# Interaction-Based Behavioral Analysis of Twitter Social Network Accounts
## 3 Data and Method
### Data Collection and Filtering
* Average Likes _(AL)_: This parameter expresses that a social media user likes the messages shared by others. It is very high for popular-active social media users, but low for observer-passive and spam-bot-malicious accounts. * Density _(DN)_: This is the ratio of current connections to the total number of possible connections in a network. This parameter helps to show the closeness of participants within a network. The closer this measurement is to 1, the more interaction participants have with each other. On the other hand, the fact that the density is close to 0 indicates a lack of communication and lack of interaction. Assuming that \(N\) is the number of nodes, \(C\) is the number of connections, and P is the number of all possible connections, the number of possible connections in the network is calculated by Equation (2) and density is found by Equation (3): \[C=\frac{N*(N-1)}{2},\] (2) \[DN=\frac{C}{P}.\] (3)
* Centralization _(CZ)_: This measures the average centralization degree of all nodes within a network. When a network has a high centralization value close to 1, this indicates that there are several central participants dominating the information flow in the network. In the networks with a low centralization measurement close to 0, it appears that information flows more freely between most participants, i.e., centralization--that expresses dependency--is very low. In dynamic networks, the dynamic centralization metric is used for calculating centralization of a node, as shown in Equation (4). In a graph such as \(G=(V,E)\), assuming \(V\) is the edge and _(s,t)_ is the shortest path for each edge pair, the fraction of shortest paths passing the peak point is determined for each edge pair. This fraction is summed at all pairs of peak points. In Equation (4), \(\sigma\)st is the sum of shortest paths between node \(s\) and node \(t\), and \(\sigma\)st(v) is the number of shortest paths passing the edge V:  
\[\text{CZ}=\sum_{s:=v:=t\text{eV}}\frac{\sigma\text{st(v)}}{\sigma\text{st}}. \tag{4}\]  
Determining the structural connection of nodes provides important information about the structural flow of the data flowing through them. Normalized degree centralization (\(\text{CZ}_{\text{ND}}\)) is calculated as shown in Equation (5):  
\[\text{CZ}_{\text{ND}}=di*(N-1). \tag{5}\]
* \(>\) and the number of all active connections is \(L\), reciprocity is calculated as shown in Equation (6): \[\text{RC}=L^{<->}/L.\] (6)  
1. Diameter (_DT_): This calculates the longest distance between two network participants. This value indicates the size of a network by calculating the number of nodes required for two users to reach each other. If the diameter increases, the domains of individuals increase and their interaction potential also increases. 2. Modularity (_MD_): This determines whether clusters represent different communities in the network. Higher values of modularity are represented by clusters and indicate net divisions between communities. In a G (\(U\), \(V\)) network, assuming \(V\) is a node and \(E\) is the edge, \(e_{ii}\) indicated in Equation (7) is the edge percentage and \(a_{i}\) indicated in Equation (8) is the percentage of edges terminated on at least one side. \(MD\) is calculated by Equation (9). \[e_{ii}=\big{|}(u,v):u\in V_{i},\ v\in V_{i},\ (u,v)\in\text{E}\big{|}/|\text{E}|,\] (7) \[a_{i}=\big{|}(u,v):u\in V_{i},\ (u,v)\in\text{E}\big{|}/|\text{E}|,\] (8) \[MD=\sum\
olimits_{i=1}^{c}\Big{(}e_{ii}-\ a_{i}^{2}\Big{)}.\] (9)  
In order to make the data set usable, various processes such as data cleaning, data integration, data reduction, and data conversion should be applied. Time series were used to extract all outlier, inconsistent and inappropriate data, and to complete missing data. In the data set, time series were applied to a sixteen-period data set and the dimension of the data was reduced to 1D. Data reduction operations were separately performed by using the simple moving average (SMA) and cumulative moving average (CMA).