## 5 AI-Based Cyber Threat Solutions in X
### Machine Learning (ML)
They addressed dataset limitations by applying oversampling techniques to a small training set. Similarly, ref. [78] leveraged tweet similarity to detect social bots, assuming similar botmaster objectives and technological constraints lead to comparable tweet content. Ref. [79] employed a CNN-LSTM algorithm on tweet content and metadata to identify evasive spam bots. Given the role of bots in misinformation spread, ref. [80] proposed using topic analysis for bot detection. Their Boost OR algorithm optimized F1-score by balancing precision and recall. Notably, they introduced two publicly available labeled X datasets. Ref. [81] classified X accounts into human, bot, and cyborg using pattern recognition and a wavelet-based approach. Random Forest outperformed Multilayer Perceptron, especially in the binary human/non-human classification. Ref. [82] extended this work to distinguish between humans, legitimate bots, and malicious bots. Assuming similar patterns in spam generated by the same botmaster, ref. [83] developed an iterative model to detect X spam and spam bots based on tweet similarity and closeness to known spam. While not directly focused on bot detection, ref. [84] classified X users into person and non-person. Their first step involved using Xati [85] to identify bots based on tweet properties like inter-tweet delay, spam detection, near-duplicate tweets, Klout score, and tweeting device. Ref. [86] hypothesized that sentiment differences could distinguish humans from bots. Ref. [86] introduced sentiment-based features alongside other tweet and user characteristics. Ref. [87] also used sentiment analysis with a Contrast Pattern-Based classifier. Ref. [88] employed content and metadata information to detect social spam bots. In a different approach, ref. [89] adopted a different approach by focusing on user-names rather than user posts. They categorized usernames as either random or non-random, creating a dataset of 235,000 X accounts with random usernames, which they labeled as automated. An analysis of a 100-account sample from this dataset led them to conclude that it is accurate and diverse, making it a valuable resource for improving bot detection on social media. Some of these techniques does not require training data. They are based, as alternatives, on two fundamental assumptions. Firstly, they assume that daily traffic is the majority of network connections and that only a very small percentage of traffic is abnormal. Secondly, malicious traffic is calculated to be statistically different from regular traffic [50]. According to these two assumptions, daily traffic is typically presumed to be data groups of similar instances, although occasionally instances that differ significantly from most instances are considered to be malicious [90]. Datasets provided as machine learning input in unsupervised learning are not labelled in any way that defines the correct or incorrect outcome. Instead, the result may achieve a larger desired target, be measured on the ability to find something readily discernible by humans, or provide a nuanced application of the statistical function to obtain the intended value [55]. Similar to supervised learning articles, those employing unsupervised methods are categorized into behavior-based and content-based approaches. A review of these unsupervised techniques follows:* **Behavior based** Several models have been proposed to detect social media bots using unsupervised machine learning techniques. DeBot by [91] identifies bots based on correlated activity patterns. Assuming human users exhibit less correlated behavior over time, DeBot flags accounts tweeting frequently (at least 40 tweets/hour) with high activity correlation as potential bots. [PERSON]. [92] introduced the Digital DNA model, which analyzes the sequence of online actions to identify bot campaigns. Accounts with similar action sequences (Longest Common String) are classified as potential spam bots. Their subsequent work [93] applied this model in both supervised and unsupervised settings, favoring the latter.