BotWalk

We propose BotWalk, a near-real time adaptive Twitter exploration algorithm to identify bots exhibiting novel behavior. Due to suspension pressure, Twitter bots are constantly changing their behavior to evade detection. Traditional supervised approaches to bot detection are non-adaptive and thus cannot identify novel bot behaviors. We therefore devise an unsupervised approach, which allows us to identify bots as they evolve. We characterize users with a behavioral feature vector which consists of (well-studied in isolation) metadata-, content-, temporal-, and network-based features. We identify a random bot from our seed bank, populated initially by previously-labeled bots, gather this user's followers' features from Twitter in real time, and employ an unsupervised ensemble anomaly detection method in the multi-dimensional behavioral space. These potential bots are folded into the seed bank and the process is then repeated, with the new seeds' features allowing us to adaptively identify novel bot behavior. BotWalk allows for the identification of on average 6,000 potential bots a day. Our method allowed us to detect 7,995 previously undiscovered bots from a sample of 15 seed bots with a precision of 90%.