Deep learning for evolving threat detection in online social networks: a PRISMA-based systematic review

Social media platforms have become prime targets for disinformation, fake accounts, and cyberbullying. Deep learning approaches (CNN, RNN, LSTM, BERT) have demonstrated high performance in detecting these OSN threats, achieving over 90% accuracy on benchmark datasets. However, this performance is based on static, outdated data (2015–2018), while malicious actors may continuously modify their behaviors, tactics, and content in response to detection mechanisms. However, the extent to which these models remain robust under temporally evolving threat patterns is less systematically investigated. This systematic review follows the PRISMA 2020 guidelines to analyze how deep learning approaches handle (or ignore) evolving OSN threats on social media. A search of five databases (IEEE, ACM, Scopus, Springer, Google Scholar) identified 450 records. After removing duplicates and screening titles, abstracts, and full texts, 35 studies published between 2020 and 2026 were selected for in-depth qualitative analysis. The results reveal three major findings. First, hybrid and transformer-based architectures are frequently represented among the reviewed approaches, with some studies reporting accuracy values above 90% on their respective benchmark datasets. Second, the distribution of the reviewed studies is concentrated on a limited number of OSN threat types. Fake news represents 31.43% of the corpus (11/35 studies), followed by cyberbullying (25.71%, 9/35) and social bots (14.29%, 5/35). Fake accounts account for 5.71% (2/35), while the remaining threat categories each represent 2.86% of the corpus. This distribution indicates that research attention is unevenly distributed across OSN threat types. Third, and most critically, explicit temporal validation and adaptation mechanisms remain limited and heterogeneous across the reviewed studies. None of the 35 studies explicitly reported a systematic chronological train/test validation protocol. Some studies nevertheless used newer datasets or considered evolutionary characteristics, which we coded separately from temporal validation. Overall, the extent to which researchers account for threat evolution varies considerably, ranging from indirect or partial consideration to more explicit evolutionary modelling. Similarly, mechanisms that enable models to adapt to changes over time remain limited and are not consistently reported. These findings highlight a methodological gap between conventional benchmark-based evaluation and the need to assess model robustness in OSN environments that continuously evolve. We refer to this gap as the Evolution Optimization Paradox (EOP), which is used in this review as a synthesis framework rather than as a machine-learning theory. To address this gap, we propose a research agenda structured around five directions: (1) collecting recent datasets (2024–2026), (2) systematically adopting temporal validation, (3) developing adaptive models (including concept drift detection and online learning), (4) evaluating cross-platform generalization, and (5) standardizing metrics for reproducibility. This review contributes to the literature by offering a novel critical analysis of existing approaches, identifying a fundamental gap that has been overlooked, and providing a roadmap for developing robust detection systems to address the rapid evolution of online OSN threats.