Influence campaigns are a growing concern in the online spaces. Policymakers, moderators and researchers have taken various routes to fight these campaigns and make online systems safer for regular users. To this end, our paper presents ALETHEIA, a system that formalizes the detection of malicious accounts (or troll accounts) used in such operations and forecasts their behaviors within social media networks. We analyze influence campaigns on Reddit and X from different countries and highlight that detection pipelines built over a graph-based representation of campaigns using a mix of topological and linguistic features offer improvement over standard interaction and user features. ALETHEIA uses state-of-the-art Graph Neural Networks (GNNs) for detecting malicious users that can scale to large networks and achieve a 3.7% F1-score improvement over standard classification with interaction features in prior work. Furthermore, ALETHEIA employs a first temporal link prediction mechanism built for influence campaigns by stacking a GNN over a Recurrent Neural Network (RNN), which can predict future troll interactions towards other trolls and regular users with an average AUC of 96.6%. ALETHEIA predicts troll-to-troll edges (TTE) and troll-to-user edges (TUE), which can help identify regular users being affected by malicious influence efforts. Overall, our results highlight the importance of utilizing the networked nature of influence operations (i.e., structural information) when predicting and detecting malicious coordinated activity in online spaces.
翻译:影响力操控行动日益成为在线空间的重大关切。政策制定者、平台管理者和研究人员已采取多种途径来对抗此类行动,为普通用户构建更安全的在线环境。为此,本文提出ALETHEIA系统,该系统将此类操作中使用的恶意账户(或称水军账户)的检测形式化,并预测其在社交媒体网络中的行为。我们分析了Reddit和X平台上来自不同国家的影响力操控行动,结果表明:基于行动图结构表示构建的检测流程(融合拓扑特征与语言特征)相较于传统的交互特征与用户特征方法具有性能提升。ALETHEIA采用先进的图神经网络(GNN)检测恶意用户,该方法可扩展至大规模网络,相比先前工作中基于交互特征的标准分类方法,F1分数提升了3.7%。此外,ALETHEIA首次构建了面向影响力操控行动的时间链路预测机制,通过在循环神经网络(RNN)上堆叠GNN,能够以96.6%的平均AUC预测未来水军账户之间以及水军与普通用户之间的交互。ALETHEIA可预测水军-水军边(TTE)与水军-用户边(TUE),这有助于识别受恶意影响力操控影响的普通用户。总体而言,我们的研究结果凸显了在预测和检测在线空间恶意协同活动时,利用影响力操控行动网络化特性(即结构信息)的重要性。