Who is Tweeting on Twitter: Human, Bot, or Cyborg?

1 Who is Tweeting on twitter : human , Bot, or Cyborg? Zi Chu, Steven Gianvecchio and Haining WangDepartment of Computer ScienceThe College of William and MaryWilliamsburg, VA 23187, USA{zichu, srgian, JajodiaCenter for Secure Information SystemsGeorge Mason UniversityFairfax, VA 22030, is a new web application playing dual roles of online so-cial networking and micro-blogging. Users communicate with eachother by publishing text-based posts. The popularity and openstructure of twitter have attracted a large number of automated pro-grams, known as bots, which appear to be a double-edged sword toTwitter. Legitimate bots generate a large amount of benign tweetsdelivering news and updating feeds, while malicious bots spreadspam or malicious contents. More interestingly, in the middle be-tween human and bot, there has emerged cyborg referred to eitherbot-assisted human or human -assisted bot.}

2 To assist human users inidentifying who they are interacting with, this paper focuses on theclassification of human , bot and cyborg accounts on twitter . Wefirst conduct a set of large-scale measurements with a collection ofover 500,000 accounts. We observe the difference among Human, bot and cyborg in terms of Tweeting behavior, tweet content, andaccount properties. Based on the measurement results, we proposea classification system that includes the following four parts: (1)an entropy-based component, (2) a machine-learning-based com-ponent, (3) an account properties component, and (4) a decisionmaker. It uses the combination of features extracted from an un-known user to determine the likelihood of being a human , bot orcyborg. Our experimental evaluation demonstrates the efficacy ofthe proposed classification and Subject [Computer-Communication Networks]: General Secu-rity and ProtectionGeneral TermsSecurityKeywordsAutomatic Identification, Bot, Cyborg, Twitter1.

3 INTRODUCTIONT witter is a popular online social networking and micro-bloggingtool, which was released in 2006. Remarkable simplicity is its dis-tinctive feature. Its community interacts via publishing text-basedposts, known astweets. The tweet size is limited to 140 charac-ters. Hashtag, namely words or phrases prefixed with a # symbol,Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a 10 Dec. 6-10, 2010, Austin, Texas USAC opyright 2010 ACM 978-1-4503-0133-6/10/12.

4 $ group tweets by topic. For example, #Haiti and #Super Bowlare the two trending hashtags on twitter in January 2010. Symbol@ followed by a username in a tweet enables the direct deliveryof the tweet to that user. Unlike most online social networkingsites ( , Facebook and MySpace), twitter s user relationship isdirected and consists of two ends, friend and follower. In the casewhere the user A adds B as a friend, A is afollowerof B while Bis afriendof A. In twitter terms, A follows B. B can also add A ashis friend (namely, following back or returning the follow), but isnot required. From the standpoint of information flow, tweets flowfrom the source (author) to subscribers (followers). More specifi-cally, when a user posts tweets, these tweets are displayed on boththe author s homepage and those of his 2009, twitter has gained increasing popularity.

5 As re-ported in June 2010, twitter is attracting 190 million visitors permonth and generating 65 million Tweets per day [30]. It ranks the12th on the top 500 site list according to Alexa [5]. In November2009, twitter emphasized its value as a news and information net-work by changing the question above the tweet input dialog boxfrom What are you doing to What s happening . To some ex-tent, twitter is in the transition from a personal micro-bloggingsite to an information publish venue. Many traditional industrieshave used twitter as a new media channel. We have witnessed suc-cessful twitter applications in business promotion [1], customerservice [3], political campaigning [2], and emergency communica-tion [21,35].The growing user population and open nature of twitter havemade itself an ideal target of exploitation from automated programs,known as bots.

6 Like existing bots in other web applications ( , In-ternet chat [14], blogs [34] and online games [13]), bots have beencommon on twitter . twitter does not inspect strictly on automa-tion. It only requires the recognition of a CAPTCHA image duringregistration. After gaining the login information, a bot can performmost human tasks by calling twitter APIs. More interestingly, inthe middle between humans and bots have emerged cyborgs , whichrefer to either bot-assisted humans or human -assisted bots. Cy-borgs have become common on twitter . After a human registersan account, he may set automated programs ( , RSS feed/blogwidgets) to post tweets during his absence. From time to time, heparticipates to tweet and interact with friends. cyborgs interweavecharacteristics of both humans and is a double-edged sword to twitter .

7 On one hand,legitimate bots generate a large volume of benign tweets, like newsand blog updates. This complies with the twitter s goal of becom-ing a news and information network. On the other hand, maliciousbots have been greatly exploited by spammers to spread spam ormalicious contents. These bots randomly add users as their friends,expecting a few users to follow back1. In this way, spam tweetsposted by bots display on users homepages. Enticed by the appeal-ing text content, some users may click on links and get redirectedto spam or malicious sites2. If human users are surrounded by ma-1 Some advanced bots target potential users by keyword to the tweet size limit, it is very common to use link short-ening service on twitter , which converts an original link to a shortone ( , ). The link illegibility favors bots to21licious bots and spam tweets, their twittering experience deterio-rates, and eventually the whole twitter community will be objective of this paper is to characterize the automation featureof twitter accounts, and to classify them into three categories, hu-man, bot, and cyborg, accordingly.

8 This will help twitter managethe community better and help human users recognize who they aretweeting the paper, we first conduct a series of measurements to char-acterize the differences among human , bot, and cyborg in termsof Tweeting behavior, tweet content, and account properties. Bycrawling twitter , we collect over 500,000 users and more than 40million tweets posted by them. Then we perform a detailed dataanalysis, and find a set of useful features to classify users into thethree classes. Based on the measurement results, we propose anautomated classification system that consists of four major compo-nents: (1) the entropy component uses Tweeting interval as a mea-sure of behavior complexity, and detects the periodic and regulartiming that is an indicator of automation; (2) the machine-learningcomponent uses tweet content to check whether text patterns con-tain spam or not3; (3) the account properties component employsuseful account properties, such as Tweeting device makeup, URLration, to detect deviations from normal; (4) the decision maker isbased on Linear Discriminant Analysis (LDA), and it uses the linearcombination of the features generated by the above three compo-nents to categorize an unknown user as human , bot or cyborg.

9 Wevalidate the efficacy of the classification system through our testdataset. We further apply the system to classify the entire datasetof over 500,000 users collected, and speculate the current compo-sition of twitter user population based on our classification remainder of this paper is organized as follows. Section 2covers related work on twitter and online social networks. Section3 details our measurements on twitter . Section 4 describes ourautomatic classification system on twitter . Section 5 presents ourexperimental results on classification of humans, bots, and cyborgson twitter . Finally, Section 6 concludes the RELATED WORKT witter has been widely used since 2006, and there are somerelated literature in twittering [24, 25, 43]. To better understandmicro-blogging usage and communities, Java et al.

10 [24] studiedover 70,000 twitter users and categorized their posts into four maingroups daily chatter ( , going out for dinner"), conversations,sharing information or URLs, and reporting news and further clas-sified their roles by link structure into three main groups informationsource, friends, and information seeker. Their work also studied(1) the growth of twitter , showing a linear growth rate; (2) its net-work properties, showing the evidence that the network is scale-free like other social networks [27]; and (3) the geographical dis-tribution of its users, showing that most twitter users are from theUS, Europe, and Japan. Krishnamurthy et al. [25] studied a groupof over 100,000 twitter users and classified their roles by follower-to-following ratios into three groups: (1) broadcasters, which havea large number of followers; (2) acquaintances, which have aboutthe same number on either followers or following; and (3) miscre-ants and evangelists ( , spammers), which follow a large numberof other users but have few followers.