Multitask Learning for Blackmarket Tweet Detection

Abstract: Online social media platforms have made the world more connected than ever before, thereby making it easier for everyone to spread their content across a wide variety of audiences. Twitter is one such popular platform where people publish tweets to spread their messages to everyone. Twitter allows users to Retweet other users' tweets in order to broadcast it to their network. The more retweets a particular tweet gets, the faster it spreads. This creates incentives for people to obtain artificial growth in the reach of their tweets by using certain blackmarket services to gain inorganic appraisals for their content. In this paper, we attempt to detect such tweets that have been posted on these blackmarket services in order to gain artificially boosted retweets. We use a multitask learning framework to leverage soft parameter sharing between a classification and a regression based task on separate inputs. This allows us to effectively detect tweets that have been posted to these blackmarket services, achieving an F1-score of 0.89 when classifying tweets as blackmarket or genuine.

Twitter is an important medium for people and companies to promote their products, ideologies, or to reach out and connect with other people in the form of micro-conversations. Twitter provides users with multiple ways of showing their support towards a tweet in the form of Likes, Retweets and Quotes. These content-level appraisals help in spreading the content further and act as a measure of users' agreement on the value of the content. The count of these content-level appraisals therefore determines the influence of a particular tweet and its author. This has led to the creation of certain blackmarket services such as FreeFollowers (https://www.freefollowers.io/), Like4Like (https://like4like.org/), YouLikeHits (https://www.youlikehits.com/), JustRetweet (http://justretweet.com), which allow users to post their tweets in order to gain inorganic appraisals in the form of Likes, Retweets and Quotes BIBREF0 , BIBREF1 .
There has been a lot of research on the detection of fraudulent activities on Twitter such as detection of bots BIBREF2 , fake followers BIBREF3 , collusive retweeters BIBREF0 , BIBREF1 , and social spam BIBREF4 . However, the problem of detecting tweets that are posted to these blackmarket services has not been tackled before. The tweets submitted to blackmarket services are not necessarily spam or promotional tweets. As we observe in our data, there is some intersection between spammers and blackmarket users since spammers may also try to gain more appraisals by using these services. However, existing spam tweet detection approaches do not work that well in identifying individual tweets as blackmarket tweets (as shown in Table TABREF29 ).
Table TABREF1 shows a sample tweet that was posted on a blackmarket service and another sample tweet that was not. In this paper, we make the first attempt to detect tweets that are posted on blackmarket services. Our aim is to build a system that can flag tweets soon after they are posted, which is why we do not consider temporal features such as the number of retweets or likes that a tweet keeps gaining over time. Instead, we only rely on the features and representations extracted from the content of the tweets.
We curate a novel dataset of tweets that have been posted to blackmarket services, and a corresponding set of tweets that haven't. We propose a multitask learning approach to combine properties from the characterization of blackmarket tweets via traditional feature extraction, with a deep learning based feature representation of the tweets. We train a neural network which takes as input both the traditional feature representation as well as the deep learning based representation generated using the Tweet2Vec model BIBREF5 , and utilizes cross-stitch units BIBREF6 to learn an optimal combination of shared and task-specific knowledge via soft parameter sharing.
We show that our multitask learning approach outperforms Twitter spam detection approaches, as well as state-of-the-art classifiers by 14.1% (in terms of F1-score), achieving an F1-score of 0.89 on our dataset. In short, the contributions of the paper are threefold: a new dataset, characterization of blackmarket tweets, and a novel multitask learning framework to detect tweets posted on blackmarket services.
Several studies have focused on detecting malicious activities such as spam, fake content and blackmarket services. Here, we mention some of these studies which we deem as pertinent to our work. We also mention the prior usage of multitask learning in a similar context.
Spam/Fake Tweet Detection: The problem of fake and spam tweets is not new. Many solutions have been proposed to tackle this problem. Yardi et al. BIBREF7 showed that the network structure of spammers and non-spammers is different, and also tracked the life cycle of endogenous Twitter content. Chen et al. BIBREF8 conducted a comprehensive evaluation of several machine learning algorithms for timely detection of spam. Fake tweets, on the other hand, are the tweets which spread misinformation. Serrano et al. BIBREF9 provided an extensive survey on fake tweet detection. Unlike spam tweets, fake tweets are mostly associated with major events, and the accounts that produce these fake contents are mostly created during these events BIBREF10 , BIBREF11 .
Blackmarket Services: Blackmarket services have recently received considerable attention due to the increase in the number of users using them. Analysis of such underground services was first documented in BIBREF12 where the authors examined the properties of social networks formed for blackmarket services. Liu et al. BIBREF13 proposed DetectVC which incorporates graph structure and the prior knowledge from the collusive followers to solve a voluntary following problem. Motoyama et al. BIBREF12 provided a detailed analysis of six underground forms, examining the properties of those social network structures that are formed and services that are being exchanged. Dutta et al. BIBREF0 investigated the customers involved in gaining fake retweets. Chetan et al. BIBREF1 proposed CoReRank, an unsupervised model and CoReRank+, a semi-supervised model which extends CoReRank to detect collusive users involved in retweeting activities.
Multitask Learning: Multitask learning is used whenever we have two or more similar tasks to optimise together. Most of the related studies on multitask learning are based on how the tasks can be better learned together. Zhang et al. BIBREF14 classified multitask learning models into five types and reported the characteristics of each approach. Cross-Stitch units were introduced by Misra et al. BIBREF6 , which can learn an optimal combination of shared and task-specific representations. Gupta et al. BIBREF15 proposed GIRNet, a unified position-sensitive multitask recurrent neural network architecture.
blackAs studied in BIBREF0 , there are two prevalent models of blackmarket services, namely premium and freemium. Premium services are only available upon payment from customers, whereas freemium services offer both paid and unpaid options. The unpaid services are available to the users when they contribute to the blackmarket by providing appraisals for other users' content. Here, we mainly concentrate on freemium services. The freemium services can be further divided into three categories: (i) social-share services (request customers to spread the content on social media), (ii) credit-based services (customers earn credits by providing appraisals, and can then use the credits earned to gain appraisals for their content), and (iii) auto-time retweet services (customers need to provide their Twitter access tokens, upon which their content is retweeted 10-20 times for each 15-minute window).
We collected data from Credit-based Freemium services because their service model is easy to understand. We crawled two blackmarket sites – YouLikeHits and Like4Like, between the period of February and April 2019. We created dummy accounts (after careful IRB approval) on these sites to participate in the platform and recorded Tweet IDs of the tweets that were posted for gaining retweets. We used Twitter's REST API to collect the tweet objects of these tweets. The timelines of the authors of these tweets were also collected, allowing us to find genuine tweets by the same users that have not been posted to these blackmarket sites.
In total, we collected INLINEFORM0 tweets posted on blackmarket sites. Out of these, we removed non-English tweets and tweets with a length of less than two characters. Finally, we were left with INLINEFORM1 blackmarket tweets. Then, from the timelines of the authors of these tweets, we randomly sampled INLINEFORM2 genuine tweets that were not posted on these blackmarket sites during the same period. Both the blackmarket and genuine tweets were also inspected manually.
To further understand the purpose of the collusive users behind the usage of blackmarket services, we annotated blackmarket tweets in our test set into a few discrete categories. The statistics of the categories are as follows: Promotional - 43.75%, Entertainment - 15.89%, Spam - 13.57%, News - 7.86%, Politics - 4.82%, and Others - 14.11%. We considered a tweet as Promotional only if the tweet attempts to promote a website/product. Most of the tweets in the Others category include personal tweets without any call to action or promotion, but this also can be considered as self-promotion. We further noticed that there were about 5% of normal tweets on concerning issues such as “pray for ...", indicating that blackmarket services are also being used for non-business purposes. 99% of tweets other than the tweets from Others class included at least one URL, and 100% of the URLs in the blackmarket tweets were shortened.
This section describes the features and tweet representation methodology, and the proposed model to solve the problem.
We use the following features based on the tweet content:
 INLINEFORM0 : Number of user mentions in the tweet
 INLINEFORM0 : Number of hashtags in the tweet
 INLINEFORM0 : Number of URLs in the tweet
 INLINEFORM0 : Count of media content in the tweet
 INLINEFORM0 : Is the tweet a reply to another tweet?
 INLINEFORM0 : Number of special characters (non alpha-numeric) in the tweet
 INLINEFORM0 : Length of the content (number of characters) in the tweet
 INLINEFORM0 : Sentiment score of the tweet obtained using SentiWordNet, ranging from -1 (negative) to +1 (positive)
 INLINEFORM0 : Number of noun words in the tweet
 INLINEFORM0 : Number of adjective words in the tweet
 INLINEFORM0 : Number of pronoun words in the tweet
 INLINEFORM0 : Number of verbs in the tweet
We use the Tweet2Vec model BIBREF5 to generate a vector-space representation of each of the tweets. Tweet2Vec is a character-level deep learning based encoder for social media posts trained on the task of predicting the associated hashtags. It considers the assumption that posts with the same hashtags should have similar representation. It uses a bi-directional Gated Recurrent Unit (Bi-GRU) for learning the tweet representation. To get the representation for a particular tweet, the model combines the final GRU states by going through a forward and backward pass over the entire sequence.
We use the pre-trained model provided by Dhingra et al. BIBREF5 , which is trained on a dataset of 2 million tweets, to get the tweet representation. This gives us a 500-dimensional representation of each tweet, based on its content.
The architecture of our model is shown in Figure FIGREF21 . We adopt multitask learning to develop our model. The primary task is set as a binary classification problem, wherein the tweets are classified as blackmarket or genuine. The secondary task is set as a regression problem, wherein the number of likes and retweets that a tweet will gain after five days of being posted is predicted.
The model takes a different input feature vector for each of the tasks.
Primary Input: The primary task takes as input the tweet content representation generated by the Tweet2Vec model, which is a 500-dimensional vector for each of the tweets, as described above.
Secondary Input: The secondary task takes as input the vector of tweet content features, which is a 12-dimensional vector, as described above.
As shown in Figure FIGREF21 , the inputs are fed into separate fully connected (FC) layers with cross-stitch units stacked between successive layers. The cross-stitch units find the best shared representations using linear combinations, and learn the optimal linear combinations for a given set of tasks. The cross-stitch units essentially allow us to unify two separate networks for two separate tasks into a single network wherein each layer of the network shares the parameters from the other network using linear combinations. The network also employs batch-normalization and dropout to avoid overfitting.
The output layer of the first task classifies tweets as blackmarket or genuine using a cross entropy loss function. The output layer of the second task predicts the numerical values for the number of retweets and likes that a tweet will gain after five days of being posted by using a Mean Squared Error (MSE) loss. Note that the performance of the secondary task is not of importance to us, however, the secondary task helps the primary task. Therefore, we focus on the performance of the model in the primary task during training and evaluation.
Since there is no prior work on blackmarket tweet detection, we chose state-of-the-art Twitter spam detection methods as baselines, along with training some state-of-the-art classifiers on the features we generated for our dataset.
Spam Detection 1: We use the Twitter spam detection method proposed by Wu et al. BIBREF4 . It uses the Word2Vec and Doc2Vec models to encode the tweets into a vector representation, which is fed to a MLP classifier in order to classify the tweets as spam or not-spam. We use the same methodology to classify tweets in our dataset as blackmarket or genuine.
Spam Detection 2: For baseline 2, we consider the approach proposed by Rajdev et. al. BIBREF11 . They proposed flat and hierarchical classifications approaches with few of the standard set of features which can classify spam, fake and legitimate tweets. We use their experimental setup with Random Forest classifier on our dataset.
We generate a combined feature vector by concatenating the tweet content features and the encoding generated by Tweet2Vec. This feature vector is then fed to state-of-the-art machine learning classifiers - Random Forest (RF), Multi-layer Perceptron (MLP), and Support Vector Machine (SVM).
We consider the problem as a binary classification problem, where the tweets are classified into two classes - blackmarket and genuine. The performance of each competing method is measured using the following metrics: Precision, Recall, and F1-score. The primary output of the multitask learning model gives us the classification result, which is what we use to evaluate our model. All hyperparameters of the models are appropriately tuned. The average results are reported after 5-fold cross-validation.
As shown in Table TABREF29 , we observe that the multitask learning based model which uses the Tweet2Vec encoding and the content features as inputs to two separate tasks outperforms all the baselines, achieving an F1-score of 0.89 for classification of tweets as Blackmarket or Genuine. The best baseline is Spam Detector 2 which achieves an F1-score of 0.77.
blackWe analyse the false negatives generated by our model to find which type of tweets the model finds difficult to classify. The percentage of each class in the false negatives is as follows: Promotional - 23.29%, Politics - 10.96%, Entertainment - 21.92%, News - 9.59%, Spam - 5.48%, and Others - 28.77%. We observe that the tweets belonging to the category Others are difficult to classify since they are similar to genuine tweets in terms of content. The results also indicate that our model is robust while classifying blackmarket tweets belonging to the following categories – News, Spam and Politics.
In this paper, we presented a novel multitask learning approach to solve the problem of identification of tweets that are submitted to blackmarket services, without the use of any temporal features. To sum up, our contributions are three-fold: (i) Characterization: We proposed 12 tweet content based features that are useful in the task of identifying blackmarket tweets, (ii) Classification: We developed a novel Multitask Learning based model to classify tweets as blackmarket tweets or genuine tweets, (iii) Dataset: We collected a dataset consisting of tweets that have been submitted to blackmarket services in order to gain inorganic appraisals.
The work was partially funded by DST (ECR/2017/00l691, DST/INT/UK/P158/2017), Ramanujan Fellowship, and the Infosys Centre of AI, IIIT-Delhi, India.

Figure and table captions:
Fig. 1. Architecture of our proposed multitask learning model for the detection of blackmarket tweets.
TABLE II PERFORMANCE OF THE COMPETING METHODS.

Questions about this paper:
How did they obtain the tweets?
What baseline do they compare to?
What language is explored in this paper?

Answers:
By crawling YouLikeHits and Like4Like sites and then using Twitter's REST API
Word2Vec and Doc2Vec to encode the tweets, then MLP classifier; Random Forest classifier on a standard set of features
English