# An Anomaly Detection Framework for Twitter Data
## 3 Social Media Data Analysis and Anomaly Detection
### Clustering Using K-Means
The tweet was treated as an anomaly tweet if the tweet had a lower cosine value than the average cosine value. The new framework selected all anomalous tweets to form and analyze the clusters. Subsequently, it created two clusters, cluster 0 and cluster 1, for those tweets. Both groups had some keywords related to the COVID-19 vaccine, Pfizer, Covaxin, Covishield, India, Sputnik, and vaccination. Based on both the groups, all the tweets were related to coronavirus and vaccination; hence, the type of disaster was analyzed. Figure 7 shows the consecutive terms of cluster 0, and Figure 8 illustrates the most frequent words of coronavirus tweets. depicted in Figure 9. The results were calculated by calculating the F1 score, precision, recall, and accuracy using Equations (10)-(13). The results show that the new framework detected anomalous data with 70% accuracy. Table 8 shows five sample tweets from the Russia-Ukraine tweet dataset with location and date of tweet. The retrieved tweets have different fields, namely, tweet_text, tweet_created_at, tweet_retweet, tweet_like, and tweet_location. \[Sensitivity\ or\ Recall=\frac{2532}{2532+583}=0.8128. \tag{10}\]  
\[Precision=\frac{2532}{2532+1961}=0.5635 \tag{11}\]  
\[F1\ Score=\frac{2(0.5635+0.8128)}{0.5635+0.8128}=0.665 \tag{12}\]  
\[Accuracy=\frac{2532+3459}{2532+1961+583+3459}=0.7019 \tag{13}\]  
The average cosine similarity was 0.4435 for the considered dataset. The cosine similarity of each tweet was compared with the average cosine similarity. The tweet was treated as a normal tweet if the tweet had a greater cosine value than the average cosine value. The new framework selected all the anomalous tweets and created two clusters, cluster 0 and cluster 1, for this dataset. Some keywords related to this are Russia, Ukraine, killed, conflict, country, project, military, and NATO in both groups. Based on both the groups, all the tweets were related to the Russia-Ukraine war, thereby identifying the type of incident. Figure 10 shows the consecutive terms of cluster 0 and Figure 11 for cluster 1 for case study 2. \begin{table}
\begin{tabular}{|c|c|c|c|} \hline \hline \multicolumn{2}{|c|}{**Tweets**} & \multicolumn{2}{c|}{**Location**} & \multicolumn{1}{c|}{**Created on**} \\ \hline \multicolumn{2}{|c|}{Russians remind me of the dynamic between dogs when one is obviously} & Russia & 01 June 2022 \\ \multicolumn{2}{|c|}{kinda dumb and goofy.} & & \\ \hline Iraq and Afghanistan were thousands of km away. Afghanistan and Iraq were defeated militarily very quickly, it was the insurgency that was the problem. & Belgium & 02 June 2022 \\ \hline \multicolumn{2}{|c|}{news project good whitepaper also clear hope project successful future also} & Russia & 28 March 2022 \\ \multicolumn{2}{|c|}{hope community grow even bigger} & & \\ \hline [PERSON] was impeached for taking congressionally-approved taxpayer money & US & 01 June 2022 \\ \multicolumn{2}{|c|}{and extorting Ukraine} & & \\ \hline amazing sexy quiet heartwarming cool really good rapper love way bare face & US & 24 April 2022 \\ \multicolumn{2}{|c|}{way walk rapping savage man look funny fineeeeeyou like basketball like} & & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Sample tweets (Russia-Ukraine Tweet Dataset) with the corresponding location and date. Figure 9: Confusion matrix of case study Russia Ukraine Tweet Dataset. Table 9 shows call, precision, F1 score, and accuracy of case studies 1 and 2. Results show that the new framework detected anomalous data with high accuracy for the case studies.