Identifying and predicting hostile influence operations
- Temporal analysis. “We observe that Russian trolls are continuously active on Twitter between January, 2016 and September, 2017, with a peak of activity just before the second US presidential debate (October 9, 2016).”
- Account creation. “Next, we examine the dates when the state sponsored accounts infiltrated Twitter, by looking at the account creation dates.”
- Client. “We analyse the clients used to post tweets. We do so since previous work  shows that the client used by official or professional accounts are quite different that the ones used by regular users. The top 10 clients used by Russian trolls and baseline users differ: the latter prefer to use Twitter clients for mobile devices (48%) and the TweetDeck dashboard (32%), whereas, the former mainly use the Web client (50%).”
- Location. “We then study users’ location, relying on the selfreported location field in their profiles. Note that users not only may leave it empty, but also change it any time they like, so we look at locations for each tweet. We observe that most of the tweets from Russian trolls come from locations within the USA and Russia, and some from European countries, like Germany, Belgium, and Italy. Whereas, tweets in our baseline are more uniformly distributed across the globe, with many tweets from North and South America, Europe, and Asia. This suggests that Russian trolls may be pretending to be from certain countries, e.g., USA or Germany, aiming to pose as locals and better manipulate opinions.”
- Timezone. “The timezone chosen by the users in their account setting: two thirds of the tweets by trolls appear to be from US timezones, while a substantial percentage (18%) from Russian ones. Whereas, the baseline has a more diverse set of timezones, which seems to mirror findings from our location analysis. “
- “Text – number of characters. We quantify the number of characters and words contained in each tweet, and plot the corresponding cumulative distribution function (CDF) that highlights Russian trolls tend to post longer tweets.
- Hashtags. Russian trolls use at least one hashtag in 32% of their tweets, compared to 10% for the baseline
- Mentions. We find that 46% of trolls’ tweets include mentions (i.e., @user appears in the tweet) to 8.5K unique Twitter users. This percentage is much higher for the random baseline users (80%, to 41K users).
- URLs. We then analyze the URLs included in the tweets. First of all, we note that 53% of the trolls’ tweets include at least a URL, compared to only 27% for the random baseline.
- Name changes. Previous work  has shown that malicious accounts often change their profile name in order to assume different identifies.
- Followers/Friends. Next, we look at the number of followers and friends (i.e., the accounts one follows) of the Russian trolls, as this is an indication of the possible overall impact of a tweet. On average, Russian trolls have 7K followers and 3K friends, while our baseline has 25K followers and 6K friends. We also note that in both samples, tweets reached a large number of Twitter users; at least 1K followers, with peaks up to 145K followers. These results highlight that Russian troll accounts have a non-negligible number of followers, which can assist in pushing specific narratives to a much greater number of Twitter users.
- Tweet Deletion. Arguably, a reasonable strategy to avoid detection after posting tweets that aim to manipulate other users might be to delete them. This is particularly useful when troll accounts change their identity and need to modify the narrative that they use to influence public opinion. We observe that 13% of the Russian trolls delete some of their tweets, with a median percentage of tweet deletion equal to 9.7%. Whereas, for the baseline set, 27% of the accounts delete at least one tweet, but the median percentage is 0.1%. This means that the trolls delete their tweets in batches, possibly trying to cover their tracks or get a clean slate, while random users make a larger number of deletions but only a small percentage of their overall tweets, possibly because of typos.”
- “Account linguistic characteristics. We also shed light on the troll account profile information. The top ten words appearing in the names and the descriptions of Russian trolls, as well as character 4-grams for account names and word bigrams for profile descriptions. Interestingly, a substantial number of Russian trolls pose as news outlets, evident from the use of the term “news” in both the name (1.3%) and the description (10.7%). Also, it seems they attempt to increase the number of their followers, thus their reach of Twitter users, by nudging users to follow them (see, e.g., “follow me” appearing in almost 8% of the accounts). Finally, 10.3% of the Russian trolls describe themselves as Trump supporters: “trump” and “maga” (Make America Great Again, one of Trump campaign’s main slogans).
- Main language. Looking at the language (as provided via the Twitter API) of the tweets posted by Russian trolls, we find that most of them (61%) are in English, although a substantial portion are in Russian (27%), and to a lesser extent in German (3.5%).”