## 5 AI-Based Cyber Threat Solutions in X
### Machine Learning (ML)
They employed a similar approach in their BotWalk model. By constructing vector representations of user features, BotWalk utilizes seed bots and these vectors to identify social bots on X. Seed bots are discovered using DeBot [94], and the model then expands its search to connected users to detect anomalous accounts. The dataset used for this research is publicly accessible. * **Content based** To disseminate information effectively, bots typically exhibit openness and content duplication. Ref. [95] exploited these characteristics to identify patterns of similarity and subsequently detect automated X accounts, commonly referred to as Influence bots. By analyzing tweet data, the author discovered emerging patterns among groups of accounts, positing that these patterns alone suffice to classify accounts as automated without requiring additional ground truth verification. Building on this concept, ref. [96] developed a method to detect spam bot campaigns on X by examining patterns in URL shortening services and comparing content similarity between tweets. In a subsequent study, ref. [97] designed a system capable of identifying spam bot campaigns on the X platform. The system identifies groups of accounts sharing identical tweets by monitoring top trending URLs on X's real-time stream. Accounts within these groups are flagged as potential bots if they exhibit similar recent tweeting behavior. A classifier is then employed to distinguish spam bot campaigns based on shared tweet content. Finally, the system links each identified campaign to the email address associated with the URL it promotes. Ref. [98] employed a content-based approach to identify Small- and Medium-Sized Businesses (SMBs) within the BotCamp dataset. Their model capitalized on trending topics to detect social threats campaigns focused on political discourse. By gathering trending hashtags, he model employs DeBot by [91] to identify synchronized bots that exploit popular hashtags. Subsequently, graph-based techniques are used to represent topological relationships between these bots and group them into clusters. A supervised model is then applied to categorize user interactions as either agreeing or disagreeing with specific sentiments. Ultimately, the identified clusters serve as indicators of bot-driven campaigns within political discourse. * Reinforcement Learning or Semi-Supervised learning. Reinforcement Learning is a learning technique dealing with the study of how machines and natural systems, such as humans, learn in the presence of both labelled and unlabeled data. Traditionally, learning has been studied either in the unsupervised paradigm where all data are unlabeled (e.g., clustering, outlier detection) or in the supervised paradigm where all data are labelled (e.g., classification, regression) [99]. In recent years, interest in SSL has increased, especially because of application domains in which unlabeled data such as images, text, and bioinformatics are abundant [100]. The aim of the reinforcement learning approach is to maximize the reward of each change in state by learning the best behavior to be performed in each state [55]. Ref. [101] introduced clickstream sequences as a robust feature to differentiate human users from social bots. By employing semi-supervised clustering, they leveraged the dynamic nature of clickstreamdata to unveil subtle behavioral patterns that are challenging for bots to replicate. This approach assumes that clickstream sequences encapsulate both the evolving aspects of user behavior and underlying, consistent characteristics. Leveraging the principle of homophily in social networks, ref. [102] developed SocialBotHunter, a model that detects spam bots on X by analyzing user behavior and interactions. Requiring only a seed set of labeled legitimate users, the model effectively identifies spam accounts.