## 3 Method  
### Basic Attributes for User Profiling  
The need to assess users' credit systems or individual characteristics from multiple perspectives to avoid losses caused by malicious users has gradually evolved into user profiling technology, which is now widely applied across various industries. In the financial market, the 5 Cs of credit provide a user profiling framework used by financial institutions and other non-bank lenders to evaluate borrowers' creditworthiness and overall loan application strength. The 5 Cs consist of capacity, character, capital and collateral, and conditions [40]. The 5 Cs represent general principles used in traditional credit scoring to solve issues, and as a classic user risk evaluation system, many of its assessment criteria are applicable to the study of risky users on online social networks (OSNs). In the context of profiling malicious users on social network platforms, although highly personal information related to capital and collateral cannot be obtained from publicly accessible social data, the remaining 3 Cs--capacity, character, and conditions--can largely be verified through social data. Referring to the traditional 5 Cs credit scoring principles, the 3 Cs framework for social network user risk assessment can be summarized as follows:  
1. Capacity: Low-risk users tend to share content related to their personal life on social networks. Such content often reflects their educational background, stable financial standing, significant online influence, and long, interconnected network chains. 2. Character: Low-risk users typically act as producers rather than mere consumers of social media content. Their language style and content quality indicate traits like caution and responsibility. They demonstrate relatively healthy and consistent online activity patterns, including moderate posting frequency and appropriate post length. 3. Conditions: Low-risk users usually maintain a good physical and mental state, without recent occurrences of unfortunate events such as unemployment or illness. These conditions reduce the likelihood of extreme behavior. While IP addresses cannot directly indicate user risk, malicious users often exhibit clustering or convergence in their IP patterns. Based on the above principles, we summarize the relevant user attributes and their representative social network features in Table 1. Attributes and features that could potentially fall under two principles are only categorized under one principle. Based on the potential behavioral patterns related to user profiling and the representative social network features summarized in Table 1 according to the 3 Cs principles, we further investigate specific attributes derived from actual OSN platform data and categorize them more systematically. We mainly focus on data collected from Twitter due to its accessibility and consistency with other platforms. Guided by the 3 Cs principles, the features collected in the raw dataset are preprocessed through data cleaning, content replacement, short-text data processing, and other operations, resulting in the feature set U_low. U_low contains all fundamental input attributes for the subsequent malicious user profiling prediction model. By analyzing these features, they are categorized into three groups representing potential user behavior patterns: population attributes, tweet attributes, and social attributes (detailed in Table 2). Population attributes include basic user characteristics such as username, age, gender, and location. These attributes often influence users' perspectives on various issues. For instance, usernames can provide significant insights into behavioral styles. Tweet attributes serve as another vital source of information on social networks. Although attributes like \"tweet_vec\" may not directly correlate with malicious behavior evaluation, temporal data,