## 3 Problem Statement  
The problem revealed in this paper is detecting and classifying each tweet whether it is spam or not. So, we have the problem of \"spam drift\", which happened because most of the researchers focus on determining the spam tweets based on the statistical features. Most of them focus on selection of features as shown in Table 1. In the real world, these features are changing in an unpredictable way over time. Therefore, we attempted to build a framework that is robust against these changes. At the beginning, we will try to prove this problem as in [29]. So, we have crawled data of tweets from Twitter Stream API for 10 consecutive days. We have to check a lot of tweets to determine which are spam. In this stage, we found that most of the spam tweets contain a URL, which most spammers use to spread their malicious content by sending the victim to mine or farm sites. Therefore, we use Trend Micro's Web Reputation Technology (WRT) to detect the tweet as spam or not based on the URL [22]. This WRT system helps users to identify the malicious sites in real-time with high reliability with an accuracy rate of 100% as reported in [30]. Moreover, we have made hundreds of manual inspections to ensure the reliability of this system. As described previously, we found that the statistical features are changing from day to day with impressive effect as shown in Table 1. For example, we found that the average number of account followings changes from the 1 st day (500-900) to the 9 th day (950-1350). This means that the spammers try to collect the followings, but the average number of followings is confused whether this account is spam or not. Therefore, to justify the problem of changing the statistical features, the distribution of the data should be modeled. There are two types of data: parametric and non-parametric. The parametric approaches are always used when the distribution of data is known as normal distribution, but the statistical features of Twitter are unknown [31; 32]. So, we used  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c c} \hline \hline  & **D-1 vs. D-2** & **D-2 vs. D-3  
the non-parametric approaches. One of the most common non-parametric approaches is the statistical test. The calculation of the statistical test is based on computing the distance between the two distributions to calculate the change between them. Distance is calculated using Kullback-Leibler (KL) divergence [31], which is also known as relative entropy, shown in Equation (1):  
\[D_{kl}(P|Q)=\sum_{i}P(i)\text{ log }\frac{P(i)}{Q(i)} \tag{1}\]  
This formula is used to measure the two probability distributions as reported in [33]. Let \(s=\{x_{1},x_{2},\dots,\ x_{n}\}\) be a multi-set from a finite set \(F\) containing numerical feature values, and \(N(x|s)\) is the number of appearances of \(x\in s\). Thus, the relative proportion of each \(x\) is shown Equation (2)  
\[P_{\text{s}}(x)=\frac{N(x|s)}{n} \tag{2}\]  
The ratio of the two variables \(P/Q\) is undefined, if we assume \(Q(i)=0\). Therefore, the estimation of \(P_{\text{s}}(x)\) is changed to Equation (3)  
\[P_{\text{s}}(x)=\frac{N(x|s)+0.5}{n+|F|/2} \tag{3}\]  
when variable \(|F|\) is defined as the number of elements in the finite set \(F\). The distance between two day's tweets, \(D1\) and \(D2\), is defined as shown in Equation (4)  
\[D(D1|D2)=\sum_{x\in F}P_{D1}(x)\text{ log }\frac{P_{D1}(x)}{P_{D2}(x)} \tag{4}\]  
We calculate the KL Divergence of spam and legitimate tweets of each feature in two adjacent days as shown in Table 1. The larger the distance, the more dissimilarity between the two distributions. So, according to the results in Table 1, the distance is large in most features in case of spam data. However, in non-spam data, the distance is very small in most of the features. According to this study, by examining the Number_of_tweet (f-6) feature from Table 1, we notice that the KL Divergence metric of spam tweets for Day 1 and Day 2 is 0.99.