Coordinated Botnet Detection in Social Networks via Clustering Analysis
Abstract
Graphs are a widely used tool in modeling social interaction networks. In a network that consists of authors and posts with time-stamped interactions between one post and one author, we can model the network as a bipartite temporal graph. These graphs are particularly useful in modeling the temporal relationships between users and pages on social media networks such as Reddit, Twitter, or Facebook. This project lays out an algorithmic framework for the identification of highly coordinated behavior in these massive networks with a three step approach and applies it at scale to real-world data from the Reddit platform. Because of the scale of this data, direct computation of group interactions for all authors in the bipartite graph is too expensive. To address this problem, the bipartite temporal graph between authors and pages is projected into a one-mode weighted graph of authors by specifying a maximum and minimum time between interactions and recording how many times each author interacted on the same page as another author in that window of time. The weight of the edge between these two authors in the projected graph is the count of these interactions; higher edge weights indicate greater potential coordination. In the second step, we query the projected graph for high edge weight triangles. This highlights triplets of authors that repeatedly interact with the same posts at the same time. Finally, after the author groups of interest have been pruned to a much smaller search space, we return to the more informative metrics considering just these authors in the bipartite graph.
Subject
BotnetCoordinated Interaction
Bipartite Temporal Graph
Spatiotemporal Analysis
Social Media Network
Graph Projection
Hypergraph
Clustering Analysis
Graph Triangles
Citation
Piercey, Preston Clent (2024). Coordinated Botnet Detection in Social Networks via Clustering Analysis. Undergraduate Research Scholars Program. Available electronically from https : / /hdl .handle .net /1969 .1 /200269.