## 3 Methodology
### SEBD Architecture and Framework Phases
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Hashtag**} & \multicolumn{3}{c}{**Size**} & \multirow{2}{*}{**Features**} & \multirow{2}{*}{**FNRs**} & \multirow{2}{*}{**FPRs**} \\ \cline{2-2} \cline{5-6}  & **Bot** & & & & **Human** & \\ \hline \#AEWDynamic & & & & & \\ \#ABbottElementary & 554 & 1801 & 2355 & & 0.012 & 0.044 \\ \#Mozz & & & & & & \\ \hline \#Cowboys & 1721 & 314 & 2035 & & 0.039 & 0.022 \\ \hline \#PMQs+\#Oscars2023 & 2631 & 439 & 3070 & & 0.038 & 0.004 \\ \hline \#ClimateCrisis & 1374 & 166 & 1540 & & - & - \\ \hline \#iOS16 & 1813 & 173 & 1986 & & - & - \\ \hline \#ChatGPT & 1280 & 401 & 1681 & & 0.013 & 0.004 \\ \hline \#TheLastofUs & 1738 & 234 & 1972 & & - & - \\ \hline All Hashtags & 11,345 & 3294 & 14,639 & & 0.032 & 0.025 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: PAC framework results of SEBD using epsilon = 0.05 and delta = 0.05. Figure 5: The results of other classifiers compared to RF (**A**) for group 1 hashtags and (**B**) for group 2 hashtags. The generalization error, shown in Figure 6A, represents the expected difference between the model's performance on the training data and its performance on unseen data from the same distribution. In other words, it is an estimate of how well the model will perform on new, previously unseen data. In our case, the upper bound generalization error for a sample size of 2000 was 0.160. This means that the expected difference between the model's performance on the training data and its performance on unseen data is 0.160. This can be interpreted as an estimate of the model's expected error rate of new data in the worst-case scenario. In general, SEBD is able to maintain false-positive rates and false-negative rates below epsilon and delta parameters for at least a sample size >2000, as shown in Table 7. This result of using RF is for the group 2 dataset combined and PAC parameters were: epsilon = 0.05, delta = 0.05. In other words, a sample size >2000 satisfies the PAC learning condition. Despite the different status of hashtags that were separately tested, as shown in Table 6, the overall results are good, unless the calibration set size is not met, as is the case for #climatecrisis, #thelastofus, and #iOS16. This is due to the inclusion of a lower number of these hashtags in the human class to generate random samples for training. ## 5 Conclusions

In this paper, we propose a stream-based evolving bot detection framework (SEBD). Our framework is built based on graph attention networks that integrate multiple views of fellowship links. It integrates Apache Kafka and the Twitter API to predict whether the account should be labeled as bot or human in a stream-based manner. SEBD utilizes fellowship links with few profile features to classify account types in the stream. Using few profile features to detect social bots is supported by a recent study [55]. Using such few profile features will decrease the computational costs of stream detection. It is obvious that detecting social bots in a stream-based way while evolving in hashtags is very effective. This is due to the fact that they work in an orchestrated manner as they are probably parts \begin{table}
\begin{tabular}{c c c} \hline \hline
**Sample Size** & **FNRs** & **FPRs** \\ \hline
50–2000 & [0.024, 0.038] & [0.005, 0.196] \\
2050–5000 & [0.033, 0.35] & [0.001, 0.031] \\
5050–10,000 & [0.034, 0.035] & [0.001, 0.023] \\ >10,050 & [0.034, 0.035] & [0.001, 0.021] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The sample size ranges with minimum and maximum FNRs and FPRs of group 2 dataset combined with PAC parameters. Figure 6: (**A**) The generalization error compared to empirical error and true error of group 2 dataset. (**B**) The model’s accuracy in examining the over-fitting issue in terms of the number of estimators for both training and testing scores combined using group 2 dataset. of botnets and they have similar features that make them distinguishable (see Figure 7). Recent studies support that bot accounts are very active in hashtags [56; 57; 58].