The research aims to analyze the effectiveness of the modern machine-learning models usually used for data classification to detect anti-Ukrainian trolling tweets on Twitter. This research was conducted based on 6000 manually gathered tweets. The gathered dataset is divided into training and validation subsets of 75% and 25%, respectively. Also, it consists of 3000 proUkrainian tweets and 3000 anti-Ukrainian tweets. Specific conditions of experiments, models, performance metrics, platform, type of learning, and classification efficiency indicators are determined. SVM, Decision Tree, Multinomial Naive Bayes, and Logistic Regression models are trained using supervised machine learning on the colab research google platform. The evaluation is done by analyzing famous classification metrics, such as accuracy, precision, recall, and F1 score. Finally, the results of experiments are given, along with conclusions and practical recommendations on using machine learning models.
On 24 February 2022, Russia invaded Ukraine in a major escalation of the Russo-Ukrainian War, which began in 2014. However, Russian aggression is not limited to the battleground but includes cyberattacks and PSYOPS (Psychological Operations) in social media.
PSYOPS are operations to convey selected information and indicators to audiences to influence their emotions, motives, objective reasoning, and ultimately the behavior of governments, organizations, groups, and individuals. Today, social media platforms are perfect for performing PSYOPS via troll accounts spreading misleading information. A troll is a person who posts or makes inflammatory, insincere, digressive, extraneous, or off-topic messages online with the intent of provoking others into displaying emotional responses or manipulating others' perceptions.
Twitter is a popular social network that the Russian government widely uses to spread disinformation about the war in Ukraine, spoil the Ukrainian reputation, and convince Ukrainian allies to stop their support. Therefore, detecting and eliminating troll accounts and their fake trolling content will positively affect the security of Ukrainians and complicate the execution of PSYOPS for the aggressor.
Machine learning is one of the approaches that can be used to identify trolling content on Twitter. This research aims to gather an up-to-date dataset related to the Russia-Ukrainian war on the Twitter platform and to set up experiments in order to determine trolling content using the widely used machine learning models, evaluate the effectiveness of each model within specific conditions, and formulate recommendations on the practical application of machine learning techniques and methods to solve this type of problem.
Detecting trolling bots is not easy because anyone can post trolling content online. Currently, more
and more researchers are devoted to developing models and technologies for protecting people from
cyberbullying (trolling) [
The paper [
The analysis of the current state of this problem shows that the vast majority of research is devoted
to analyzing information on Twitter based on the use of neural networks and ML. Papers [
The development of modern representation models is no less important for the combination and
presence of cyberbullying facts estimation in e-learning and some other systems [
A study analyzing government-sponsored trolls related to the Russian troll farm found that usually trolling bots create a small portion of destructive content, such as posts or comments, and heavily spread them by retweeting and copy-pasting the same information within a specific period [27]. Existing Twitter bot detection methods can be grouped into feature-based, text-based, and graph-based methods [28].
The idea of feature-based methods is to discover features from user information and utilize machine learning classification algorithms to detect bots. Researchers extract properties from users' metadata, their follow relationships, and tweets, including various time patterns. The paper [29] presents results where researchers achieved 87% accuracy in detecting Twitter bots using different machine-learning methods on a dataset containing metadata about Twitter profiles. However, bot owners are increasingly aware of discovered features allowing others to identify bot accounts, so new bots try to imitate other behavior to evade detection. Subsequently, engineers implementing this approach for bot detection have to keep track of bot evolution to keep their models actual.
Graph-based methods treat Twitter as graphs using concepts from network science. This approach adopts neural graph networks, heterogeneous graph neural networks, and node representation learning to detect Twitter bots. For example, a group of researchers from Xi’an Jiaotong University proposed TwiBot-22, a graph-based Twitter bot detection benchmark that presents a comprehensive dataset, providing diversified entities and relations on the Twitter network. They re-implemented 35 Twitter bot detection baselines, evaluated them on nine datasets, and achieved about 80% accuracy [30].
Text-based methods utilize techniques in NLP to detect trolling bots based on tweets. Under the hood, the methods use word embeddings, recurrent neural networks, and pre-trained language models. Since trolling content is primarily textual and usually represented as a comment or a post containing hostile language, employing a linguistic and sentiment analysis is a good approach for detecting trolling content.
The paper [31] shares the results of applying domain-adaptation techniques for sentiment analysis of textual content in online forums. The researchers achieved around 70% in detecting trolls. In the paper [32], researchers evaluated the sentiments of posts and other metadata from trolling posts and were able to detect Twitter trolls more than 76% of the time. C.J. Hutto and Eric Gilbert presented VADER [33], a simple rule-based model for general sentiment analysis. Utilization of the VADER in combination with sentiment, aggression, lexical, and syntactic textual features to determine whether a tweet is meant to troll or not achieved 88% accuracy when tested with the Kaggle Twitter cyber-trolls dataset [34, 35]. Todor Mihaylov and Preslav Nakov developed two classifiers for detecting "sponsored trolls" trying to manipulate the public's opinion and another for detecting "individual trolls" trying to provoke negative emotions. They combined sentiment analysis with metadata of trolling posts (information about the publication time) and achieved 82% accuracy [36].
Consider input data, used methods and conditions for experiments and metrics to understand which model demonstrates better results. 3.1.
In this study, existing Twitter datasets with already identified trolling users and trolling tweets (e.g., the IRA troll dataset or the Dataset of Russian trolling tweets for detection of cyber-trolls [37]) were not used because they are not directory related to the context of the Russia-Ukrainian war.
The data set, which was used for the research, consists of raw new tweets and labels specifying whether a tweet is anti-Ukrainian or not. The tweets were gathered via Twitter API and filtered by one of the similar keywords: “zov”, “nazis”, “azov”, “russia is a terrorist state” or “putin war crimes” including different hashtags such “#RussiaInvadedUkraine” or “#ZOV”. Such keywords were selected to find tweets where a user wanted to deliberately create an association with one of the sides in this war. Each tweet was manually labeled as a pro-Ukrainian or an anti-Ukrainian one by the researcher. All tweets were gathered via a JS script and saved into a Comma Separated Value (CSVs) file that could be easily imported into an ML model.
The dataset contains 6000 items. There are 3000 of anti-Ukrainian tweets and 3000 of pro-Ukrainian tweets. Table 1 demonstrates two samples from the data set.
The “TweetId” column represents an id of the tweet and can be used in future research to get extra data about the tweet. “TweetId” is represented as a number containing 19 digits.
The “Text” column is a raw tweet congaing a maximum of 280 characters, and the “Label” column points to the category of the concrete sample. The “Text” can contain arbitrary characters and words, including emojis, links, or hashtags.
The dataset was split into two parts to analyze content and build the frequency distribution charts based on used words. The first part contained anti-Ukrainian tweets and the second contained proUkrainian tweets. Each tweet was split into words and filtered from stop words and non-alphabetical symbols. Figure 1 displays the distribution of the words in anti-Ukrainian tweets, and Figure 2 displays the distribution in pro-Ukrainian tweets.
It is possible to see in Figure 1 that the most popular words in anti-Ukrainian tweets are “Ukraine”, “Ukrainian”, “russian”, “Russia”, “war”, “nazi”, “NATO”, “zelensky”. In addition, these tweets contain specific for this category words, such as “zelenskywarcrime” or “ukrainenazis”.
Machine learning models are built based on feedback from evaluated performance metrics that help to understand whether a model meets requirements.
There are different metrics in the AI Industry, such as recall or precision, helping to evaluate the performance of a model. This research will use accuracy, precision, recall, and F1 metrics that are derived from the confusion matrix.
A confusion matrix (Figure 3) is a tabular structure that helps visualize the performance of classifiers. Each column in the matrix represents classified instances based on predictions, and each row of the matrix represents classified instances based on the actual class labels.
True Positive (TP) indicates the number of correct hits or predictions for our positive class. False Negative (FN) indicates the number of instances we missed for that class by predicting it falsely as the negative class.
False Positive (FP) is the number of instances we predicted wrongly as the positive class when it was not.
True Negative (TN) is the number of instances we correctly predicted as the negative class.
Accuracy is defined as the overall accuracy or proportion of correct predictions of the model, which can be depicted by the formula (1) where we have our correct predictions in the numerator divided by all the outcomes in the denominator.
+
. =
+ + +
Precision is defined as the number of predictions made that are correct or relevant out of all the predictions based on the positive class. This is also known as positive predictive value and can be depicted by the formula (2) where we have our correct predictions in the numerator for the positive class divided by all the predictions for the positive class including the false positives. (2) = .
+
Recall is defined as the number of instances of the positive class that were correctly predicted. This is also known as hit rate, coverage, or sensitivity and can be depicted by the formula (3) where we have our correct predictions for the positive class in the numerator divided by correct and missed instances for the positive class, giving us the hit rate.
+
F1 score is another accuracy measure that is computed by taking the harmonic mean of the precision and recall and can be represented by the formula (4).
2 ∗ ∗ (4) 1 = .
+ (1) (3) = .
This research will rely on NLP techniques since the primary piece of information in the dataset is raw text. NLP or Natural Language Processing is a part of computer science, human language, and artificial intelligence whose goal is to make a program capable of “understanding” the content of documents, including the contextual nuances of the language within them.
The first step is the normalization of data. Data normalization is a process consisting of steps that should be followed to wrangle, clean, and standardize textual data into a form that machine learning models could consume.
Text normalization steps: 1. Tokenization. It is the process of splitting or segmenting text from sentences into their constituent words.
2. Removing special symbols such as punctuation or emojis. 3. Expanding contractions such as “won’t” or “can’t”. 4. Case conversion. Transforming all tokens to lowercase or uppercase.
5. Removing stop words, words that have little or no significance. They are removed to retain words having maximum significance and context.
6. Stemming. It is the process of reducing a word to its stem that affixes to suffixes and prefixes or the roots of words.
7. Lemmatization.
The next step after the normalization of the text is its vectorization. Text vectorization is the process of converting text into a numerical representation. It is done since machine learning models can not understand the text as is and require the data's numeric representation. This research will use two popular vectorization methods: bag of words and normalized TF-IDF.
The bag of words model is one of the most straightforward yet powerful techniques to extract features from text documents. The essence of this model is to convert text documents into vectors such that each document is converted into a vector representing the frequency of all the distinct words present in the document vector space for that specific document.
TF-IDF stands for Term Frequency-Inverse Document Frequency, a combination of two metrics: term frequency and inverse document frequency. This technique was initially developed as a metric for ranking functions for showing search engine results based on user queries and has come to be a part of information retrieval and text feature extraction now.
The cleaned and vectorized data is forwarded as input into the model for training. This research will focus on decision trees, SVM, multinomial naive bayes, and logistic regression models to find out which of them, within specific conditions, give the best results. These models were selected since they are well-established and reliable. In addition, they are capable of drawing a line between different features in a multi-dimensional space detecting the optimal line between the trolling and non-trolling tweets.
In order to identify the best model that is preferred to be used for detecting trolling content, we will run multiple experiments using various machine-learning models that will be tested under different conditions.
For the experiments, the CoLab Research Google platform will be used. The programming language is Python since it is well-supported in CoLab. In addition, the programming language has many libraries for analyzing data and training models. All machine learning models, such as logistic regression or multinomial naive bayes and vectorization packages, will be taken from the sklearn Python package. The pandas library is required for experiments as it provides data reading and manipulation functions. The pyplot library will be used for data visualization, and nltk will be used for text preprocessing.
The experiment consists of 3 parts and is visualized in Figure 2.
The first step in the experiment is data preparation. The entire dataset containing 6000 samples and represented as a CSV file will be read using the “pandas” library. After this, column “TweetId” will be dropped since it does not give any value to models and exists only as a reference to the original tweet for extra information. As a result, the dataset containing data will consist of two columns: “Text” and “IsTrolling”. The column “Text” is represented as an arbitrary text that contains links, emojis, and stop words such as articles “the” or “a”. The column “IsTrolling” is represented as a number one or zero.
After this, it necessary to perform text normalization. It is required because it can positively affect the results of experiments.
The normalization of text consists of the following steps: ● Words tokenization, a process of splitting a sentence into separate words, which will simplify the performing of the next steps. ● Cleaning all website links using regular expressions. It is required because they do not bring meaningful information and can confuse a machine learning model for experimenting. ● Cleaning everything except alphabetical and numerical characters. ● Lemmatization, a process of grouping the inflected forms of a word so they can be analyzed as a single item. ● Stemming, a process of reducing inflected words to their word stem. ● Removing stop words.
The normalization is done using regular expressions for cleaning up text from needless data and using the “nltk” library. The “nltk” has already implemented functions for lemmatization, stemming, and removing stop words.
The second step is text vectorization. It is necessary because machine learning models can not directly work with text and need data to be represented as numbers, so vectorization is the process of converting text into numerical data. There are various algorithms of vectorization, but this research will use bag of words and normalized TF-IDF since they are the most popular and are available out of the box on the colab.
The final step is the training of models and obtaining results. Vectorized data will be split in the ratio of 75% and 25% to have training and validation sets. When the text is normalized, vectorized, and divided into training and validation chunks, ML models will be trained. For the first experiment, the support vector machine model will be used. The second experiment will use the decision tree model. The multinomial naive bayes will be used for the third one, and the last experiment will use logistic regression.
Every model will have separate experiments for bag of words and normalized TF-IDF vectorization algorithms. In addition, every model will be tested with different levels of text normalization. There will be experiments with: 1. Fully normalized text. 2. Normalization without stemming. 3. Normalization without stemming and lemming. 4. Normalization without stemming, lemming and removing stop words. 5. Normalization without stemming, lemming, removing stop words, and cleaning not alphabetical characters.
After every run of the experiment, the following metrics will be collected: accuracy, recall, precision, and F1, and saved in a separate table for analysis. As a result, it should be possible to determine what model has the better output and should be used for detecting trolling tweets.
Consider obtained results of experiments conducted under different conditions using different machine learning models, algorithms of vectorization, and different levels of text normalization. Each chapter demonstrates results for the concrete model, but with different algorithms for text vectorization and different levels of text normalization. 5.1.
After analyzing the results (metrics) listed above, it is possible to conclude that the multinomial naive bayes model provides the best result with the bag of words algorithm for text vectorization. The result of multinomial naive bayes is 89.4% in all metrics. At the same time, the worst results demonstrated the decision tree with 75.46% in all metrics using the bag of words vectorizer. The difference between the multinomial naive bayes and the decision tree is 13.94%. The worst result for the multinomial naive bayes was 87.13% with normalized TF-IDF, while the best outcome for the decision tree was 81.06% with the bag of words algorithm.
Logistic regression demonstrated 88.53% accuracy, which is second among the tested models. The logistic regression achieved this result with the bag of words vectorization algorithm and the text that was not normalized. The difference between the best and the worst result for this model is 4.47%.
The SVM model took third place and achieved 88.46%, which is only 0.07% lower than the logistic regression. This result was achieved using the normalized TF-IDF algorithm with the raw text that was not normalized. The difference between this model's best and worst results is 4%. Figure 3 visualizes discussed results and shows the difference between the best and the worst result for every model. 90 88 86 84 82 80 78 76 74 72 70
SVM
Decission tree
Multinomial naive bayes
Logistic regression
An interesting fact is that only sometimes the text normalization leads to improvement of results. Although there is no direct correlation in metrics when text normalization is done or not, overall, this practice may positively affect results. For instance, the SVM model demonstrates good results with the bag of words vectorizer and full-text normalization. However, the best result among all experiments this model gave was when the text was not normalized, and the model used the normalized TF-IDF vectorizer. Proper text normalization can improve the model's performance by 4.26%.
There is no clear performance correlation in vectorizer algorithms since different models with various levels of text normalization demonstrated different results. However, normalized TF-IDF gave better results in 3 out of 4 models with the text without normalization. The most significant difference between vectorization algorithms is 4.47%, so it is worth trying different vectorization approaches to improve metrics.
Based on the analyzed results, it is possible to recommend using the multinomial naive bayes model for detecting trolling content since it demonstrated the best result among all models. In addition, using the normalized TF-IDF vectorizer is preferred because it will most likely demonstrate a better result. Also, it is not recommended to use fully normalized text, and it is better to try different normalization levels to find that normalization level that will improve metrics.
The researchers gathered 6000 tweets during this research, where every tweet was labeled as antiUkrainian or pro-Ukrainian. The researchers selected four popular machine learning models and conducted experiments to identify which ML model is the most suitable for identifying trolling content in Tweets. The data samples were split in a 75% and 25% ratio for training and validating models. Google colab was used as the experiment environment. This platform allows utilizing a programming language called Python, which is popular in ML and Data Science and has an enormous number of libraries for machine learning.
Every model was tested under different conditions. They were tested with different algorithms of text vectorization and with different levels of text normalization. Unexpectedly text normalization only sometimes improves the performance metrics of models. For instance, the SVM model demonstrated better performance results with no normalized text among all experiments conducted for the model.
The multinomial naive bayes showed the best results for the selected tweets with completely normalized text and the bag of words vectorization algorithm. At the same time, the worst results were obtained from the decision tree in combination with the bag of words vectorization algorithm and without text normalization.
The results of the current research possibly could be used in big data methods for E-learning systems trying to optimize the learning process for teachers and students, which were described in the work [38]. The primary idea of such systems is organizing information stored in libraries with unstructured data from emerging outlets such as social media.