# An Attention-Based Graph Neural Network for Spam Bot Detection in Social Networks
## 1 Introduction  
In recent years, online social networks (OSNs) such as Facebook and Twitter have become ever more popular with users, and they have become convenient service platforms for people to share and communicate. While people are immersed in the convenience and freshness brought by social networks, numerous malicious behaviors generated by anomaly accounts, such as advertising, malicious links and fake news, are common on social platforms [1]. The definition of an anomaly account in this article is a spam bot. Unlike other legitimate social bots, the spam bot is a type of account that uses automated programs to spread malicious, phishing or unsolicited content in social networks. The growing number of users and the open nature of social networks make them ideal targets for automated programs (Bots) [2]. As a result, spam bots are widely used to spread spam or malicious content. Manually managing a large number of spam accounts will cause high costs, so many spammers use the Twitter API to create custom programs to automatically publish spam tweets [3]. These spam bots use automated programs to launch various attacks on social networks. For example, to spread advertisements, post tweets containing pornographic information [4],or hijack trend topics [5]. A recent study estimated that 9% to 15% of active Twitter accounts are spam bots [6]. [PERSON] et al. [7] found that 10% to 50% of the tweets generated by seven popular URL shortening services on Twitter are always bots account. The malicious interaction behaviors or spam messages being generated by such spam bots seriously affect the trust and security of social platforms. Therefore, the effective identification of these spam bots has important practical significance in the development of OSNs. Previous research on anomaly account detection has mainly focused on the detection of anomaly accounts or messages using a single feature set or simple relation structure. However, spam bots have become more advanced and complex in evading existing detection methods. Research has shown that social bots can interact with other accounts, post tweets on different topics, and display human-like activities [8]. Therefore, spam bots can use advanced intelligent methods to evade the existing anomaly detection system. For example, some spam bots release normal information most of the time, and occasionally release promotional activities, advertisements, spam, etc. Methods based on a single feature set (such as user behavior or content) have struggled to accurately detect anomaly users or events, especially spam bots. At the same time, bots have gradually evolved into swarm intelligences. The behavioral features of a single user may seem legitimate, but when multiple such users appear as a group, they will show anomaly features [8]. For example, a group of users can collaborate to post some fake comments or threatening activities on Twitter [6]. In large organizations, malicious teams or internal groups usually work closely together to achieve this malicious purpose. There are still some challenges to addressing these problems. First of all, when detecting anomaly accounts and their behaviors in social networks by simply using features such as behavior/content, it is necessary to extract these features that can effectively separate anomaly accounts and legitimate accounts. However, spam bots usually pretend to be a legitimate account to evade the detection system. They usually imitate the behavior of legitimate users, such as the number and frequency of tweets. In addition, spam bots also apply complex social engineering techniques to manipulate information; secondly, the design idea of the graph structure based on the detection system is to assume that anomaly accounts struggle to effectively connect with many legitimate accounts in social networks. However, in order to obtain higher network popularity, even legitimate users have begun to buy fake bot accounts and indirectly add these anomaly users to their relationships.