Detecting Coordinated Bot Campaigns through Time-Series Anomaly Detection: A Comparative Study of GAN-Based and Reconstruction-Based Models

Technical Summary: Detecting Coordinated Bot Campaigns through Time-Series Anomaly Detection

Problem Statement
Social bots increasingly operate not as isolated entities but as coordinated campaigns, pushing messages and manipulating trends in unison. While existing detection methods effectively analyze profile metadata, post content, and social graph structures, they often treat accounts as static objects, neglecting the temporal dimension of activity. This paper addresses the gap in understanding whether the timing of an account's activity alone is sufficient to distinguish coordinated bots from genuine users. Furthermore, it seeks to determine which class of time-series anomaly detection models—specifically comparing generative adversarial approaches against reconstruction-based models—is most effective for this task.

Methodology
The study utilizes the Cresci-2017 dataset, focusing on genuine accounts as the "normal" class and social spambots as the "coordinated-bot" class. The methodology proceeds through four key stages:

1. Time-Series Reconstruction: For each account, the author reconstructs two representations from raw tweet timestamps:

   • A weekly activity profile: A 168-point vector (7 days × 24 hours) mapping tweet frequency to a normalized probability distribution.
   • A temporal feature vector: A 9-dimensional, interpretable vector capturing:
     • Posting intervals (mean, median, std dev, min).
     • Burst patterns (Goh-Barabasi burstiness coefficient and fraction of sub-60-second intervals).
     • Diurnal cycle (night-time share, Shannon entropy of hourly distribution, and coefficient of variation for daily counts).
   • Note: The study explicitly found that scoring models on the raw 168-point profile yielded sub-chance performance because coordinated bots occupied a simpler, more repetitive region of the space. Consequently, all reported results utilize the 9-dimensional feature vector, where bots appear as genuine outliers.

2. Problem Formulation: Detection is framed as an unsupervised anomaly detection problem. Models are trained exclusively on genuine accounts to learn "normal" temporal behavior. At test time, any account deviating from this norm receives a high anomaly score.

3. Model Comparison: Four detectors are compared across five independent train-test splits (60% training, 40% testing):

   • TAnoGAN-style GAN: An adversarial model using an LSTM generator and discriminator. Anomaly scores are derived via latent inversion (gradient descent to find the best latent code) and measuring residual reconstruction error.
   • LSTM Autoencoder: A recurrent encoder-decoder using reconstruction error as the anomaly score.
   • Temporal CNN (TCN) Autoencoder: A 1D convolutional autoencoder with dilated convolutions, using reconstruction error as the score.
   • Isolation Forest: A classical, non-neural baseline.

4. Coordination Verification: To verify that detected anomalies correspond to actual campaigns, the highest-scoring accounts are clustered using DBSCAN based on their 24-hour activity fingerprints. The purity of these clusters (fraction of members that are labeled bots) is measured.

Key Contributions

• Feature Engineering: The reconstruction of per-account time series from raw timestamps into a compact, interpretable set of temporal features describing intervals, burstiness, and diurnal rhythm.
• Systematic Comparison: A rigorous, unsupervised comparison of a GAN-based detector against three reconstruction-based models (LSTM, TCN, and Isolation Forest) on the specific task of coordinated bot detection.
• Negative Result Analysis: A detailed investigation into the consistent failure of the GAN-based detector on this specific domain, rather than dismissing it as an outlier.
• Pipeline Validation: The demonstration that an "anomaly detection followed by clustering" pipeline can successfully recover dense groups of coordinated bots.

Results
The study reports performance as mean and standard deviation over five independent splits, using ROC-AUC as the primary metric:

• Temporal CNN Autoencoder: Achieved the best performance with a highly stable ROC-AUC of 0.976 ± 0.002. It also led in PR-AUC (0.989) and F1 (0.973).
• Isolation Forest & LSTM Autoencoder: Performed comparably, with mean ROC-AUCs of 0.930 ± 0.012 and 0.927 ± 0.015, respectively.
• TAnoGAN-style GAN: Performed at or below chance level with a mean ROC-AUC of 0.472 ± 0.066. The model was markedly unstable, with ROC-AUC values ranging from 0.347 to 0.531 across splits. The author notes that the GAN's seemingly high F1 score (0.893) was an artifact of class balance in the test set, not true discriminative ability.

Clustering and Coordination:
When flagged accounts were clustered by daily activity, the reconstruction-based models and Isolation Forest recovered clusters with 100% bot purity. The GAN recovered clusters with 95–99% purity. These clusters contained hundreds of accounts sharing near-identical daily schedules, confirming that the temporal anomalies detected correspond to genuine coordinated behavior.

Significance and Claims
The paper claims that temporal signals alone are highly discriminative for detecting coordinated bot campaigns, achieving near-perfect separation without relying on profile, content, or network data. This is significant because timestamps are lightweight, available even when content is obscured, and difficult for operators to disguise without sacrificing automation efficiency.

Crucially, the study concludes that simpler reconstruction-based models (specifically the Temporal CNN) significantly outperform adversarial models on this task. The author attributes the GAN's failure to the low dimensionality of the input features (9 dimensions), which offers little structure for an adversarial generator to exploit, combined with the inherent instability of adversarial training and the added variance of the latent-inversion scoring step. The paper posits that on compact temporal representations, "plainer" models are not only stronger but far more dependable, challenging the assumption that more elaborate models are automatically superior.

Limitations
The author acknowledges that the study uses a balanced sample of accounts from a single dataset (Cresci-2017) and focuses only on the social spambot class. Future work is proposed to validate these findings on full datasets, include other bot classes, and test richer sequential representations that might allow adversarial models to become competitive.