MRLBot: Multi-Dimensional Representation Learning for Social Media Bot Detection

Abstract

Social media bots pose potential threats to the online environment, and the continuously evolving anti-detection technologies require bot detection methods to be more reliable and general. Current detection methods encounter challenges, including limited generalization ability, susceptibility to evasion in traditional feature engineering, and insufficient exploration of user relationships. To tackle these challenges, this paper proposes MRLBot, a social media bot detection framework based on unsupervised representation learning. We design a behavior representation learning model that utilizes Transformer and a CNN encoder–decoder to simultaneously extract global and local features from behavioral information. Furthermore, a network representation learning model is proposed that introduces intra- and outer-community-oriented random walks to learn structural features and community connections from the relationship graph. Finally, the behavioral representation and relationship representation learning models are combined to generate fused representations for bot detection. The experimental results of four publicly available social network datasets demonstrate that the proposed method has certain advantages over state-of-the-art detection methods in this field.

1. Introduction

The advent of online social networks (OSNs) such as Twitter, Instagram, and Weibo has brought revolutionary advancements in communication tools, providing users with a novel means to create and disseminate personal content. With the growing influence of social networks, an increasing number of individuals and organizations are utilizing OSNs to accomplish their objectives. To fully leverage the power of social networks, it is necessary to have sufficient influence on these platforms, leading to the emergence of social media bots.

Social media bots (SMBs) are computer programs that generate content, engage in social interactions, online discussions, and other activities, with the aim of imitating human accounts. Research on SMBs has shown that a substantial proportion of English-speaking users on Twitter, ranging from 9% to 15%, display bot-like behavior. The estimated total number of bots on Twitter is approximately 8.5% of all users, equating to tens of millions [1]. SMBs can be categorized as benign, neutral, or malicious. Among these, malicious bots pose a significant threat to OSNs. Attackers typically control and direct malicious bots, planning and executing their attack behaviors. The presence and activities of malicious bots have a significant impact on specific topics and public opinions on the Internet. For instance, during the 2010 U.S. midterm elections, malicious bots infiltrated Twitter, promoting specific candidates and spreading rumors and misinformation about others [2]. Similar attacks were observed during the 2016 U.S. presidential election [3].

To mitigate the proliferation of malicious behaviors on OSNs, researchers have proposed various techniques for detecting and banning bot accounts. Nevertheless, attackers can reverse-engineer their bot accounts by exploiting existing detection methods to evade filtering by the platform. This constant cat-and-mouse game has rendered this field dynamic, thereby increasing the demands for the enhanced reliability and universality of new detection technologies. Currently, commonly used techniques for detecting SMBs are typically classified into two main types: graph-based, and node-based [4]. However, there are still several bottlenecks and challenges in this field, including the following:

• The generalization ability of detection methods; existing detection models may only be applicable to particular OSNs, and their performance on other OSNs may be suboptimal,
• Traditional feature engineering-based methods can be expensive and susceptible to evasion; the manual extraction of distinctive features to discern between malicious bots and legitimate users requires significant domain expertise and human resources. Moreover, when malicious bots enhance their anti-detection capabilities, the originally defined feature set may lose its effectiveness,
• Insufficient exploration of user relationships; existing detection methods that rely on user relationships demand substantial time and computational resources. Furthermore, considering the privacy regulations of OSNs, potential features should be extracted from a restricted and accessible set of user relationships to the fullest extent feasible.

In order to tackle these challenges, this paper introduces a framework called MRLBot for detecting malicious bots in social networks using representation learning. The framework aims to model multi-dimensional information of user behaviors and relationships through automated feature extraction and the high generalization capability of general representation learning, ultimately accomplishing the detection task. The primary contributions of this paper are summarized as follows:

• We propose a behavior representation learning model, DDTCN. The model abstracts user activities on social networks to obtain behavior sequences, which are then encoded using the contextual global feature extraction ability of Transformer for time series. A CNN encoder–decoder is subsequently cascaded to extract local information from the sequences. Additionally, the representation ability of the output vectors is enhanced through the proposed Transformer dual decoder;
• This paper presents a network representation learning model, IB2V, based on latent communities. Additionally, we propose an incremental learning strategy for large-scale network graphs to reduce the time cost of generating representations for newly added nodes, while maintaining the performance of the model. The model learns the structural features of node neighborhoods through a novel random walk algorithm, while also preserving the internal structure of communities and the correlations between them;
• We design a generalized detection framework for various social network platforms, achieved through unified input from multiple platforms. The framework integrates components for behaviora; representation and relationship representation learning to generate fused representations, thereby enhancing detection performance.

In the rest of this paper, we conduct a comprehensive review of the relevant literature in Section 2. Section 3 provides a detailed overview of the preliminaries of user behaviors and relationships in social networks. Subsequently, in Section 4, we present the proposed MRLBot. In Section 5, we present the experimental results and corresponding analyses. Section 6 includes a review of the study’s findings, along with our directions for future research.

2. Related Works

2.1. Graph-Based Detection Approaches

A graph, G, in mathematical terms is a collection of vertices, V(G), and edges, E(G), that represent points connected in a plane or space. Graph structures are widely employed in diverse fields to represent pairwise relationships between objects. Early graph-based models for SMB detection were based on the architecture of the studied OSN and established user relationships. Feng et al. [5] constructed an undirected graph using the bidirectional follow relationship among target users, and then created a matrix of target users and their related users based on the Jaccard coefficient. Subsequently, the probability of a user being identified as a social bot was calculated based on the similarity between matrices. Dorri et al. [6] proposed SocialBotHunter, which was based on the isomorphism of social network graphs, where isomorphism suggests that two accounts may share similar attributes if they are associated in the social network. This model detected bots on Twitter by analyzing users’ social behaviors and interaction records. Abu-El-Rub et al. [7] employed a graph-based approach to model geographical information and clustered accounts based on graph structure and other collected information. Furthermore, Ahmad et al. [8] employed the unsupervised machine learning method to cluster graphs for bot detection by modeling social media data using a set of features and weighted graphs.

Extracting features from rich relational information in graph has long been a challenging problem. Recently, new research approaches have emerged, with a common method involving the transformation of topological and relational information into low-dimensional vectors, followed by training and inference using machine learning algorithms. Pham et al. [9] proposed a community-based random walk strategy that generates low-dimensional node representations while preserving local neighborhood relationships and intra-community structure. Magelinski et al. [10] utilized the graph neural network to extract latent local features of social network graphs by aggregating nodes along one-dimensional slices of the feature space, and then performed classification based on generated multi-channel histograms. Feng et al. [11] introduced a framework called BotRGCN, which constructs a relation-based heterogeneous graph and enhances the model’s ability to detect bots disguised as normal users by using multimodal user semantics and profiles. Building upon this, they considered varying relationship strengths between users in their recent work [12], and constructed a heterogeneous network with users as nodes and diverse relationships as edges.

However, in reality, OSNs are typically of massive scale, with some even having billions of user nodes. Consequently, most graph-based methods for detecting malicious SMBs in OSNs demand substantial training times and significant computing resources. Moreover, obtaining relationships for all users is highly challenging due to privacy constraints in OSNs, which impedes the further development of graph-based methods in this field.

2.2. Node-Based Detection Approaches

Most graph-based methods focus solely on the relationships between nodes, disregarding the valuable information contained within user nodes. Supervised machine learning is the prevailing method for node-based detection. These methods employ machine learning classifiers to detect malicious SMBs, treating the detection as binary classification and relying on a substantial amount of annotated data for training. Daouadi et al. [13] proposed an augmented set of features that leverage the interaction volume between accounts, combined with other features from previous research, to detect bot accounts on Twitter. Kudugunta et al. [14] employed the content of individual tweets and six account features to identify bots on Twitter. Wang et al. [15] hypothesized that tweets of social bots exhibit similarity due to shared goals among attackers, and utilized tweet similarity for detecting social bots on Twitter. Ping et al. [16] utilized CNN-LSTM to extract features from tweet content and metadata. Wei et al. [17] used the bidirectional long short-term memory (BiLSTM) network to capture features from tweets for classifying human and spam bots on Twitter. Stanton et al. [18] introduced a method called spamGAN that utilizes generative adversarial networks (GAN) to detect spam bots and enhance text classification accuracy in online comments with limited labeled data.

In addition to supervised learning, unsupervised machine learning methods have also been applied in this field. These methods do not rely on annotated data or unique features of individual accounts for classification purposes. Cresci et al. [19,20] extracted and analyzed digital DNA sequences from users’ online behaviors, and applied standard DNA analysis techniques to distinguish between legitimate accounts and spam accounts on the platform. Mazza et al. [21] collected a dataset of 10 million retweets and developed a novel visualization method to differentiate between benign and malicious retweet activities. They proposed an unsupervised bot detection technique called Retweet-Buster (RTbust), which utilizes feature extraction and clustering. Feng et al. [22] proposed a representation learning framework called SATAR for the unsupervised identification of bot accounts on Twitter. SATAR employs semantic, attribute, and neighborhood information about specific users for unsupervised pretraining on a large number of user samples to achieve generalization across different OSNs, and fine-tunes the model for adaptability to specific OSNs.

The majority of machine learning-based models for detecting malicious SMBs mentioned above focus on detecting at the user node, while disregarding the relationships between users and the structural information of the social graph. Moreover, these models are only applicable to OSNs with typical features. In different OSNs, users can perform varied actions, access personal information, and form relationships with other users, making it challenging to transfer feature sets or extraction methods proposed for a specific OSN to another. Additionally, behavioral patterns of malicious SMBs demonstrate high variability and diversity across different OSNs, which require increased demand for the generalizability of detection methods.

3. Preliminaries

This section presents definitions for “behavior” and “relationship” in social networks, and integrates input from various platforms to ensure the generalizability of the detection framework across different OSNs.

3.1. User Behaviors in Social Networks

Generally, social networks are commonly used by individuals to fulfill various needs, such as communication, information acquisition, and social interaction, among others. The actions of users in different OSNs such as those depicted in Figure 1 can be considered events that take place at different timestamps on a timeline, encompassing the diverse actions and interactions carried out by users at each timestamp.

The data generated from these behaviors contain valuable information that reflects the unique characteristics of users. Therefore, deep learning techniques can be utilized to analyze and model user behaviors, generating representation vectors that capture the behavioral patterns of users. By comparing and analyzing these representation vectors, it is possible to distinguish normal accounts from malicious SMBs.

We summarize the common actions performed by users in OSNs, including Post, Follow, Like, and Repost. The behavior of a user, u, on a social network can be defined by the behavior type sequence, $B_u$, and the corresponding timestamp sequence, $T_u$, both of which comprise a set number of operations.

$$B_u=\left\{b_{u,1},b_{u,2},\dots ,b_{u,i},\dots ,b_{u,l-1},b_{u,l}\right\}$$

(1)

$$T_u=\left\{t_{u,1},t_{u,2},\dots ,t_{u,i},\dots ,t_{u,l-1},t_{u,l}\right\}$$

(2)

$B_u$ represents the behavior type sequence for user u’s l actions, where $b_{u,i}\in \left\{Post, Follow, Like, Repost\right\}$ denotes the behavior type of the i-th action. $T_u$ is the timestamp sequence for each action of user u, where $t_{u,i}\in T$ represents the timestamp of the i-th action, and T represents the collection of all timestamps within the data collection period. To account for the temporal characteristics of user behavior, $T_u$ is arranged in an increasing sequence, with timestamps being sorted based on values, i.e., $t_{u,i-1}\le t_{u,i}\le t_{u,i+1} \left(1\le i\le l-1\right)$.

Posts or reposts generated by malicious SMBs often exhibit biased or directed characteristics and differ from the content posted by regular users. Therefore, the semantic features of these posts play a critical role in detecting malicious SMBs. Consequently, the content of posts should be incorporated as part of the definition of user behavior sequences. Specifically, the content sequence, $C_u$, can be defined as follows:

$$C_u=\left\{c_{u,1},c_{u,2},\dots ,c_{u,i},\dots ,c_{u,l-1},c_{u,l}\right\}$$

(3)

$C_u$ represents the posts published by user u during l actions, where $c_{u,i}$ denotes the content posted by user u in the i-th action. If no content is posted during a particular operation, $c_{u,i}$ is recorded as empty.

3.2. User Relationships in Social Networks

Social relationships among users in social networks can be integrated to form a social network graph. An OSN can be represented as a directed graph, $G=\left(V,E\right)$, where V and E denote sets of user nodes and relationship edges, respectively. However, due to the existence of different types of relationships and varying interaction frequencies among users, representing the relationship information among users in social networks with the directed graph is inadequate. To more accurately represent the strength of relationships between users, we propose assigning weights to the edges to create a directed weighted graph, $G=\left(V,E,W\right)$, where W denotes the set of edge weights. In this study, we categorize the strength of relationships into five levels: very weak, weak, medium, strong, and very strong. The allocation rules for relationship strength levels and corresponding weights, $W_i$, are based on the assumption that relationship $E_i$ occurs k times from user $V_p$ to user $V_q$, as shown in

Table 1. The allocation rules for relationship strength levels and corresponding weights.

Relationship Strength	Allocation Rule	$\mathbf{Weight}\left({\mathit{W}}_{\mathit{i}}\right)$
Very Weak	$k=1$	1
Weak	$2\le k<4$	2
Medium	$4\le k<6$	3
Strong	$6\le k<8$	4
Very Strong	$k\ge 8$	5

.

4. MRLBot: Methodology

This paper proposes a malicious SMB detection framework called MRLBot based on multi-dimensional representation learning, as depicted in Figure 2.

The framework consists of the following three steps:

• Data restructuration and preprocessing; due to potential differences in structured rules across diverse datasets, it is advisable to restructure the data for further preprocessing and expansion. The rules for data restructuration are formulated based on the user behaviors and relationships defined in Section 3.1 and Section 3.2. Each record in the table represents the behavior of each user or bot at a specific time point, including the behavior type and posted content, as well as interaction relationships. Preprocessing for the restructured data involves aggregating the records to generate user behavior sequences ($B_u$, $C_u$, $T_u$), and to build the social network relationship graph, $G=\left(V,E,W\right)$, with a focus on each user and each relationship (source node and target node),
• The generation and fusion of multi-dimensional user representations; the behavior sequences are input into the behavior representation learning model, DDTCN, and the directed weighted graph is input into the relationship representation learning model, IB2V. Through unsupervised learning, optimizers are performed separately to generate behavior representations and relationship representations that capture each user’s characteristics. Then, these two types of representations are concatenated to complete the fusion of multi-dimensional representations,
• The training and detection of the deep learning classifier; a fully connected neural network is employed to construct the classifier, with the fused representations serving as input, to achieve an accurate detection framework. During the training process of the detection framework, hyperparameters are adjusted to ensure optimal performance. Additionally, a labeled dataset is utilized to train the classifier, facilitating the effective judgment and identification of malicious SMBs based on different user representations.

4.1. DDTCN: Behavioral Representation Learning Model

Traditional RNN structures are capable of analyzing high-frequency and uniform behavior information and exhibit limitations in handling low-frequency and un-uniform behaviors that evolve over time [23]. In contrast, Transformer structures have been shown to effectively model multiple sequences and generate meaningful contextual representations in temporal interaction data [24]. Inspired by this, we propose a Transformer-based behavioral representation learning model, named DDTCN, for modeling user behavior in social networks. The architecture of DDTCN is illustrated in Figure 3.

When considering behavior sequences in social networks, relying solely on Transformer may present limitations. To address this, DDTCN incorporates two optimizations based on Transformer:

• Incorporating a CNN encoder–decoder concatenated with Transformer to capture both local and global information of user behavior simultaneously;
• Adding a parallel decoder on top of Transformer to retain diverse information and further mitigate information loss during the generation of user behavior representations.

DDTCN encodes different types of sequences at the input layer and merges them together. The original input sequences are encoded using embedding layers, including a behavior type-embedding matrix, $M_b\in {ℝ}^{\left|B\right|\times d}$, and time-embedding matrix, $M_t\in {ℝ}^{\left|T\right|\times d}$, where d is the dimension of the projection vectors, $\left|B\right|$ denotes the number of behavior types, and $\left|T\right|$ is the number of timestamps. By performing a look-up table, input embeddings for $B_u$ and $T_u$ are obtained, denoted as ${\tilde{E}}_b\in {ℝ}^{l\times d}$ and ${\tilde{E}}_t\in {ℝ}^{l\times d}$, respectively:

$${\tilde{E}}_b=\left(e_{b,1},e_{b,2},\dots ,e_{b,i},\dots ,e_{b,l-1},e_{b,l}\right)$$

(4)

$${\tilde{E}}_t=\left(e_{t,1},e_{t,2},\dots ,e_{t,i},\dots ,e_{t,l-1},e_{t,l}\right)$$

(5)

where $e_{b,i}\in {ℝ}^d$ is the embedding of $b_{u,i}$, and $e_{t,i}\in {ℝ}^d$ is the embedding of $t_{u,i}$.

As the length of each content in the content sequence, $C_u$, may be different, it is necessary to encode each text to align its dimension with the embeddings of other sequences (${\tilde{E}}_a$ and ${\tilde{E}}_t$), while preserving its semantic features. To achieve this, we utilize the pre-trained BERT [25] model to encode $C_u$ and obtain the content embeddings ${\tilde{E}}_c\in {ℝ}^{l\times d}$:

$${\tilde{E}}_c=\left(e_{c,1},e_{c,2},\dots ,e_{c,i},\dots ,e_{c,l-1},e_{c,l}\right)$$

(6)

where $e_{c,i}\in {ℝ}^d$ is the embedding of $c_{u,i}$ after encoding with BERT.

Based on the embeddings defined above, the input of the Transformer encoder can be defined as ${\tilde{E}}_I\in {ℝ}^{l\times d}$:

$${\tilde{E}}_I={\tilde{E}}_b+{\tilde{E}}_c+{\tilde{E}}_t$$

(7)

4.1.1. Transformer Encoder

The Transformer encoder is the key component of our model, responsible for fusing and compressing different types of information. The Transformer encoder is composed of two components: the multi-headed self-attention mechanism (MHSA) and the feedforward network (FFN). The MHSA can capture valid information from a variety of subspaces, while the MHSA is defined explicitly as follows:

$$MHSA\left(X^n\right)=Concat\left(hea{d}_1,hea{d}_2,\dots ,hea{d}_h\right)W^O$$

(8)

$$hea{d}_i=Attention\left(X^n{W}_i^Q,X^n{W}_i^K,X^n{W}_i^V\right)$$

(9)

where $X^n$ is the input to $n$-th layer of the Transformer encoder, i.e., $X^1={\tilde{E}}_I$ when $n=1$. The projection matrices $W_i^Q\in {ℝ}^{d\times d/h}$, $W_i^K\in {ℝ}^{d\times d/h}$, $W_i^V\in {ℝ}^{d\times d/h}$, and $W^O\in {ℝ}^{d\times d}$ represent the parameters that can be learned in each attention head in the MHSA. In this paper, the scaled dot product is used as the formula for attention, defined as follows:

$$Attention\left(Q,K,V\right)=softmax\left(\frac{Q{K}^{\top }}{\sqrt{d/h}}\right)V$$

(10)

where $Q=X^n{W}_i^Q$, K $=X^n{W}_i^K$, and $V=X^n{W}_i^V$. Additionally, $\sqrt{d/h}$ is the scaling factor that prevents the inner product ($Q{K}^{\top }$) from becoming excessively large.

Additionally, we provide MHSA with the nonlinear characteristic using a feedforward network, which is defined as follows:

$$FN\left({\tilde{X}}^n\right)=LeakyReLU\left({\tilde{X}}^n{W}_1^F+b_1^F\right)W_2^F+b_2^F$$

(11)

where $W_1^F$, $W_2^F$, $b_1^F$, and $b_2^F$ are all trainable parameters in FFN, and $LeakyReLU$ is the activation function.

Through the residual structure, the final output at the $n$-th layer of the Transformer encoder is $X^{n+1}\in {ℝ}^{l\times d}$:

$$X^{n+1}=LayerNorm\left(FFN\left({\tilde{X}}^n\right)+{\tilde{X}}^n\right)$$

(12)

4.1.2. CNN Encoder–Decoder

Peng et al. [26] proposed that the cascaded multi-head self-attention (MHSA) in Transformer can capture long-range feature dependencies. However, it may suffer from the loss of local feature information. In contrast, CNN convolutional operation excels at extracting local features but struggles to capture global features simultaneously. Relying solely on MHSA to focus on global user behavior representations may overlook the active state during specific periods. Therefore, taking these factors into consideration, we design a cascaded CNN encoder–decoder to capture important local information in behavior sequences.

Based on TextCNN [27], we have developed a CNN encoder–decoder that consists of a CNN encoder and a CNN decoder. The CNN encoder comprises a two-dimensional convolutional layer, a one-dimensional max pooling layer, and a fully connected layer. The size of the convolutional kernel, $\left[k_w, k_e\right]$, can be adjusted to capture specific lengths of continuous information. Meanwhile, to ensure coverage of the sequence embeddings, the dimension of the convolutional kernel is set to be the same as the embedding dimension, i.e., $k_e=d$. The dimension of the max pooling layer is also set to match the feature map generated by the convolutional kernel, which reduces the model parameter size through downsampling to alleviate the overfitting. Finally, the fully connected layer compresses the feature map and generates the user behavior representation, ${\tilde{u}}_b$. The definition of the CNN encoder is as follows:

$${\tilde{u}}_b=Maxpool\left(ConvNet\left(X_u;\left[k_w, k_e\right],\mathsf{\Theta }\right)\right)W^{CE}+b^{CE}$$

(13)

where $X_u$ is the output of the Transformer encoder, $\left[k_w, k_e\right]$ and $\mathsf{\Theta }$ represent the parameters of the CNN encoder, and $W^{CE}$ and $b^{CE}$ are the parameters of the linear layer.

In the CNN decoder, ${\tilde{u}}_b$ is used to reconstruct the input, $X_u$, of the CNN encoder, in preparation for the reconstruction task in the Transformer decoder. Corresponding to the encoder, the CNN decoder begins with a fully connected layer, followed by an upsampling layer to recover information lost due to max pooling. Finally, a two-dimensional transposed convolutional layer is connected to restore the convolutional operation of the encoder. The definition of the CNN decoder is as follows:

$$X_u^{\prime }=ConvTransNet\left(Upsample\left(W^{CD}{\tilde{u}}_b+b^{CE}\right)\right)$$

(14)

where $W^{CD}$ and $b^{CD}$ are the parameters of the linear layer.

4.1.3. Transformer Dual Decoder

Typically, research involving the encoder–decoder structure (autoencoder) employs only one unsupervised reconstruction task to train the model. To minimize information loss during the compression, our method incorporates parallel reconstruction tasks. Specifically, ${\tilde{E}}_b$ and ${\tilde{E}}_c$ are used as the Query to reconstruct the timestamp embeddings, ${\tilde{E}}_t$, in addition to reconstructing ${\tilde{E}}_c$ for retaining the feature of contents. The parallel reconstruction tasks endow the generated representations with the ability to recover diverse types of data, thereby enhancing the feature extraction capability of the autoencoder.

As the conventional Transformer decoder lacks the capability to perform parallel reconstruction tasks, we design the Transformer dual decoder (TDD) with two decoders: TDDc, which reconstructs ${\tilde{E}}_c$, and TDDt, which reconstructs ${\tilde{E}}_t$. Considering model complexity and computation time, we do not reconstruct ${\tilde{E}}_b$. The reconstructions of ${\tilde{E}}_c$ and ${\tilde{E}}_t$ are defined as follows in the formulas:

$${\tilde{D}}_c{}^n=LayerNorm\left(MH{A}_{TDDc}\left(D_c^n\right)+D_c^n\right)$$

(15)

$${\tilde{D}}_t{}^n=LayerNorm\left(MH{A}_{TDDt}\left(D_t^n\right)+D_t^n\right)$$

(16)

$${\tilde{E}}_c^{\prime }=LayerNorm\left(FF{N}_{TDDc}\left({\tilde{D}}_c{}^n\right)+{\tilde{D}}_c{}^n\right)$$

(17)

$${\tilde{E}}_t^{\prime }=LayerNorm\left(FF{N}_{TDDt}\left({\tilde{D}}_t{}^n\right)+{\tilde{D}}_t{}^n\right)$$

(18)

where MHA and FFN represent the formulas for the multi-head attention mechanism and feedforward network in Transformer. $D_c^n$ is the input to the n-th layer of TDDc, and when $n=1$, $D_c^1={\tilde{E}}_b+{\tilde{E}}_t$. $D_t^n$ denotes the input to the n-th layer of TDDt, and when $n=1$, $D_t^1={\tilde{E}}_b+{\tilde{E}}_c$. Lastly, ${\tilde{E}}_c^{\prime }$ and ${\tilde{E}}_t^{\prime }$ serve as the final outputs of the dual decoders, which are the reconstructions of the content embeddings, ${\tilde{E}}_c$, and the timestamp embeddings, ${\tilde{E}}_t$, respectively.

To minimize information loss and enhance feature extraction performance, the restoration of ${\tilde{E}}_c$ and ${\tilde{E}}_t$ to $C_u$ and $T_u$ is considered. Since $T_u$ is encoded using a lookup table in the embedding layer, the changing weights of the embedding layer during training may cause loss of information in ${\tilde{E}}_t$. If only the differences between ${\tilde{E}}_t$ and ${\tilde{E}}_t^{\prime }$ are compared, the reconstructed information may not match the original sequence. Therefore, the most probable time-reconstructed sequence, $T_u^{\prime }$, can be calculated by reverse computation using $M_t$ and the softmax layer:

$$T_u^{\prime }=softmax\left({\tilde{E}}_t^{\prime }{M}_t^{\top }\right)$$

(19)

In contrast, $C_u$ is encoded using the pre-trained BERT model. Additionally, to retain its semantic features, the parameters in BERT are fixed during training, meaning that the embedding vectors in ${\tilde{E}}_c$ remain unchanged. Hence, the differences between ${\tilde{E}}_c$ and ${\tilde{E}}_c^{\prime }$ can be directly calculated to assess the model’s ability to reconstruct contents.

4.1.4. Optimization Objectives

The DDTCN model adopts a multi-task joint training strategy. Specifically, the model uses two reconstruction tasks to achieve unsupervised training of the encoder–decoder structure, as outlined in Algorithm 1.

Algorithm 1: Training algorithm of DDTCN

Input: Behavior type sequences,${\left\{B_u\right\}}_{u\in U}$, timestamp sequences, ${\left\{T_u\right\}}_{u\in U}$, content sequences, ${\left\{C_u\right\}}_{u\in U}$, the length of user behavior sequences, $l$, the dimension of embeddings, $d$, and the dimension of user behavior representations, $e$, for the users in $U$. Output: The learned user behavioral representations, ${\left\{{\tilde{u}}_b\right\}}_{u\in U}$. Randomly initialize the parameters in DDTCN; For $u=1\to \left|U\right|$  carry out Project the input series, obtain behavior type embeddings, ${\tilde{E}}_b$, time embeddings, ${\tilde{E}}_t$ and content embeddings, ${\tilde{E}}_c$; Set input embeddings, ${\tilde{E}}_I$, through Equation (7); Learn the user behavioral representation, ${\tilde{u}}_b$, from the Transformer and CNN encoder–decoder; Learn the content sequence reconstruction, ${\tilde{E}}_c^{\prime }$, and the time sequence reconstruction, $T_u^{\prime }$, using Equations (17) and (19); Perform SGD based on Equation (24) to reduce the error in the reconstruction and improve the behavioral representation’s performance; End

Following the reconstruction tasks described in Section 4.1.2, the Softmax cross-entropy (SCE) loss function is employed to calculate ${\mathcal{L}}_{time}$ for time sequence reconstruction. Additionally, the mean squared error (MSE) loss function is employed to calculate ${\mathcal{L}}_{content}$ for content sequence reconstruction:

$${\mathcal{L}}_{SCE}\left(\widehat{y},y\right)=-1_y{}^{\top }\log [\mathrm{softmax}\left(\widehat{y}\right)]$$

(20)

$${\mathcal{L}}_{MSE}\left(\widehat{y},y\right)=\frac{1}{n}{\displaystyle \sum }_{i=0}^n{\left({\widehat{y}}_i-y_i\right)}^2$$

(21)

$${\mathcal{L}}_{time}={\mathcal{L}}_{SCE}\left(T_u^{\prime },T_u\right)$$

(22)

$${\mathcal{L}}_{content}=\frac{1}{l}{\displaystyle \sum }_{k=1}^l{\mathcal{L}}_{MSE}\left(\widehat{e_{c,k}},e_{c,k}\right)$$

(23)

where ${\mathcal{L}}_{SCE}$ is the calculation formula for SCE, $1_y$ denotes the one-hot encoding of the true label y, and $\widehat{y}$ is the predicted value. ${\mathcal{L}}_{MSE}$ is the calculation formula for MSE. When calculating ${\mathcal{L}}_{content}$, since the dimensions of $\tilde{E}$ and ${\tilde{E}}_c^{\prime }$ are both ${ℝ}^{l\times d}$, the specific calculation method for the loss value is to compute the mean squared error for each embedding vector, and then to take the average of the losses for all embedding vectors. The loss function of the entire model encompasses both ${\mathcal{L}}_{time}$ and ${\mathcal{L}}_{content}$, and they are combined by summing up the loss values to define ${\mathcal{L}}_{main}$ as follows:

$${\mathcal{L}}_{main}={\mathcal{L}}_{time}+{\mathcal{L}}_{content}$$

(24)

where ${\mathcal{L}}_{main}$ serves as the loss function for the entire model, accounting for the losses incurred in both the time reconstruction and content reconstruction.

4.2. IB2V: Relationship Representation Learning Model

According to the research by Pham et al. [9] (Bot2Vec), in various OSNs, normal users or bots tend to interact with other users who belong to their shared social circles. Typically, botnets managed by attackers establish relationships with each other and maintain interaction frequency to disguise themselves as normal users for evading detection. These social circles can be considered potential communities within the network graph, and by utilizing community information and its internal structural features, it is possible to differentiate between normal users and bots.

Based on prior work on network representation learning and Bot2Vec, we have developed a novel relationship network representation learning model called IB2V (Incremental Bot2Vec), as shown in Figure 4. The main focus of IB2V is to characterize the relationships among users and embed the user nodes from the network graph into low-dimensional vectors using unsupervised learning. Once potential communities are identified in the graph, we employ a strategy that combines breadth-first sampling and depth-first sampling to generate context neighborhoods for each node. Meanwhile, in order to preserve the internal structure of each community, transfer probabilities are designed to restrict the neighborhood set to remain within the community. By acquiring the neighborhood relationships of user nodes and preserving the internal structure of communities, node representations are generated. In order to enhance the performance and usability of the model, IB2V introduces two optimizations:

• Outer-community association. During the random walk process, in case of cross-community movement, dummy nodes related to the communities are added between the nodes and participate in the similarity calculation of context neighborhoods;
• An incremental learning strategy. This strategy aims to learn representation vectors of newly added nodes while maintaining model performance as much as possible, avoiding the retraining of the entire graph structure and reducing time costs.

4.2.1. Intra- and Outer-Community-Oriented Random Walks

Initially, the Louvain community detection algorithm [28] is used to determine the community to which the node belongs. Subsequently, leveraging the community information, the graph-based structure of OSN is converted into a Skip-gram model using a walk strategy.

In a random walk process, the length of the random walk is set to $l$, the starting point is $s=v^0$, $i$ steps have been taken, and the walker is at node $v^i$. $v^{i+1}$ is a node in the social graph, and the transition probability from $v^i$ to $v^{i+1}$ is defined as $\pi \left(v^i\to v^{i+1},C\left(v^i\right)\right)$, as shown in the following formula:

$$\pi \left(v^i\to v^{i+1}\right)=\left\{\begin{array}{c}\frac{w_{\left(v^i,v^{i+1}\right)}·{\alpha }_{\left(v^i,v^{i+1}\right)}}{\lambda },if \left(v^i,v^{i+1}\right)\in E and v^{i+1}\in C\left(v^i\right)\\ \begin{array}{c}\frac{w_{\left(v^i,v^{i+1}\right)}·{\beta }_{\left(v^i,v^{i+1}\right)}}{\lambda },if \left(v^i,v^{i+1}\right)\in E and v^{i+1}\notin C\left(v^i\right)\\ 0,otherwise\end{array}\end{array}\right.$$

(25)

where $E$ is the set of directed edges (relationships) in the graph. ${\alpha }_{\left(v^i,v^{i+1}\right)}$ is the non-normalized transition probability from $v^i$ to $v^{i+1}$ within the community when $v^i$ and $v^{i+1}$ belong to the same community, $C\left(v^i\right)$. ${\beta }_{\left(v^i,v^{i+1}\right)}$ is the non-normalized transition probability across communities from $v^i$ to $v^{i+1}$ when $v^i$ and $v^{i+1}$ do not belong to the same community. $w_{\left(v^i,v^{i+1}\right)}$ is the weight of the directed edge between $v^i$ and $v^{i+1}$. $\lambda$ is the global normalization constant, which is calculated by summing up all the non-normalized transition probabilities of node $v^i$.

The random walk strategy in Bot2Vec sets the transition probabilities ${\alpha }_{\left(v^i,v^{i+1}\right)}$ and ${\beta }_{\left(v^i,v^{i+1}\right)}$ within and outside the community as follows:

$${\alpha }_{\left(v^i,v^{i+1}\right)}=\left\{\begin{array}{c}\frac{1}{p},if spd\left(v^{i-1},v^{i+1}\right)=0\\ \begin{array}{c}1, if spd\left(v^{i-1},v^{i+1}\right)=1\\ \frac{1}{q}, if spd\left(v^{i-1},v^{i+1}\right)=2\end{array}\end{array}\right.$$

(26)

$${\beta }_{\left(v^i,v^{i+1}\right)}={\alpha }_{\left(v^i,v^{i+1}\right)}·\frac{1}{r\left|C\left(v^i\right)\right|}$$

(27)

where $v^{i-1}$ represents the previous node of $v^i$. $spd\left(v^{i-1},v^{i+1}\right)$ is the shortest path distance from $v^{i-1}$ to $v^{i+1}$. Since it takes at most two steps from $v^{i-1}$ to $v^{i+1}$, the value of $spd\left(v^{i-1},v^{i+1}\right)$ can only be selected from $\left\{0,1,2\right\}$. $\left|C\left(v^i\right)\right|$ is the number of nodes in the community to which $v^i$ belongs. Meanwhile, $p$, $q$, and $r$ are hyperparameters. $r\left|C\left(v^i\right)\right|$ is the penalty value.

Figure 5 shows the random walk process of our model. The in–out parameter $q$ can control the distance of the random walk. When $q<1$, the walk is more likely to choose nodes farther away from $v^{i-1}$. When $q>1$, the walk is more likely to visit nodes closer to $v^{i-1}$; that is, nodes around $v^{i-1}$. By setting $q$, the random walk process can be controlled to explore outward from the source node or to explore the surroundings. In addition, the return parameter $p$ can control the probability of the random walk revisiting the previous node; that is, $v^{i+1}=v^{i-1}$. Increasing the value of $p$ helps reduce the likelihood of sampling the same node in the random walk process. The penalty value $r\left|C\left(v^i\right)\right|$ is used for cross-community sampling to control the movement of the random walker, either to the outside or staying within the current community, when starting from the current node. Thus, changing the value of $r$ can guide the random walker in capturing the local structure of each user node.

In addition, to preserve cross-community information during the sampling process, IB2V introduces dummy community nodes between each community, as depicted in Figure 5. Let us assume a dummy node, $D^k\in D$, where $D$ is the set of all dummy nodes, and $D^k$ is positioned between different communities, $C\left(v^k\right)$ and $C\left(v^{k+1}\right)$. When the random walker moves across communities, from $v^k$ to $v^{k+1}$, we include the dummy node $D^k$ in the sampled context, forming $v^k\to D^k\to v^{k+1}$. By performing these operations, the generated node context during random walk sampling includes community dummy nodes, which takes into account the association between different communities and cross-community information.

4.2.2. Node Representation Learning and Optimization Objectives

The primary objective of the model is to acquire the latent node representation ${\tilde{u}}_g$ with a dimensionality of $e$. Skip-gram model and Word2Vec are used to learn the representation of each node by sampling context neighborhoods through random walks. For a node $v$ in a social network, the optimization objective of IB2V is to maximize the probability of its neighboring nodes appearing, as shown in the following equation:

$$\underset{\theta }{\mathit{max}}{{\displaystyle \sum }}_{c\in N\left(v\right)}logPr\left(c|v;\theta \right)$$

(28)

where $N\left(v\right)$ represents the set of neighboring nodes of $v$ obtained through sampling strategies. Additionally, given node $v$, $logPr\left(c|v;\theta \right)$ is the conditional probability of node $c$ occurring, which can be represented by the following equation:

$$logPr\left(c|v;\theta \right)=\frac{\exp \left({\tilde{u}}_c·{\tilde{u}}_v\right)}{{{\displaystyle \sum }}_{u\in V}\exp \left({\tilde{u}}_u·{\tilde{u}}_v\right)}$$

(29)

where ${\tilde{u}}_c$ and ${\tilde{u}}_v$ are the representation vectors of $c$ and $v$, respectively. To reduce the computational cost of model parameter updates, the network embedding process adopts a negative sampling technique, which randomly selects a subset of neurons for updates. Negative sampling has been proven to be effective at training large-scale datasets, such as text corpora and information networks. In a more detailed implementation process, for each positive training sample, a set of $K$ negative samples is randomly selected from the given node set $V$ according to the noise distribution, $P\left(u\right)$. The optimization function with the negative sampling strategy is $L_{\theta }$:

$$L_{\theta }=log \sigma \left({\tilde{u}}_c·{\tilde{u}}_v\right)+{\displaystyle \sum }_{k=1}^K{\mathbb{E}}_{u^k~P\left(u\right)}\left[log \sigma \left(-{\tilde{u}}_{u^k}·{\tilde{u}}_v\right)\right]$$

(30)

where $\sigma$ is the sigmoid activation function, $P\left(u\right)$ is the noise distribution for randomly selecting $K$ negative-sample nodes from the given node set, and $u^k$ is the user node selected through negative sampling.

4.2.3. Incremental Learning Strategy

OSNs in the real world are typically characterized by a large scale, with some networks having hundreds of millions of user nodes. When new nodes and relationships are added, incremental training on the existing social graph must be considered. However, reloading the complete social graph, resampling, and relearning representations for each node can consume a large amount of time and computational resources.

Therefore, this paper proposes an incremental learning strategy for IB2V that aims to reduce the time cost of model continuation training as much as possible, while minimizing performance degradation. The specific process is illustrated in Figure 6.

To improve the efficiency of model training, the incremental learning strategy adopts various methods, including avoiding redundant community detection, reducing sampling frequency, and fixing the weights of old nodes, as follows:

• Specifically, the model first conducts community detection and saves the community membership for each node;
• Then, the original social graph is converted into a community graph, where nodes are represented as communities. Based on the saved community information and structure, newly added nodes are integrated into the community graph and undergo a new round of community detection to determine their community membership;
• Then, the newly added nodes are used as the starting point for the random walk process, which generates context sequences after sampling from the new social graph;
• In the final step, the representations of old nodes are fixed, and the Skip-gram model is used to learn the representations for all new nodes.

5. Experiments and Discussions

5.1. Datasets and Evaluation Metrics

In order to assess and evaluate the performance of the detection framework and its generalization ability across different OSNs, this study utilizes four publicly available datasets from distinct OSNs:

• Cresci-2015 [29] (Twitter). The statistical information of the dataset is presented in

  Table 2. Details of the Cresci-2015 dataset.

  Sub-Datasets	Accounts	Tweets	Friend Relationships	Follow Relationships
  TFP	469	563,693	241,710	258,494
  E13	1481	2,068,037	667,225	1,526,944
  FSF	1169	22,910	253,026	11,893
  INT	1337	58,925	517,485	23,173
  TWT	845	114,192	729,839	28,588
  Total number of accounts	5301
  Number of bots	3351 (63%)

  , comprising 5301 users, out of which 3351 accounts are labeled as bots, accounting for 63% of all users. This dataset includes tweet records and user profiles of relevant users, and consists of five sub-datasets: TFP, E13, FSF, INT, and TWT. All sub-datasets have label information, with users annotated as either bots or normal users.
• Social-Spammer [30] (Tagged). This dataset is collected from the Tagged social networking website and contains a large labeled dataset of bots. It encompasses a total of 5,607,454 accounts with their profiles, 912,280,409 relationship records between accounts, and timestamps of interactions. This dataset forms a heterogeneous network with seven different types of relationships between users (“Message”, “Pet Game”, “Meet-Me Game”, “Add Friend”, “Give A Gift”, “Report Abuse”, and “View Profile”). Among these, 221,305 accounts are labeled as bots, which constitutes 3.9% of all accounts.
• MicroblogPCU [31] (Weibo). This dataset is collected by researchers for spam detection in Weibo, and includes basic attribute of users, as well as the content they posted and corresponding timestamps. It contains a total of 48,848 Weibo posts and 781 accounts. Among all the accounts, the number of labeled normal users is 113, and the number of malicious bots is 66.
• TwiBot-22 [32] (Twitter), a comprehensive graph-based Twitter bot detection benchmark that presents the largest dataset to date. The dataset contains 1,000,000 users (39,943 accounts are labeled as bots), 86,764,167 tweets, and 170,185,937 edges between users.

According to the methods of re-structuring and pre-processing, the four datasets mentioned above are processed. For the experiments, all datasets are divided into training set, validation set, and test set in a ratio of 7:1:2, respectively. To test the model’s generalization ability and its applicability to new users, MRLBot is trained on the training set in an unsupervised manner to generate user representations. The deep learning classifier is trained using a supervised task of predicting malicious SMBs, and the performance of the detection framework is evaluated using the test set. Additionally, to prevent model overfitting, the training quality is evaluated using the validation set.

Table 3. Evaluation metrics.

Metrics	Formula	Description
Accuracy (ACC)	$\frac{\mathrm{TP}+\mathrm{TN}}{\mathrm{ALL}}$	Classification accuracy is the percentage of all categories identified correctly.
Precision	$\frac{\mathrm{TP}}{\mathrm{TP}+\mathrm{FP}}$	The ratio of the number of correctly identified malicious SMBs to the total number of identified samples.
Recall	$\frac{\mathrm{TP}}{\mathrm{FN}+\mathrm{TP}}$	The ratio of the number of correctly identified malicious SMBs to the number of samples that should be identified.
F1 score	$\frac{2\ast \mathrm{TP}}{2\ast \mathrm{TP}+\mathrm{FP}+\mathrm{FN}}$	F1 score is a statistical metric to measure model accuracy. Both accuracy and recall are considered in the metric.

presents the evaluation metrics used in this study.

In Table 3, TP, TN, FP, and FN represent true positive, true negative, false positive, and false negative, respectively. The primary focus of this study is the detection of malicious SMBs, with bots being considered positive samples and normal users being considered negative samples. Therefore, accuracy is employed as a measure of the overall classification performance. In cases where the dataset has a significant imbalance between positive and negative samples (e.g., in the Social-Spammer dataset where bots account for only 3.9% of all accounts), evaluation metrics that emphasize positive samples, such as precision, recall, and F1 score, should be given priority.

5.2. Experimental Setups

Based on the PyTorch deep learning framework (version 1.11.0), we constructed MRLBot. The hyperparameter settings are provided in

Table 4. Hyperparameter settings of the proposed detection framework.

Hyperparameters	Settings
User behavior sequence length (l)	64
Embedding dimension (d)	128
Representation dimension $\left(e\right)$	128
Transformer Encoder layers $(n_e)$	2
Transformer dual-decoder layers $(n_d)$	1
Convolution kernel size ($\left[k_w, k_e\right]$)	[8, d]
Skip-gram sliding window size ($sw$)	7
Negative sampling sample size ($K$)	5
Random walk distance ($l$)	30
Number of random walks per node ($w$)	20
Return parameter ($p$)	1
In–out parameter ($q$)	1
Out-community parameter (r)	1
DNN Layers	3
Dropout rate	0.1
Learning rate	1 × 10−4

. In the experimental discussion section of Section 5.4, significant hyperparameters will be adjusted to assess their impact on the model’s performance.

To demonstrate MRLBot’s ability to detect malicious SMBs, we compared it against the following baseline methods:

• AdaBoost [14]. This method uses a 10-dimensional feature set based on user profiles and employs AdaBoost for bot classification. The feature “favorite_counts” is present in the Cresci-2015 dataset. but it is not available in the other two datasets, and thus is not used in experiments involving these datasets.
• DeeProBot [33]. This method uses metadata from user profiles and replaces the descriptive text in the metadata with pre-trained global word embeddings. The model consists of LSTM and fully connected layers to handle mixed types of features, including numerical, binary, and text. As the datasets used in this paper lack “Sentiment” and “Timing” features; these features are not taken into consideration during input construction.
• BotRGCN [11]. The authors constructed a heterogeneous graph from the follower relationships, embedding multimodal user semantics and attribute information into the graph, and applied graph convolutional network for detecting bots. Since the dataset used in this paper do not include account avatars, this feature is not considered when constructing inputs.
• SATAR [22]. This method is an unsupervised Twitter user representation learning framework that jointly utilizes semantic, attribute, and neighborhood information, and employs a co-influence module to aggregate this information.

The above methods have corresponding implementations in publicly available code repositories, and hyperparameters from the published papers are referred to for optimal performance.

5.3. Experimental Results

This section discusses the comparative experiments that were conducted on the proposed MRLBot, utilizing datasets from three distinct social networks, along with the use of the baseline methods mentioned in Section 5.2.

Table 5. Detection results on Cresci-2015 and TwiBot-22.

Methods	Cresci-2015				TwiBot-22
	ACC	Precision	Recall	F1	ACC	Precision	Recall	F1
AdaBoost [14]	0.7533	0.9982	0.6095	0.7574	0.7650	0.8000	0.1499	0.2474
DeeProBot [33]	0.8427	0.9296	0.7931	0.8559	0.6587	0.4431	0.6198	0.5167
BotRGCN [11]	0.9652	0.9551	0.9917	0.9731	0.7966	0.7481	0.4680	0.5750
SATAR [22]	0.9342	0.9066	0.9988	0.9505	0.7822	0.7270	0.4510	0.5567
MRLBot	0.9725	0.9654	0.9920	0.9785	0.8025	0.7845	0.5050	0.6145

presents the experimental results of all detection frameworks on Cresci-2015 and TwiBot-22.

MRLBot demonstrated superior performance in terms of accuracy and the F1 score compared to other bot detection frameworks, achieving 97.25% accuracy and a 97.85% F1 score. Despite achieving the highest precision, AdaBoost generated a significant number of false positives in bot identification, mistakenly classifying numerous bot samples as normal users. SATAR, although achieving the highest recall, also misclassified some normal users as bots. Overall, MRLBot achieved the best detection performance on the Cresci-2015 dataset. Similarly, MRLBot achieved the best performance on TwiBot-22.

The detection performance on Social-Spammer and MicroblogPCU is shown in

Table 6. Detection results on Social-Spammer and MicroblogPCU.

Methods	Social-Spammer				MicroblogPCU
	ACC	Precision	Recall	F1	ACC	Precision	Recall	F1
AdaBoost [14]	0.9655	0.5456	0.7529	0.6327	0.8991	0.8571	0.8322	0.8445
DeeProBot [33]	0.9633	0.5248	0.7412	0.6145	0.9052	0.8507	0.8655	0.8580
BotRGCN [11]	0.9967	0.9429	0.9755	0.9589	0.9108	0.8636	0.8767	0.8701
SATAR [22]	0.9960	0.9319	0.9695	0.9503	0.9121	0.8529	0.8856	0.8689
MRLBot	0.9962	0.9325	0.9742	0.9529	0.9254	0.8806	0.9088	0.8945

.

On the Social-Spammer dataset, which contains richer relational information, BotRGCN achieved the highest detection performance. This is attributed to the utilization of graph convolutional networks in BotRGCN, which capture the global contextual information of the social graph and define it as a heterogeneous graph, taking into account the diverse types of relationships among users. Our proposed MRLBot outperformed other methods except BotRGCN, indicating that the integration of multi-dimensional features can enhance the detection performance and accomplish the performance of graph neural network in supervised tasks.

On the MicroblogPCU dataset with a small sample size, MRLBot outperformed SATAR, which is also an unsupervised framework, and achieved the best performance among all the compared frameworks. This indicates that the fusion of multi-dimensional information improved the detection performance of user representations.

In light of the experimental results and the analysis presented above, we can draw the following conclusions: MRLBot demonstrated effective detection results on diverse datasets, showcasing its ability to generalize across various OSNs. Furthermore, on the four publicly available datasets, the detection performance of MRLBot surpassed that of state-of-the-art baseline frameworks in this field, validating the efficacy of our approach in integrating multi-dimensional representations.

5.4. Discussions

5.4.1. Ablation Study

This paper presents various structures and components aimed at optimizing the detection performance and generalization ability. In this section, we evaluate the contribution of each component to MRLBot. Variants of the framework are generated by selectively reducing techniques and components, while maintaining consistent hyperparameters. Ablation experiments were performed on the Cresci-2015 dataset. The control groups for the experiments are as follows:

• Timestamp sequence. The model variants consist of TCN and TCN_pos. TCN (Transformer Convolutional Network) is the structure of DDTCN in MRLBot without the dual decoder, reconstructing only the published content in the decoder part. TCN_pos replaces time embedding with position embedding in the input layer.
• Community dummy nodes. The control groups are IB2V and Bot2Vec.
• CNN encoder–decoder. The control groups are DDTCN and DDTN, with DDTN being a variant of our model that does not utilize CNN autoencoder.
• Transformer dual decoder. The control groups are DDTCN and TCN.

Figure 7 presents the accuracy and F1 score of each control group in comparison to all the optimization components. The results of the ablation experiments indicate that the proposed components achieved significant optimization effects.

To illustrate the significance of timestamp sequences for the model, ablation experiments were conducted to compare the performance of TCN with timestamp sequences, against that of TCNpos without timestamp sequences. The model’s performance improvement with timestamp sequences is evident in terms of the accuracy and F1 score. This is because, although Transformer is capable of capturing contextual relationships in sequences, it lacks information about the timing of user behavior. Moreover, the Transformer dual decoder demonstrated a notable improvement of 1.47% in the F1 score compared to the other components in the control group. We posit that the parallel decoder, through the reconstruction of timestamp sequence, enhances the temporal features of user representations. This facilitates the more accurate identification of samples that were previously challenging to determine, thereby resulting in a more balanced detection performance.

5.4.2. Efficiency of Incremental Learning Strategy

In the comparative experiment, a graph of all nodes and relationships from the dataset was constructed to learn user representations. MRLBot was trained on a per-user-node basis, using 50% of the nodes from the Social-Spammer dataset as the initial training set. Subsequently, the percentage of nodes was incrementally increased from 50% to 100% to simulate the scenario of adding new users.

In the absence of the incremental learning strategy described in Section 4.2.3, the representations of all nodes must be relearned following the algorithmic flow of IB2V, and the classifier needs to be retrained using the newly added 10% nodes as the test set to validate the classification performance. The effectiveness of this strategy was verified by comparing the time taken and detection performance of generating representation vectors for newly added nodes with and without using the incremental learning strategy.

Based on the findings in

Table 7. Detection F1 score with different learning strategies (Social-Spammer dataset).

Strategies	Dataset Size
	60%	70%	80%	90%	100%
Original learning	0.9431	0.9744	0.9782	0.9521	0.9529
Incremental learning	0.9210	0.9352	0.9288	0.9035	0.8975

and

Table 8. Time consumption (seconds) for representation learning with different learning schemes (Social-Spammer dataset).

Strategies	Dataset Size
	60%	70%	80%	90%	100%
Original learning	23,752	28,502	35,253	38,003	42,454
Incremental learning	15,500	19,681	23,922	26,832	31,269

, the incremental learning strategy can greatly decrease the time cost of learning representations for newly added nodes. However, the strategy may result in a trade-off between time cost and detection performance. This is because this strategy does not re-sample and generate context sequences for all nodes, resulting in the loss of structural information of some nodes in the graph. Additionally, the performance of the generated representations for new nodes may also be affected due to the fixed representation of old nodes and the loss of structure features. As the number of nodes grows, the loss of detection performance caused by the incremental learning strategy becomes more severe. Therefore, it is recommended to use the incremental learning strategy to generate representation vectors for a certain amount of newly added nodes to reduce training time costs. However, when a large number of new users are added to the social network over a period of time, in order to ensure detection performance, it is recommended to re-sample the new social graph structure and refresh the representation vectors of all nodes.

5.4.3. Validity of Relationship Strength

In Section 4.1.1, the user’s social network was defined as a directed weighted graph, and the relationship strength among users was divided. We tested the variation in MRLBot’s detection performance on the Social-Spammer dataset when the input of IB2V was a directed unweighted graph and a directed weighted graph.

Based on the findings in

Table 9. Detection results of MRLBot before and after adding the relationship strength (Social-Spammer dataset).

Graph Type	Social-Spammer Dataset
	ACC	Precision	Recall	F1
Directed unweighted graph	0.9951	0.9176	0.9622	0.9394
Directed weighted graph	0.9954	0.9204	0.9671	0.9432

, the detection performance of MRLBot was enhanced when the relationship strength among users was considered. We defined the relationship strength based on the number of interactions among users and quantified it using the weight of edges in the relationship graph. The experimental results indicate that this optimization scheme enables the network representation learning method to capture more relationship features from the social graph, leading to the improved performance of node representation in bot detection tasks.

5.4.4. Parameter Sensitivity of the Model

The primary objective of selecting suitable hyperparameters for the model is to achieve optimal performance within the constraints of time and computational resources. This section investigates the impact of different hyperparameters on the model’s performance, in order to evaluate the robustness of our model using the Cresci-2015 dataset.

In our model, MRLBot, the behavior representation part is based on the Transformer encoder–decoder structure. The number of layers in the Transformer encoder and decoder may affect the model’s performance. Without changing other hyperparameters, we recorded the results of the detection framework in terms of accuracy and the F1 score by varying the number of layers in the Transformer encoder and dual decoder in DDTCN, as shown in Figure 8 and Figure 9.

The detection performance was optimized when the number of layers in the Transformer dual decoder was set to 1 and the number of layers in the Transformer encoder was set to 2. Thus, the depth of our model is not the determining factor of performance, as increasing the depth would raise the computational cost and model complexity.

To extract local information from the behavior sequence, we used a CNN autoencoder. The size of the convolutional kernel can affect the final performance of the model. We set the size of the convolutional kernel as two-dimensional $\left[k_w, k_e\right]$, where $k_e$ is the same as the embedding dimension of the model, i.e., $k_e=d$. By varying $k_w$ in the set $\left\{2, 4, 8, 16, 32, 64\right\}$, we recorded the performance change of the detection framework with the change in the convolutional kernel size, as shown in Figure 10.

This can be attributed to the fact that larger convolutional kernels result in longer sequence lengths being calculated within each kernel, causing the model to focus more on textual content and temporal information. As a consequence, the ratio of important local information to unimportant information decreases, leading to diminishing returns in model performance. Furthermore, projecting high-dimensional information into a low-dimensional space does not increase the amount of effective information in the user vectors as the convolutional kernel size increases. As a result, the accuracy and F1 score plateaus, with no further improvement observed beyond a kernel size of eight.

Most network representation learning techniques are highly sensitive to changes in hyperparameters, such as the number of random walks per node ($w$) and the length of each walk ($l$). Based on the results depicted in in Figure 11, stability and optimal performance in bot classification tasks were achieved with $w>18$ and $l=30~50$. This can be attributed to the fact that increasing the values of $w$ and $l$ results in an increased number of contextual nodes for each user node. Therefore, these parameters should be carefully chosen, taking into consideration the size of the network, in order to generate sufficient training samples for the network’s representation learning. Finally, sensitivity experiments on parameters indicate that, considering the balance between time, computational resources, and model performance, parameter settings of $w=20$ and $l=30\sim 50$ can be adopted.

5.4.5. Limitations

Our proposed method has the following limitations:

• Limitations of research hypotheses. In Section 3, we simplified user behaviors and relationships in social networks, which is a critical weakness and a simplification of the research work. In actual social networks, user behaviors and relationships are more complex and have more variables. Furthermore, the hypothesis method we employed is based solely on past research and historical experience, without taking into account future changes. There are two main limitations to this approach. Firstly, due to the reduction in variables considered, the detection performance may decrease in the real environment, even though the rationality of the research is guaranteed. Secondly, attackers may bypass the detection methods we proposed by disguising software robots as real users based on these assumptions.
• Limitations of technical methods. During the representation fusion stage, we concatenated representations of different dimensions, which has the potential to affect the final performance.
• Limitations of experimental scenarios. All experiments in this paper were conducted using publicly available datasets and did not involve actual online environments. These datasets were collected by researchers in the past, and the performance on these datasets can indicate whether or not the detection method was effective in the past time period. However, it is also important to consider the timeliness of the detection method; that is, whether or not it is effective in the latest time period. Real-time monitoring in online environments requires more complex engineering work and will be the focus of our future research.

6. Conclusions

This paper presents a novel method for detecting malicious SMBs based on multi-dimensional representation learning. Detection methods relying on a single feature, such as behavior or relationship, may perform poorly when that feature is missing in a social network platform. To address this limitation, this study proposes a framework that combines behavior representation and relationship representation learning models to generate fused representations. By unifying the input from multiple platforms, the framework achieves generalization across different social network platforms. Specifically, an unsupervised representation learning model, DDTCN, based on user behavior, is proposed, along with different optimization components to enhance the model’s output vectors for users. Additionally, a network representation learning model, IB2V, is proposed, which incorporates an incremental learning strategy for large-scale social network graphs to reduce the time cost of generating representations for newly added nodes while maintaining performance. This model captures not only the structural features of node neighborhoods, but also the internal structure of communities and the correlations between communities. The experimental results demonstrate the effectiveness of the framework, with good detection performance being achieved on all datasets.