Twitter has become a viable platform for spammers, who often form networks to further their reach. Troublesomely, targeted users become increasingly frustrated, or worse, view content resulting in computer virus infection. We build on previous work around detecting spam on Twitter, proposing that subcategorising spammers can increase our understanding of their connections in spammer networks and aid detection. After defining five subcategories of spammers and classifying users accordingly, correlations between the categories of spammers and the categories of their followers and followees are explored. We also find that all spam subcategories follow a higher share of non-spam accounts than any individual spam subcategories, and, unexpectedly, that every spammer subcategory is followed by non-spammers more than by individual counterparts.
Users are not compelled to follow accounts they deem to be spam. However, the ability to quickly determine if a new follower is a spammer is useful in deciding whether to follow back. Automatic detection could save users from wasting time checking each new follower, and spare them from potentially dangerous spam. Spammers can also reach users via a mention or a direct message; in this case investigating the tweet author safeguards against spam.
Copyright c 2015 held by author(s)/owner(s); copying permitted only for private and academic purposes.
Published as part of the #Microposts2015 Workshop proceedings, available online as CEUR Vol-1395 (http://ceur-ws.org/Vol-1395) Emergent trends, which we will examine, in the distribution of an account’s followers and those they follow between the categories may increase confidence that it belongs to a particular category. Finding that one spammer is commonly connected to a particular type yields a fast way to discover accounts of that type, potentially to block or suspend. Connections between di↵erent spammer categories are not very dangerous in themselves—though could lure a user to viewing further spam accounts—but they form a potential means of detecting spammer networks.
This paper, part of an ongoing research project, lays the
groundwork for investigating the extent to which di↵erent
categories of spammers are connected to others, and to
genuine users. It establishes that these connections result from
spammers’ collusion within networks. We build on the work
of [
The Twitter API [
• advertising: users who tweet extremely frequently, mostly, if not always, advertising products, or tweets advertising a product authored by such a user. Normally the tweets contain links, often shortened using a URL shortener. • explicit : users who post exclusively, or almost so, photos, videos, and links, perhaps shortened with a URL shortener, to websites of a pornographic or adult nature, or tweets that that contain this kind of content. • follower gain: users claiming the ability to boost other users’ follower bases, frequently, in most of their tweets, asking users for retweets and to follow certain accounts. A tweet in this category claims that retweeting or following a mentioned (via @username) account will result in the receipt of followers. • celebrity: users who tweet plead relentlessly for the follow back of a public figure in their tweets. Ascertaining whether an individual tweet falls into this category is generally harder. Examining the authoring user should be indicative — ascertaining whether a suspect tweet is a unique occurrence for that user and therefore not representative. • bot : accounts whose tweets are generated by a bot that auto-posts content from some source, or details usage of an online app. Tweets that fall into this category often contain a URL, but, again, to be certain in classification the authoring account may need to be examined.
Feature representations of Twitter users can be formed, as
per previous work, using content-based and user-based
features [
Screen name and description Levenshtein similarity1 Percentage of non-alphanumeric characters in description
Mean number of new lines in the user’s tweets Relative standard deviation of the number of new lines in the user’s tweets
The Random Forest classifier implementation in the Weka
Java library [
Ten-fold cross-validation, provided through Weka, allows the classifier to be evaluated, with the collected sample of 1,420 users forming the validation set: not spam explicit advertising follower gain bot celebrity The classifier performs poorly on the class bot, most often misclassifying as advertising, so there can be no confidence in conclusions made regarding that class. The misclassification is probably due to the inherent similarity between the behaviours of spammers in each category.
For each class, given a sample of 70 contained users the tailored classifier can be used to attain the mean class percentages of followers and followees — 500 (or as many as there are) are sampled for each. Given more time and computational resources, a larger dataset could be formed. All the percentages are rounded to the nearest integer. Contingency tables are also constructed given the counts of (category, follower category) pairs and (category, followee category) pairs. These help reveal the extent to which spammers are connected to their followers and to their followees.
Possible inaccuracies in classifications detailed in Section 4 mean care should be taken in drawing conclusions, and it is unlikely all of them will be infallible. The results report that genuine users have 73% not spam followers on average, 20% higher than the not spam followers share of advertising and bot accounts. Tallying with our intuition, the fair conclusion to draw here given the classifier performance on these follower classes for not spam is that genuine users will have a noticeably higher share of not spam followers than spammers, a trait that can increase the confidence that a user classified as not spam is indeed so. With a fair degree of confidence the results show that genuine users are likely to follow back around half of their genuine followers. The reported number of followers and followees for accounts that spammers follow back is usually higher than for accounts they do not, implying that spammers target their connections to popular accounts.
The average share of not spam accounts followed across the advertising, bot, celebrity, and follower gain categories, 60%, is notably higher than that of any of the spam subcategories, showing their persistent eo↵rts to gain genuine users’ attention. However, perhaps surprisingly, on average 50% of assumed to be spam, to further increase the spam recall. a spammer’s followers are genuine users for each subcategory. Users are either consciously following spammers— perhaps advertising accounts hoping to find good deals or celebrity accounts because they are interested in the associated celebrity—or through ignorance, lacking a tool to warn them. No one spam category is a landslide winner in attaining genuine followers though.
On average, about 30% of advertising followers belong to the same category — a share much higher than any other spam subcategory. Also around 23% of the accounts followed are advertising—again, a share much higher than the other spam subcategories—suggesting a significant degree of connection between advertising accounts, confirmed later. Other subcategories appearing to have a high degree of intraconnection are explicit and celebrity. Accounts in the former have a higher share of explicit followers than any other follower subcategory, averaging at 20%, and also follow more accounts of the same subcategory than the others, with a share averaging around 42%. Accounts in the latter have a higher share of celebrity followers than the other follower subcategories, averaging at 33%. Such accounts also follow more accounts of the same subcategory than the others, with a share averaging around 42%.
However, accounts in the bot category have a higher share, averaging at 26%, of advertising followers than bot followers (averaging at only 6%) or any other subcategory of follower. Likewise the followees share is higher for advertising, averaging at 18%, than bot (averaging at only 4%) and the other subcategories. This discrepancy could be due to the categories’ inherent similarity; arguably both have the same Class advertising bot celebrity explicit follower gain not spam
Follower advertising bot not spam advertising bot not spam celebrity not spam explicit not spam follower gain not spam aim— to direct users to content—so there is incentive for them to connect with each other. As previously warned, given the categories are not definitive, advertising and bot could reasonably be merged into one category, probably reducing the classification error.
We confirm the hypothesised relationships in the
connections between spammers of the same subcategory using
Cram´er’s V correlation c [
The fairly strong positive correlations and attained percentage shares aforementioned evidence the degree of collusion between spammers, and that those in the same subcategories are deliberately connecting to form networks — notable relationships are present. Predicated on these correlations, the heat maps in Figure 2 show the strength of spammer connections. Because it is a hallmark of spam, establishing the presence of such connections aids spammer network detection and individual account classification.
When the classifier is further tested by classifying a sample of followers of users from each of the categories, the performance reported in Table 4 is worse than the cross-validation in Section 2.3, likely due to large variations in the distribution as the sample is more deterministic than the validation set. Thus in Section 3 only sound conclusions respecting these figures were drawn, but improvements made in future work could allow further conclusions regarding the connections between some of the combinations of categories not considered. A larger test sample, perhaps yielding di↵erent figures, would clearly be preferable but was not practicable given the time constraints.
This paper presents the findings of new research. By forming a training set of users and implementing a classifier tailored to the task, underpinned by Random Forest, users can be classified into the defined classes. Analysing the distribution of these classes in users’ followers and followees allows inferences to be made about the relationships between users, crucially between spammers. We observe that many genuine users are falling into the trap of connecting with a range of types of spammer.
We reveal that spammers mainly have their largest share of connections devoted to non-spammers and their second largest to spammers of the same subcategory. However there are exceptions, with some subcategories connecting with a proportionally very much smaller number of spammers from the same category. Correlations are found between spammer subcategories and their follower and followee subcategories, showing that spammers are colluding with each other in networks, with a significant degree of connection between spammers of the same category.
Establishing connections between subcategories in a large contiguous network, starting from one account and branching outwards, recursively analysing the followers and followees, could be a future extension. Visualising this network would be interesting, allowing clusters of spammers of di↵erent subcategories to be determined. Also the subcategories could usefully be refined, and perhaps more introduced.
We thank Krzysztof Jerzy Geras, School of Informatics, University of Edinburgh, for explaining to us how to find correlations, which we subsequently found and included in this paper.