iSchool at the University of Washington. Please don’t make copies of the content until you contact the blog admin.

***The twitter handles used in the post are not real they are pseudonyms created by the team.

[1]http://www.elcinema.com/person/pr1104200/

Political Bots: Who is Re-tweeting the Syrian Civil War?

syria2

This is a project that I am currently working on with David McDonald and Daisy Yoo, they are both from the iSchool. The project started last year (2012) and the main objective of the project was to understand the role of Twitter in the ongoing conflict in Syria. Moreover, we were aiming on understanding how people use the retweet function to amplify their voices during protracted political conflicts such as war. In this study, we use two metrics to measure influence: (1) content influence — the number of retweets that a piece of content is receiving; and (2) account influence — the number of retweets that an account is receiving.

That said, we had an initial hypothesis about the types of influential voices on the RT network: (a) activists, people with an idea or a cause, who have high content influence but low account influence; and (b) celebrities, who have both high content influence and high account influence. Furthermore, we assumed that activists’ influence would be based on proactive networking ability (two-way communication) while celebrities’ influence would be based on individual fame and authority (one-way communication).

Syria1

However, the findings from our data reveled other interesting findings that neither of our hypotheses explained. For example, the image below is a network analysis of all retweets (From our dataset 1) November 10, 2012 – Syrian National Council Election, and in the image you will notice that there are nodes with high centrality and low centrality on the left of the digram. You will also notice that the edges have varied thickness, compared to the right small cluster (Purple color) . The right cluster looks like they were RTing each other equally and not only on this date, but in many others.

bot net

To know more about the right cluster and what were they tweeting, please stay tuned for the next blog post where I am going to explain what we found and our next steps.

1: Preparing the Dataset will be discussed in the coming post