## 3 Methodology  
### SEBD Architecture and Framework Phases  
Figure 1 depicts the SEBD architecture. There are three phases for the framework. The first is the data collection phase. It starts by entering a hashtag to the Twitter API. The Twitter platform has developed an application-programming interface (API) to retrieve recent and popular tweets for research and development purposes. The API will fetch the required data about users' accounts and filter the collected tweets using queries. Queries are keywords that help in retrieving the tweets of interest. From these tweets, we can collect different information regarding the owner of the tweet, the date of its creation, and any interactions that happen with it (replies, retweets, quoting, favorites, etc.) [18]. The second phase is the streaming phase. We used Apache Kafka, which is an open-source, fault tolerant, and distributed publish-subscribe messaging system for handling stream data [43]. It has been used by different popular social media platforms (Twitter and Netflix) due its scalability, manner of data distribution, and high availability [44]. The main parts of the Apache Kafka server in the streaming phase are shown in Figure 1. The collected data are sent to a Kafka topic through the Kafka producer. The producer is responsible for publishing messages to Kafka topics. A Kafka topic is considered a container for storing messages and can comprise several partitions. Consumers subscribe to different topics and consume the messages by pulling them. Zookeeper software is used to manage and synchronize the information between different brokers (Kafka servers) in the Kafka cluster. On the other hand, Kafka consumers subscribe to topics and retrieve the relevant data. In the last phase, the detection phase, we used our pre-trained model (Bot-MGAT) to predict the label of each account. These labels will be sent to another Kafka topic. A console consumer can be run on that topic to observe the labels in an online manner, as shown in Algorithm 1. Bot-MGAT is built using graph attention networks (GATs), which  
Figure 1: SEBD framework. are a form of graph neural network in which nodes are assigned varying weights on the graph's edges to reflect their relative significance. Self-attention is used to perform the weighting, which combines nodes' and neighbors' embeddings and applies a linear transformation [45]. Multiple perspectives can be taken on the same set of nodes in a multi-view graph, which is a type of relational graph (or, technically, multiple graphs with the same nodes, but different edges). Bot-MGAT is a model that performs relation-wise self-attention. This means that an attention mechanism is applied to each view of the graph and the resultant nodes' embeddings are combined to perform classification tasks [22]. We trained Bot-MGAT using Twi-Bot20 [46], a benchmark dataset that is recent and diverse. ```
#Data Collection Phase Input to Twitter API: hashtag Output user features U\({}_{\text{f}}\), follower edges U\({}_{\text{follower}}\), following edges U\({}_{\text{following}}\), follower features \(\text{feat}_{\text{follower}}\), following features \(\text{feat}_{\text{following}}\)
```  
```
1 If hashtag == 'done':  Data \(\leftarrow\) (U\({}_{\text{f}}\), U\({}_{\text{follower}}\), U\({}_{\text{following}}\), feat\({}_{\text{follower}}\), feat\({}_{\text{following}}\))

\end{table}
Table 1: SEBD Framework. For the second dataset collection (group 2), which took place on December 2022 and January 2023, we choose different scenarios to evaluate how the model was performing based on local or worldwide trends, the domain, used keywords, etc. Table 2 shows a summary of the collected hashtags based on domain. We collected data for three trending hashtags/keywords based on specific locations to compare them to worldwide trends.