Online manipulation of information has become  prevalent in recent years as  disinformation campaigns seek to  polarize political topics . While we are aware that disinformation campaigns exist, detecting their online presence is still difficult. Researchers have proposed detecting disinformation campaigns on Twitter by looking for specific coordination patterns (e.g., sharing the same hashtag in a short time frame). The problem with this approach, however, is that while the proposed coordination patterns may have been unique to the studied disinformation campaigns , the patterns have not been thoroughly validated against non-random samples or across a diverse set of campaigns. We examine the usefulness of these coordination patterns for identifying the activity of a disinformation campaign from other Twitter activity. We do this by testing the proposed coordination patterns on a large-scale dataset of ten state-attributed campaigns and various benign Twitter communitieslikely to coordinate and share information amongst themselves. We show that such patterns have significant limitations. First, coordination in Twitter communities is not uncommon, especially when the online world is reacting to real-world news (e.g., US impeachment trials). Second, due to the COVID-19 pandemic, we found that political bodies increased their coordinated activity. Such surge in coordination worsens the trade-off between usability and rateof detection. To identify most of the benign activity during the pandemic, the classifier misses nearly 25\% of disinformation activity. Conversely, if the classifier achieves a high rate of detection for malicious coordination, it misclassifies 46\% of legitimate coordinated activity. In doing this meta-analysis ,  we show that although coordination patterns could be useful for detecting disinformation activity, further analysis is needed to determine the community's intention .
Online manipulation of information has become more prevalent in recent years as state-sponsored disinformation campaigns seek to influence and polarize political topics through massive coordinated efforts. In the process, these efforts leave behind artifacts, which researchers have leveraged to analyze the tactics employed by disinformation campaigns after they are taken down. Coordination network analysis has proven helpful for learning about how disinformation campaigns operate; however, the usefulness of these forensic tools as a detection mechanism is still an open question. In this paper, we explore the use of coordination network analysis to generate features for distinguishing the activity of a disinformation campaign from legitimate Twitter activity. Doing so would provide more evidence to human analysts as they consider takedowns. We create a time series of daily coordination networks for both Twitter disinformation campaigns and legitimate Twitter communities, and train a binary classifier based on statistical features extracted from these networks. Our results show that the classifier can predict future coordinated activity of known disinformation campaigns with high accuracy (F1 = 0.98). On the more challenging task of out-of-distribution activity classification, the performance drops yet is still promising (F1 = 0.71) , mainly due to an increase in the false positive rate. By doing this analysis, we show that while coordination patterns could be useful for providing evidence of disinformation activity, further investigation is needed to improve upon this method before deployment at scale .
A
more
A
state-sponsored
A
influence and
R
. While we are aware that disinformation campaigns exist, detecting their online presence is still difficult. Researchers have proposed detecting disinformation campaigns on Twitter by looking for specific coordination patterns (e.g., sharing the same hashtag in a short time frame). The problem with this approach, however, is that while the proposed coordination patterns may have been unique to the studied disinformation campaigns , the patterns have not been thoroughly validated against non-random samples or across a diverse set of campaigns. We examine the
through massive coordinated efforts. In the process, these efforts leave behind artifacts, which researchers have leveraged to analyze the tactics employed by disinformation campaigns after they are taken down. Coordination network analysis has proven helpful for learning about how disinformation campaigns operate; however, the
R
these coordination patterns for identifying
these forensic tools as a detection mechanism is still an open question. In this paper, we explore the use of coordination network analysis to generate features for distinguishing
R
other
legitimate
R
We do this by testing the proposed coordination patterns on a large-scale dataset of ten state-attributed campaigns and various benign Twitter communitieslikely to coordinate and share information amongst themselves. We show that such patterns have significant limitations. First, coordination in Twitter communities is not uncommon, especially when the online world is reacting to real-world news (e.g., US impeachment trials). Second, due to
Doing so would provide more evidence to human analysts as they consider takedowns. We create a time series of daily coordination networks for both Twitter disinformation campaigns and legitimate Twitter communities, and train a binary classifier based on statistical features extracted from these networks. Our results show that the classifier can predict future coordinated activity of known disinformation campaigns with high accuracy (F1 = 0.98). On the more challenging task of out-of-distribution activity classification,
R
COVID-19 pandemic, we found that political bodies increased their coordinated activity. Such surge in coordination worsens the trade-off between usability and rateof detection. To identify most of the benign activity during the pandemic, the classifier misses nearly 25\% of disinformation activity. Conversely, if the classifier achieves a high rate of detection for malicious coordination, it misclassifies 46\% of legitimate coordinated activity. In doing this meta-analysis
performance drops yet is still promising (F1 = 0.71)
A
mainly due to an increase in the false positive rate. By doing this analysis,
R
although
while
R
detecting
providing evidence of
R
analysis
investigation
R
determine the community's intention
improve upon this method before deployment at scale