TGEconomicDataset: A Collection of Russian-Language Economic Telegram Channels and a Synthetic Data Generation Framework for Continuous Authentication

Abstract

Telegram, along with WhatsApp and Signal, has become very popular due to its hybrid capabilities, including both instant private and public messaging, making it an effective tool for quickly broadcasting content to a wide audience. This article presents TGEconomicDataset, a new dataset containing more than 2.9 million messages from the most popular Russian-language Telegram channels in the field of economics, as well as synthetically generated labeled mixtures of these channels. These mixtures are specifically designed to model authorship change scenarios for testing various methods for solving the problem of continuous authentication, which is of particular interest due to the need for organizations and companies to rely on data posted on social media. The presented dataset is enriched with quotes of important financial instruments such as gold futures, the USD/RUB currency pair, BRENT oil, the dollar index (DXY), and bitcoin (BTC), synchronized with the message timestamps. A detailed joint analysis of the collected data is provided. In addition to the presented dataset, we publish the scripts used to collect the data, integrate the financial indicators, and generate the synthetic mixtures for the continuous authentication task, ensuring full reproducibility of the research.

1. Summary

Today, Telegram, along with WhatsApp and Signal, has become very popular due to its hybrid capabilities, which include both instant private and public messaging. The number of users of this messenger app began to grow during the coronavirus pandemic [1,2,3]. In addition, starting in 2021, there has been a mass migration of users from WhatsApp to other messengers, including Telegram, due to changes in WhatsApp’s privacy policy [4,5,6].

Telegram has proven to be an attractive service due to its support for user privacy, its rich infrastructure that enables cryptocurrency transactions, and its tools for automating channel management, including artificial intelligence bots and an open platform for developers via an application programming interface (API) [7,8]. Along with the ability to privately exchange text, video, and audio messages and files in real time, Telegram has made it possible to interact with a wide audience both publicly and privately through its channel mechanism. A channel is a platform tool that allows messages and other content (video, audio, files) to be broadcast to a large audience [9]. Telegram channel data can be used by organizations in their business processes. Such organizations include mass media, online survey organizations, and financial services.

Telegram’s wide range of features, primarily privacy, also attract malicious actors to the platform for illegal activities such as distributing content (videos, video games, etc.) in violation of copyright laws, spreading radical ideologies, using the messenger to carry out terrorist attacks and using channels for market manipulation, including manipulation on crypto exchanges through pump and dump schemes [10,11,12,13].

The task of identifying typical user behavior becomes relevant here, the solution of which allows the user to be assigned to a particular class based on semantic analysis of the information received from a user. The practical application of methods and software algorithms for solving such a task may be necessary when analyzing data from both messengers and social networks, for example, to determine the fact of theft, sale of accounts, as well as the use of deepfake technologies to commit fraudulent actions in virtual space [14,15]. The methods can also be used to determine the impact of unreliable and knowingly false information on user behavior.

In this paper, we present a dataset of Telegram channels in the field of economics, as well as a mixture of these channels with class labels, formed to test various methods for solving the problem of continuous authentication [16,17,18,19], which is of particular interest due to the need for organizations to rely on data posted on social media. The main contributions of this work are as follows:

A dataset of messages from Russian-language Telegram channels has been created. The channels for downloading were selected using the TGStat [20] analytics system catalog.

A key feature of the proposed dataset is synthetic collections of labeled messages that reflect a scenario where the author changes while the thematic focus of the texts remains the same. These collections can be used to test and validate models that solve the problem of continuous authentication (authorship verification) within a given subject area.

Attributes with values reflecting the state of financial markets at the time of message creation have been added to the dataset messages. These attributes allow us to explore two interrelated aspects: first, the influence of the market context on the content of messages, and second, the suitability of using these quantitative attributes as features to improve the accuracy of continuous authentication models.

The dataset contains public channels whose data does not allow for establishing a link between a message and the user ID of its author. Thus, the dataset strikes a balance between research utility and ethical responsibility, allowing authorship and message style to be studied without revealing private information.

The dataset and scripts for its creation and analysis are publicly available. This allows the results to be reproduced and further research to be conducted in the field of continuous authentication and text analysis in social media.

2. Related Work

The largest dataset from the Telegram messenger is described in [21] and contains 27,801 channels and 317,224,715 messages on various topics, focusing on channels discussing right-wing extremism and cryptocurrency. Other noteworthy datasets are those described in [22], dedicated to the QAnon conspiracy theory and containing 151 channels, as well as those in [23], which contains more than 500,000 Persian channels.

Ref. [24] is devoted to collecting misinformation about COVID-19 in the Telegram messenger. The collected dataset contains almost a million messages collected from 2000 channels and, in addition to text messages, contains images, videos, and documents, mainly in PDF format.

The authors of [25] attempted to provide a more comprehensive picture of the Telegram ecosystem and collected a dataset of 120,979 channels, representing more than 400 million messages, which were then grouped into 13 topics.

Another study [26] was focused on collecting channels in German and represents 6000 groups and channels, about 40 million text messages, and more than 3 million transcribed audio files. The authors suggest that researchers could use this resource to study social dynamics in the areas of disinformation, political extremism, public opinion adaptation, and social network structures on Telegram [26].

Ref. [27] presents a dataset consisting of posts from 13 channels collected in real time, as well as posts collected using an export API that allows all recent messages in a channel to be downloaded. This made it possible to identify posts that had been moderated and deleted. The authors then attempted to estimate the proportion of propaganda posts in the collected data.

The paper [28] presents the largest dataset, TeleScope, containing data from 500,000 public Telegram channels and 120 million messages collected over a period of 2.5 years (until October 2024). The authors suggest that researchers use the collected dataset, including in the context of repeating social media research previously applied to X (formerly Twitter), for analyzing networks and communities, and conducting research on language communities [28].

Previous studies involving Telegram datasets have primarily focused on general content or socio-political themes. Russian-language content, including economic discourse, is represented only fragmentarily and is not treated as a coherent, annotated corpus for specialized research. Moreover, none of the known datasets provide synthetic data specifically constructed for continuous authentication tasks. Our dataset addresses these gaps. It offers a purposefully collected corpus of messages from popular Russian-language economic channels, where each message is enriched with financial attributes (gold and BRENT oil futures prices, USD/RUB exchange rates, bitcoin, and the dollar index) reflecting market conditions at the time of publication. In addition to the original authentic messages, the dataset includes synthetic messages specifically designed for rigorous evaluation of continuous authentication algorithms.

3. Background

3.1. Description of Telegram Infrastructure

Telegram combines the functionality of a social network and a messaging app for making audio and video calls and conferences. The Telegram social network allows you to interact with a large audience through chats: channels and groups. Channels and groups are collections of messages and can be either publicly available or require prior approval of each new member, as well as the ability to join via an invitation link. A channel is a chronologically ordered collection of messages with the option to subscribe to new messages, managed by a single user-administrator or a group of users with administrator or author access rights [29]. Only privileged users can post messages in a channel. The channel administrator can allow comments to be added to messages. Other subscribed users can comment on messages or leave their reactions. When a message is posted in a channel, the channel ID is indicated as the author.

A group is a chronologically ordered collection of messages from participating users with the option to subscribe to new messages, managed by one administrator user or several users with administrator and moderator access rights. Unlike a channel, all group members can create messages and react to them. Comments, as a separate nested collection of messages, are not available in a group. The class diagram (Figure 1) shows the structure of the above-described elements of the Telegram messenger. The activity of non-privileged users may be limited by the number of messages a user can send in an hour. The ability to comment on messages is not provided in the group.

The Telegram data model includes messages, channels, and users subscribed to them. As shown in Figure 1, each message consists of content, reactions, and view statistics. Message content can include text, audio and video data. A separate type of message is a telegram circle video, which does not include other types of data. Messages that include multiple media elements (images, audio recordings, videos, etc.) are represented as a group of simple messages (media_group) with a common media_group_id identifier.

A reaction to a message is a way of evaluating a message in which a user expresses their opinion in the form of one or more Unicode characters from the emoji group. The overall evaluation of a message is represented by an associative array in which the key is a Unicode emoji character and the value is the number of reactions (evaluations) left by users with the specified key.

The Telegram social network API allows developers to download chat information, including its type (channel or group), list of participants, and collection of messages. The content of the downloaded messages includes not only text data, but also design elements: sections of text highlighted with font styles, URL and email addresses, graphic elements, user IDs, hashtags, and other elements. Each message from a channel or chat is characterized by the following attributes [30]:

• ID (integer)—Message identifier.
• Message (string)—Message text.
• Date (datetime)—Date and time of message creation.
• URLs (array)—Contains all URLs that appear in the text of the message.
• Mentions (array)—Contains explicit references to peers in the form of “@peer_name”.
• fwd_id (long)—An identifier of the peer whose message was forwarded (copied).
• media_group_id (long)—identifier of a message group (media group). A message group is displayed as a single message with multiple media elements and text.
• Entities—Message formatting elements, including text styles and elements highlighted with a special style, such as URLs and email addresses, mentions of user names, bank card numbers, etc.
• Reactions (nested JSON-object)—contains user reactions to the message in the form of special Unicode characters such as , , , etc.:
  • Totals (array)—Contains summary information about reactions: how many users reacted to the message with a specific Unicode character.
• Array elements:
  • Reaction (Unicode emoji character)—contains one Unicode character from the emoji special character group.
  • Count (long)—Number of user reactions.
• recent_reactions (array)—Contains detailed data about reactions: how a specific peer reacted; not supported by all channels and chats.
• Array elements:
  • peer_id (long)—Peer identifier.
  • Reaction—Contains one Unicode character.
• Replies (array of messages)—User comments (replies) to the message. Each comment is a message represented as a JSON object with the structure shown above.

The Telegram network API imposes restrictions on continuous data downloads. Frequent calls to API methods or the use of identifiers for download of non-existent (deleted) messages, users, and channels will result in blocking. The duration of each subsequent block increases and may exceed 20 h. Our experience with API usage has shown that continuous message downloading in batches of 100 items is possible with a pause of at least two seconds between calls.

3.2. Using a Text Dataset in Continuous Authentication Tasks

Continuous authentication is a security process that operates throughout a user session and uses biometric [31,32], behavioral [33,34], or contextual [35,36] (geolocation, network parameters, temporal context) data to determine user authenticity.

Some categories of user data may be unavailable, which limits the possibility of continuous authentication. In this regard, it is interesting to use text data, such as posts in messengers and social networks, as a basis for continuous authentication. Preparing datasets for experimental analysis and developing continuous authentication methods that process text data can allow the use of source text data as an independent source of information available to third-party services without the need to access closed or confidential data. This is especially relevant in the context of implementing business processes for organizations that use user message analysis, for example, for marketing, sociological, and research purposes, where publication texts serve as an independent and valuable resource [16,19].

Machine learning and text preprocessing methods used to establish authorship [37,38,39,40,41] can also be effectively used in continuous authentication tasks. Analysis of stylistic features and linguistic patterns, which are identified using algorithms, allows the creation of a unique user profile based on their written speech. Thus, methods originally aimed at determining text authorship expand the capabilities of continuous authentication, providing more reliable and adaptive protection. It should be noted that group profiles on social networks are often maintained by several authors and contain reposts from news channels, but they often have common requirements for the style of publications and the interpretation of events, which is of particular research interest when solving such problems.

There is a critical shortage of realistic, yet controlled and ethically sound test environments for developing prolonged authentication methods. We fill this gap by offering a formalized method for generating synthetic datasets. This method allows us to create marked sequences based on real public data (Telegram channels) that realistically model a compromise scenario (change in authorship while maintaining the topic), ensuring control over the level of anomalies, and also allow for rigorous benchmarking of different algorithms. Thus, we provide not just another dataset, but a toolkit for creating reproducible benchmarks that allow for the exploration of prolonged authentication methods in realistic but ethically safe conditions, without the need to access private data.

3.3. Threat Model

The dataset is intended for research in the field of continuous authentication of Telegram channels. It simulates three types of threats: (1) author change (another person starts posting messages at a certain point in time, and their style differs from what was previously observed); (2) channel compromise (a small number of messages are added as a result of unauthorized access); and (3) style imitation, hidden advertising (messages from another source are edited to match the style and vocabulary of the original author). Synthetic posts labeled 1 reproduce these threats to evaluate algorithms for detecting changes in authorship, including minor changes in style.

3.4. Ethical Concerns

The dataset consists of messages collected from public Telegram channels. The downloading was not targeted at specific channels or users; the list of channels was selected from TGStat [20] and supplemented with links mentioned within these channels. Although the data is public and not anonymized, no attempts were made to profile or identify individual users. There are two tools in the Telegram messenger: groups and channels. The dataset consists only of channel messages. The channel does not contain explicit indication of the author ID of a message. Thus, the channel does not allow for establishing a correspondence between a message and a user with author privileges.

Synthetic messages added for continuous authentication tasks simulate changes in authorship or style and do not correspond to real users, which allows for safe experimentation. Overall, the dataset strikes a balance between research utility and ethical responsibility, allowing for the study of authorship, style, and message dynamics without revealing private information.

4. Materials and Methods

4.1. Source of Data on Collected Channels

Messages for the time period from 1 September 2022 to 1 December 2024 have been downloaded. The upload process consisted of two stages: initial and additional. The lists of channels for the initial upload were obtained from TGStat [20], Russia’s largest catalog of Telegram channels and chats, under the heading “Economy”. In the alternative analytics service Telemetr [42], the economy category is represented by fewer elements compared to TGStat. During the initial downloading of messages, an additional list of channels was compiled, mentioned in messages in the form of a username, a link to a user, or in the form of a forwarded (quoted) message. Then, messages from channels in the additional list were downloaded. Thus, the most well-known economic channels in the Russian-language segment of the Telegram messenger were covered.

The constructed dataset has several inherent limitations that define its scope. First, it carries a platform selection bias, as it includes only public channels indexed by TGStat [20], potentially omitting private, new, or unlisted sources. Second, it is thematically and linguistically narrow, focused solely on Russian-language economic discourse, which limits its generalizability to other topics or languages. Third, the data reflects a specific temporal snapshot and may not capture long-term linguistic shifts. Therefore, this dataset is best utilized as a purpose-built benchmark for methodological research in stylometry and continuous authentication rather than as a representative sample for broad socio-economic analysis.

To export messages, the generated channel list is saved in a document database and used until the export process is complete. During the export process (Figure 2), an active channel is set, from which messages are downloaded in small batches to prevent blocking. Each channel metadata includes a status and a list of users and other channels mentioned in it. Text data is processed before saving. When each message is saved, log entries are updated, allowing the download to resume after a stop. When the channel is fully downloaded, the next channel in the list is set as active.

After messages are downloaded, they are processed and enriched with economic data (Figure 3). Messages with the same mediagroup_id identifier are combined, as they are displayed as a single message in the Telegram network client. The exchange’s trading day calendar is taken into account when adding economic data. Messages created on weekends have the price and exchange indicators values from the most recent previous trading day.

4.2. Description of the Dataset Structure

TGEconomicDataset dataset was stored in a MongoDB database, which enables fast query execution and the selection of necessary data samples. A document data model was used to create the dataset, which made it possible to preserve the structure of Telegram messages with nested elements and arrays of attribute values. The document model allowed the message schema to be expanded as the experiments progressed. The list of downloaded channels is presented in the “chats” collection. A description of the MongoDB collections, which contain the synthesized labeled collections for research in the field of continuous authentication, is provided in Section 4.3.

Table 1. Description of attributes of the “chats” collection.

Attribute Name	Description
_id	MongoDB document identifier
Title	Channel name exactly as in Telegram
posted	Date the document was added to the collection
timestamp	Date of data collection in Unix format, i.e., the number of seconds that have elapsed since 00:00:00 UTC on 1 January 1970.
Collection	Collection name where messages from the channel are stored
Source	Source (if the data is loaded from Telegram, then the tag is “tg”)
ch_mentions	Mentioned channels in the channel
forwards_from_chat	Channels from which messages are forwarded to the channel
forwards_from_user	Users from whom messages are forwarded to the channel
tg_urls	URLs mentioned in the channel messages
Origin	Source of information about the channel, either TGStat [41] or a mention in another channel
members_count	Number of subscribers (participants)
Completed	Bit flag (1 if the channel messages are completely downloaded)
last_id	Last downloaded message ID
updated	Bit flag (1 if all messages of the channel are processed)
updated_mg	Bit flag (1 if messages with the same media group are merged)

shows the attributes of the “chats” collection. Channel messages are stored in separate collections. Each message in a channel is described by a set of attributes, which are listed in

Table 2. Description of attributes of collections containing messages from Telegram channels.

Attribute Name	Description
_id	MongoDB document identifier
text	Message text
timestamp	Date of publication of the message in Unix format, i.e., the number of seconds that have elapsed since 00:00:00 UTC on 1 January 1970.
posted_str_date	Date of publication of the message in the format “DD/MM/YYYY”
posted	Date of the message creation
market_entities	Dictionary with values of financial instruments
views	Message view count in a Telegram channel
msg_id	Telegram message ID
forwards	The number of message forwards/reposts in a Telegram channel
media	Type of media
reactions	Dictionary of reactions to the message
edit_date	Date of the message editing
hashtags	Array of hashtags
entities	Array of message entities
mentions	Array of mentions
tg_urls	Array of Telegram URLs (https://t.me/…) in the message
symbols	Number of symbols in the message
words	Number of words in the message

. The stock market indicators used to enrich each message are presented in the “market_entities” attribute. A detailed description of these indicators is provided in Section 6 of this study.

4.3. Method for Obtaining Labeled Datasets Representing Channel Mixtures Intended for Solving the Problem of Continuous Authentication

The task of typical user behavior requires evaluation of the sensitivity of the methods being developed on different user groups in different subject areas. Also, it is necessary to assess the possibility of improving the effectiveness of these methods through the use of additional information, such as comments on user messages being analyzed.

To solve such problems, including the problem of continuous authentication based on collected datasets, synthetic datasets with class labels were constructed, simulating a change in editorial policy in connection with the sale or theft of personal pages, using channels as an example. This simulation was carried out by adding messages from a similar channel to the main channel. The channels, on which the mixtures were based, were selected so that they belonged to the same general topic and were similar in terms of the average number of words in a publication (message).

Next, channel mixes were constructed in one of two ways:

• The latest messages from the second channel were added to the messages from the first channel, according to a predefined ratio/percentage. By default, the proportion of added messages is 10%. The choice of a 10% anomaly level is dictated by the key requirement of the continuous authentication task—minimizing detection delay. An anomaly must remain a rare event to preserve its diagnostic value as an indicator of compromise. A high proportion of anomalies transforms them into a new stable pattern, which contradicts the goal of early detection of a subtle deviation in the dataset. This threshold allows the validation of the model’s ability to quickly detect an intrusion before it becomes statistically predominant. Thus, messages added from another channel represent the proportion of “normal behavior” in terms of editorial, stylistic, and content policy, while added messages represent outliers. The two channels were selected so that the messages belonged to the same list of topics and had a similar average publication length. Given that the added publications were written by a different group of authors, they have different stylistic and syntactic characteristics and can thus be identified as outliers relative to “normal” messages. The date of the “injected” messages is taken from the original normal messages, and an additional synthesized date field is added, formed on the basis of the average frequency of publications in the normal part of the collection. In order to conduct experiments on collections of the same size, synthetic datasets of equal size were formed: 5, 10, and 50 thousand original messages.
• A specified percentage of messages (by default, 10% of the messages from the source channel) from the second channel, arranged in chronological order, were added to the messages from the first main channel. The set of messages for these dates was taken from the first channel and replaced with messages from the second channel. The publication dates were also added from the second channel. Unique message identifiers were also added from the second channel. The second method gives a the possibility to take into account the impact of global economic news on the subject of messages in economic channel publications and makes such a dataset more plausible. The number of original messages remains the same as it was initially, with the exception of the inserted messages.

The “to_inject” collection stores multiple pairs consisting of two collections that are similar in terms of the average number of words per message. Based on these pairs, the above-mentioned annotated collections are synthesized. Information about mixed messages is presented in a special collection called “injected_chats” with the following set of attributes (

Table 3. Set of attributes for the collection of injected chats.

Attribute Name	Description
_id	Record identifier
avg_word_inj	Average number of words in a channel’s message from which outlier posts are added
avg_word_main	Average number of words in posts on the original channel with non-outlier posts.
collection	Name of the resulting synthesized collection
collection_inj	Name of the collection containing raw data from the Telegram channel with outlier messages
collection_main	Name of the collection containing raw data from the main Telegram channel with non-outlier posts
injected_count	Number of added outlier messages
count_main	Number of messages marked as original non-outlier
Percent	Percentage of outliers
size	The number of messages; if 0, the channel contains all messages. Otherwise, the number of latest messages that were taken from the source channel.
type	collection synthesis method: type 1 corresponds to method 1; type 2 to method 2, described above.

). Each mixed channel message is characterized by a set of added attributes presented in

Table 4. Metadata for synthesized datasets.

Attribute Name	Description
_id	Publication ID
text	Message text
timestamp	Timestamp of the original dataset
newtimestamp	For added outlier message, the timestamp is set based on the average frequency of publications in the main channel.
outlier	Outlier tag: 0, normal message; 1, outlier.

.

Table 5. Fragments of injected dataset.

Channel	Message Text	Outlier Tag
Name of the synthesized collection: PerfecProfit_and_whalebotalerts_10_size_5000_type1
PerfecProfit	HI PRICE Tiker—MAGN Price—55.705 06.05.2024—10:03:00 #MAGN”	0
	HI PRICE Tiker—YNDX Price—4282.6 06.05.2024—10:03:00 #YNDX”	0
whalebotalerts	117 BTC ($11,321,512) transferred from Kraken to Unknown Sender’s balance: 0	1
	Crypto Fear/Greed Index Status: Extreme Greed Value: 84/100 Next Update in 19 h	1

shows examples of normal messages and messages considered to be outliers. The data sample shows that it is extremely difficult for humans to visually detect outliers.

4.4. Empirical Validation of Synthetic Datasets

To validate how well the synthetic data reflect real scenarios of channel authorship changes according to the proposed threat model (Section 3.3), we conducted an empirical analysis. We used 30 type 1 datasets and 30 type 2 datasets. Type 1 datasets contained 5000 Telegram messages with a controlled anomaly rate of 10% (label 1 represents anomalous messages). Type 2 datasets had an anomaly percentage of 9–13% and varied in size from approximately 4000 to 34,000 messages.

Due to computational constraints, we applied stratified sampling to type 2 datasets: from each dataset, we extracted a fixed-size subsample of 4000 messages while preserving the original distribution of legitimate and anomalous messages. During stratification, we performed preprocessing to remove messages without meaningful textual content (emoji-only messages, media without text, etc.). This preprocessing slightly adjusted the anomaly proportions, resulting in an actual anomaly rate of 6.2–16.3% (mean 11.7% ± 2.2%) for type 2 datasets.

The experimental design followed the threat model hierarchy: the most challenging scenario (threat 3) combines authorship change with style imitation, while the second-most challenging scenario (threat 1) preserves topic consistency without style imitation (see Section 3.3).

Topic homogeneity was ensured through multiple approaches. First, all Telegram channels were selected from the economics category on TGstat [20] (see Section 4.1). Second, we performed BERTopic [43] topic modeling on a sample of 300,000 messages from the full corpus (~2.9 million messages; Section 5). The modeling confirmed that over 65% of messages belong to economic themes, with the most frequent topics being Russian economy (26%), cryptocurrencies and investments (16%), and foreign policy/economics (18%). Additionally, frequent cross-references between channels further indicate thematic proximity (see Section 5).

Focusing on a close average number of words when creating synthetic datasets, as well as relatively close publication dates, potentially makes the style of publications similar and models threats 1 or 3. In this work, we focus on the most complex cases (threats 1 and 3), as they are of the greatest practical interest for continuous authentication systems. threat 2, although important, is a more trivial task in terms of detection. Thus, the goal of the experimental analysis is to evaluate the degree of similarity and overlap between normal and anomalous messages.

To quantify the distribution overlap between legitimate (label 0) and anomalous (label 1) messages, we employed three complementary metrics:

• Cosine distances between text vector representations allow assessing semantic similarity at the level of individual messages, for which the following are used:
  • Inter-class cosine distance—the distance from objects of the opposite class to the centroid.
  • Inter-centroid distances—distances between the centroids of opposite classes.
• Fréchet Distance (FD) [44] is a strict measure for comparing multivariate distributions that accounts not only for the position of distribution centers (like cosine distance), but also for their shape and spread. In addition to FD, normalized FD is calculated in the range 0 to 1 for interpretability, enabling comparison of complexity across different datasets independently of absolute FD values. Normalized FD represents an inverted and scaled version of FD in the range 0 to 1, where 1 corresponds to complete closeness of distributions, and 0 to their maximum divergence.

The choice of metrics is motivated by the need to evaluate both local semantic proximity and global distribution similarity in relation to the threat model. Vector representations for all 270,000 messages were obtained using the pre-trained rubert-tiny2 model [45]. The selection of this compact model is justified by its efficiency for Russian-language texts and computational constraints when processing this volume of data.

Complete numerical results for all 60 datasets are available in the research repository (Data Availability Statement). Analysis of type 1 experimental results (

Table 6. Validation metrics statistics for 30 type 1 datasets.

Metric	Mean ± SD	Range [Min, Max]	Interpretation
Cosine distance between centroids	0.232 ± 0.076	[0.069, 0.337]	High semantic similarity between classes
Fréchet Distance	0.607 ± 0.230	[0.205, 0.864]	Strong distribution overlap (all FD < 1.0)
Normalized closeness	0.940 ± 0.019	[0.915, 0.979]	Extremely challenging verification scenario
Distance from class 0 to centroid 1	0.359 ± 0.080	[0.203, 0.476]	Inter-class proximity (class 0 → 1)
Distance from class 1 to centroid 0	0.397 ± 0.089	[0.225, 0.507]	Inter-class proximity (class 1 → 0)

) via cosine similarity reveals high semantic coherence: 87% of datasets (26 of 30) exhibit inter-centroid distances below 0.30 (mean = 0.232 ± 0.076). Inter-class distance analysis further indicates substantial distribution overlap, with class 0 samples averaging 0.359 ± 0.080 from the class 1 centroid, and class 1 samples averaging 0.397 ± 0.089 from the class 0 centroid.

The Fréchet Distance analysis (Table 6) confirmed strong distribution overlap: all 30 datasets exhibit FD < 1.0 (mean = 0.607 ± 0.230, range [0.205, 0.864]). These values correspond to extremely challenging classification cases. Since FD remained below 1.0 for all datasets, the synthetic datasets are suitable for modeling the most difficult threats—specifically when a new author team attempts precise style imitation.

The normalized closeness score (0.940 ± 0.019) quantitatively confirms that the created datasets constitute a challenging test benchmark for authentication systems.

To visually illustrate the degree of distribution overlap, Figure 4 presents two-dimensional PCA projections of embeddings for two extreme cases from type 1 datasets: the closest case (FD = 0.205) and the farthest case (FD = 0.864). Even for the dataset with the smallest FD value, clear distribution overlap is observable, confirming that all synthetic datasets model complex, non-trivial user verification scenarios.

Table 7. Validation metrics statistics for 30 type 2 datasets.

Metric	Mean ± SD	Range [Min, Max]	Interpretation
Cosine distance between centroids	0.135 ± 0.075	[0.018, 0.279]	High semantic similarity between classes
Fréchet Distance (FD)	0.414 ± 0.218	[0.094, 0.813]	Substantial distribution overlap
Normalized closeness	0.959 ± 0.022	[0.919, 0.991]	Challenging verification scenario
Distance from class 0 to centroid 1	0.359 ± 0.080	[0.220, 0.490]	Interpretation
Distance from class 1 to centroid 0	0.322 ± 0.075	[0.211, 0.491]	High semantic similarity between classes

presents the experimental results for type 2 datasets. Cosine similarity analysis reveals high semantic coherence: 90% of datasets (27 of 30) exhibit inter-centroid distances below 0.20 (mean = 0.135 ± 0.075). Inter-class distances further demonstrate distribution proximity: class 0 samples average 0.359 ± 0.080 from the class 1 centroid, while class 1 samples average 0.322 ± 0.075 from the class 0 centroid, indicating substantial class overlap. The mean cosine distance in type 2 datasets is nearly half that of type 1 (0.135 versus 0.232), reflecting stronger semantic relatedness between legitimate and anomalous messages.

Fréchet Distance analysis confirms substantial distribution overlap for type 2 datasets: all 30 datasets exhibit FD < 1.0 (mean = 0.414 ± 0.218, range [0.094, 0.813]). FD values show greater variability compared to type 1, reflecting the impact of stratification and the inherent variability of original anomaly distributions.

The histogram in Figure 5 illustrates the FD distribution, while Figure 6 shows the cosine centroid distance distribution. Both histograms confirm that type 2 datasets model more challenging scenarios associated with the threat of author collective change coupled with message style imitation.

Overall, the experimental results confirm that the synthetic datasets align with threat scenarios 1 and 3. Analysis of Fréchet Distance (FD) and cosine measures revealed substantial overlap between legitimate and anomalous message distributions across all 60 datasets (FD < 1.0), modeling challenging continuous authentication cases.

5. Analysis of the Collected Dataset

The entire dataset is 6.3 GB in size, contains 486 channels, and 2,918,303 posts, mainly in Russian. Only 10 channels contain posts in English. The language of the channels was identified using the langdetect library [46]. Considering that many channels repost messages from news channels and also mention the news title and the news channel itself, these news channels are also included in the dataset described. In order to characterize the channels in this dataset, Figure 7 shows the cumulative distribution function of a discrete random variable—the number of messages per channel. At the same time, with a probability of 0.996, the number of messages in the channel is no more than 100,000.

The cumulative distribution function of the number of subscribers to a channel shows that most channels have fewer than 250,000 subscribers (with a probability of 0.903), which is also confirmed by the histogram shown in Figure 8. The histogram (Figure 9) shows that the number of subscribers to a channel is distributed according to a power distribution function.

Some messages in the dataset are marked with hashtags and also contain references to other channels. Analysis of the dataset showed that only 456,504 posts contain hashtags, which is 15.6% of the total number of posts. The number of hashtags contained in a single post varies from 1 to 136. Figure 10 shows the cumulative distribution function of the discrete random variable of hashtag usage in posts. When constructing this cumulative function, posts in which hashtags are not specified were not taken into account. It should be noted that most publications containing hashtags use fewer than 10 (probability 0.996). Figure 11 shows a fragment of the histogram for 10 or fewer hashtags.

Table 8. Most frequent hashtags in the dataset.

Rank	Hashtag	Frequency of Use in the Dataset	Rank	Hashtag	Frequency of Use in the Dataset
1	#poccия’	32,205	26	#Пoлитикa’	3781
2	#Aкции’	22,349	27	#пpoгнoз’	3742
3	#Импyльc’	21,585	28	#инφляция’	3716
4	#кpиптo’	20,152	29	#гaз’	3641
5	#cшa’	13,746	30	#YNDX’	3490
6	#oтчeтнocть’	11,059	31	#ROSN’	3452
7	#aкции’	9588	32	#cot’	3438
8	#нeφть’	8560	33	#бaнки’	3359
9	#GAZP’	7322	34	#LKOH’	3307
10	#pынки’	7084	35	#SMLT’	3082
11	#BTC’	6454	36	#sentiment’	2919
12	#SBER’	6024	37	#дивидeнды’	2901
13	#fx’	5805	38	#OZON’	2831
14	#китaй’	5708	39	#POSI’	2829
15	#дкп’	5659	40	#VKCO’	2808
16	#экoнoмикa’	5515	41	#TCSG’	2785
17	#гeoпoлитикa’	5488	42	#дивидeнд’	2736
18	#eвpoпa’	4854	43	#epзнoвocти’	2719
19	#мaкpo’	4591	44	#нoвocти’	2693
20	#MOEX’	4416	45	#GMKN’	2632
21	#Ъyзнaл’	4211	46	#AFLT’	2524
22	#caнкции’	4100	47	#ALRS’	2501
23	#VTBR’	4024	48	#CHMF’	2477
24	#Maкpo’	3969	49	#Пpeмapкeтинг’	2477
25	#NVTK’	3832	50	#Пoлитикa’	3781

shows the top 100 most popular hashtags across the entire dataset.

Other channels are mentioned in 18.8% of messages, of which only 1.2% of mentions do not contain mentions of the same channel or mentions of special accounts such as bots. Figure 12 shows the cumulative distribution function of the discrete random variable of mention usage. When constructing this cumulative function, publications in which mentions are not represented or only one mention is used, i.e., a mention of the same channel or a channel bot with the same name, were not taken into account. Most publications contain no more than 10 mentions, with a probability of 0.996. Figure 13 shows a fragment of the histogram for 200 or fewer mentions. The most frequent mentions are listed in

Table 9. Most frequent mentions.

№	Mention	Number of Mentions
1	@ifax_go’	2655
2	@kriptokondrashov’	1438
3	@selfinvestor’	1204
4	@investinfopro_mmvb’	1137
5	@bitkogan’/Bitkogan’	953
6	@banksta’	916
7	@AK47pfl’	592
8	@offcrypt’	544
9	@wisedruidd’	485
10	@keepcontact’	457
11	@voin_dv’	452
12	@rocket1signals’	450
13	@interfaxonline’	432
14	@ntvnews’	418
15	@fanimani_official’	361
16	@investi_usa’	330
17	@rybar’	290
18	@alfabank’	280
19	@Dohod’	271
20	@FiboAlex’	264

. For comparison,

Table 10. Most frequent mentions without filtering.

№	Mention	Number of Mentions
1	@WhaleBotAlerts’	148,634
2	@banksta’	26,161
3	@bankrollo’	23,360
4	@if_market_news’	21,955
5	@interfaxonline’	21,531
6	@bankoffo’	19,148
7	@kommersant’	18,549
8	@banki_oil’	14,939
9	@marketsnapshot’	14,221
10	@ifax_go’	13,996
11	@voenkorKotenok’	13,516
12	@PerfecProfit’	11,791
13	@fatcat18’	11,213
14	@kstati_p’	11,005
15	@kfm936’	10,473
16	@ejdailyru’	8586
17	@selfinvestor’	8461
18	@bitkogan’	7625
19	@ivan_utenkov13’	6473
20	@milinfolive’	6347

shows the most frequent mentions without any filtering.

Analysis of the text of publications in the collected dataset showed that out of the total number of messages, 1690 contain only emojis without a single word, and 174,847, or 6%, contain images without accompanying text. Figure 14 and Figure 15 show the cumulative distribution function of the discrete random variable of the number of characters and words in publications in the collected dataset.

Unigrams and bigrams were also collected across the entire dataset. Each token is a word, with the exception of the stop word list, which also includes channel names. Given the significant computational costs involved in processing all the data, unigrams and bigrams were collected using the following less computationally intensive algorithm. For each channel, the 100 most frequent unigrams and bigrams were found, and then a list of the most frequent unigrams and bigrams in the dataset was compiled from this set of unigrams.

Table 11. Most frequent unigrams.

№	Original Unigram	Unigram in English	Number of Occurrences
1	гoд	year	1,058,316
2	Poccия	Russia	643,307
3	мoчь	be able	433,262
4	кoмпaния	company	395,978
5	pынoк	market	379,351
6	poccийcкий	Russian	361,870
7	cвoй	its	359,526
8	aкция	stock	330,631
9	цeнa	price	325,888
10	нoвый	new	321,402
11	pyбль	ruble	310,296
12	CШA	USA	309,627
13	PΦ	RF	307,033
14	дeнь	day	263,045
15	cтpaнa	country	261,620
16	млpд	billion	260,943
17	Укpaинa	Ukraine	247,127
18	вpeмя	time	243,380
19	чeлoвeк	person	228,869
20	дaть	give/provide	226,986

and

Table 12. Most frequent bigrams.

№	Original Bigram	Bigram in English	Number of Occurrences
1	2023 гoд	year 2023	130,353
2	2022 гoд	year 2022	92,893
3	2024 гoд	year 2024	85,779
4	млpд pyб	billion RUB	66,443
5	млpд pyбль	billion rubles	61,484
6	Bлaдимиp Пyтин	Vladimir Putin	40,298
7	чиcтый пpибыль	net profit	37,892
8	бaнк Poccия	Bank of Russia	33,731
9	binance tx	Binance transaction	32,004
10	ключeвoй cтaвкa	key rate	30,119
11	sender’s balance	sender’s balance	29,858
12	balance tx	balance transaction	29,858
13	PИA нoвocть	RIA Novosti/RIAN	28,315
14	индeкc мocбиpжa	MOEX Index/Moscow Exchange Index	27,663
15	Coinbase tx	Coinbase transaction	26,726
16	млн pyбль	million rubles	24,845
17	BC PΦ	Armed Forces of the Russian Federation (AF RF)	24,626
18	yгoлoвный дeлo	criminal case	23,973
19	coвeт диpeктop	board of directors	22,764
20	oбъëм измeнeниe	volume change	21,666
21	измeнeниe дeнь	daily change	21,639
22	цeнa oткpытиe	open price	21,593
23	oткpытиe cвeчa	opening of the candle	21,585

show the most frequent bigrams and unigrams across the entire dataset.

In addition, an analysis of the message topics was performed based on the Topicbert model [43] in unsupervised mode. Topic modeling across the entire dataset requires significant computational resources, including a large amount of RAM at the stage of clustering the obtained data by topic [47]. Therefore, to reduce costs, a sampling method was used, during which a training dataset of 300,000 publications was formed, preserving the proportions of messages from each channel. This volume is related to the available computing power. The quality criteria [48] for topic modeling were as follows: Coherence Score = 0.77, Topic Diversity = 0.89. The language model “paraphrase-multilingual-MiniLM-L12-v2” [43] was used for topic modeling with the minimum cluster size set to 100 in order to capture more significant topics. The resulting model allows us to identify topics for each publication from the collected dataset. The number of automatically identified topics was 300, with each topic occupying 7% or less of the sample. The model did not recognize 48% of publications, which is a normal result for the given type of model. In order to evaluate the topics globally, all topics were converted by combining similar clusters.

Table 13. Message topics obtained by combining small clusters.

Percent	Topic	Keywords in English	Original Keywords
26	Russia’s economy, market, banking sector, investments, finance, and events in Russia and around the world	‘billion’, ‘rubles’, ‘Russia’, ‘USA’, ‘2023’, ‘rub’, ‘million’, ‘companies’, ‘RF’, ‘oil’, ‘CB’, ‘2024’, ‘2022’, ‘market’	‘млpд’, ‘pyблeй’, ‘Poccия’, ‘cшa’, ‘2023’, ‘pyб’, ‘млн’, ‘кoмпaнии’, ‘PΦ’, ‘нeφть’, ‘ЦБ’, ‘2024’, ‘2022’, ‘pынoк’
18	Russia’s foreign policy and economy. Finance.	‘Russia’, ‘RF’, ‘said’, ‘USA’, ‘president’, ‘Putin’, ‘Trump’, ‘Ukraine’, ‘ukrainians’, ‘head’, ‘reported’	‘Poccия’, ‘PΦ’, ‘зaявил’, CШA’, ‘пpeзидeнтa’, ‘пyтин’, ‘тpaмпa’, ‘Укpaинa’, ‘Tpaмп’, ‘пpeзидeнт’’глaвa’, ‘cooбщил’
17	Situation in Russian regions: UAV strikes, air defense operations, statements by authorities	region, UAF, reported, RF, Russia, Defense Ministry, victims, direction, data, result, governor, air defense	‘oблacти’, ‘BCУ’, ‘cooбщил’, ‘cooбщили’, ‘PΦ’, ‘paйoнe’, ‘Poccия’, ‘минoбopoны’, ‘пocтpaдaвшиx’, ‘нaпpaвлeнии’, ‘дaнным’, ‘peзyльтaтe’, ‘гyбepнaтop’, ‘ПBO’
16	Cryptocurrency. Investments	‘unknown’, ‘tx’, ‘transfered’, ‘transfered unknown’, ‘usdc’, ‘btc’, ‘000’, ‘coinbase’, ‘binance’, ‘sender’, ‘sender balance’, ‘balance tx’, ‘balance’, ‘unknown coinbase’	‘unknown’, ‘tx’, ‘transfered’, ‘transfered unknown’, ‘usdc’, ‘btc’, ‘000’, ‘coinbase’, ‘binance’, ‘sender’, ‘sender balance’, ‘balance tx’, ‘balance’, ‘unknown coinbase’
8	News. Investment news. Bonds.	More details, bonds, privet Rostov, privet, Rostov, news, offer, rubles, billion, investments, shares, currency, exchange rate	‘пoдpoбнee’, ‘oблигaций’, ‘privet rostov’, ‘privet’, ‘rostov’, ‘нoвocть’, ‘пpeдлoжить’, ‘pyб’, ‘млpд’, ‘news’, ‘инвecтиции’, ‘aкции’, ‘вaлютa’, ‘кypc’
4	Events in Israel	Israel, Hamas, Gaza, USA, Gaza Strip, Iran, Strip, Netanyahu, IDF, stated	‘Изpaиль’, ‘XAMAC’, ‘Гaзa’, ‘CШA’, ‘ceктope гaзa’, ‘Иpaн’, ‘ceктope’, ‘Heтaньяxy’, ‘ЦAXAЛ’, ‘зaявил’, ‘ceктop Гaзa’
2	Telegram-censored publications	infringement, due copyright, message couldn, displayed device, device due, couldn displayed, copyright infringement, copyright, displayed, device	‘infringement’, ‘due copyright’, ‘message couldn’, ‘displayed device’, ‘device due’, ‘couldn displayed’, ‘copyright infringement’, ‘copyright’, ‘displayed’, ‘device’
2	Weather events in Russia.	degrees, temperature, Moscow, expected, snow, wind, heat, abnormal precipitation, ISS, weather, forecasters, at night, rain	‘гpaдycoв’, ‘тeмпepaтypa’, ‘Mocквa’, ‘oжидaeтcя’, ‘cнeг’, ‘вeтep’, ‘жapa’, ‘aнoмaльный’ ‘ocaдкoв’, ‘мкc’, ‘пoгoдa’, ‘cинoптики’, ‘нoчью’, ‘дoждь’, ‘oжидaютcя’
2	China’s economy	China, stocks, USA, alibaba, Xi, People Republic of Chine, dollars, chinese, Hong Kong, chinastocks	‘Kитaй’, ‘China’, ‘aкции’, ‘CШA’, ‘alibaba’, ‘Cи’, ‘KHP’, ‘дoллapoв’, ‘китaйцы’, ‘китaйcкиx’, ‘гoнкoнгcкиx’, ‘китaйcкиe’, ‘chinastocks’
1	Economy of Georgia, South America, Africa, European Union	Georgia, France, Maduro, Tbilisi, Venezuela, protesting, president, protesters, Niger, protests, countries, protest, Argentine, police	‘Гpyзия’, ‘Φpaнция’, ‘Maдypo’, ‘Tбилиcи’, ‘Beнecyэлa’, ‘пpeзидeнтa’, ‘пpoтecтyющиe’, ‘нигep’, ‘пpoтecты’, ‘cтpaны’, ‘Apгeнтинa’, ‘пoлиция’
1	Artificial intelligence, apps, social media, and investments	AI, Apple, Telegram, iPhone, Google, company, Microsoft, VK, Twitter, Russia, users, intelligence, artificial intelligence, artificial	‘ИИ’, ‘Apple’, ‘Telegram’, ‘iPhone’, ‘Google’, ‘кoмпaнии’, ‘Microsoft’, ‘VK’, ‘Twitter’, ‘Poccия’, ‘пoльзoвaтeлeй’, ‘интeллeктa’, ‘иcкyccтвeннoгo интeллeктa’, ‘иcкyccтвeннoгo’

shows the most frequent topics with a share exceeding 1%, excluding noise publications.

Figure 16 shows the publications obtained, broken down by topic by reducing the dimensionality of their vector representation to two. It can be noted that events occurring in the world are well reflected in economic channels, along with economic topics.

Given that economic channels often quote and refer to news channels, the topic modeling data was compiled taking into account publications from news channels, which were also downloaded as reference channels. It should also be noted that six channels were censored by the Telegram messenger. From a copyright perspective, such publications were placed in a separate cluster, and the texts of their publications were unavailable and replaced with messages from Telegram about censorship.

6. Enriching Collected Data with Financial Indicators and Analyzing Them

In order to understand the reason for the appearance of a particular publication on economic topics, as well as for a deeper semantic understanding of the publications, the collected dataset was enriched with stock market quotes and indicators [49].

The time interval from 1 September 2022, to 1 December 2024, for which messages were uploaded, corresponds to the development of the trend in the gold futures contract for the growth of exchange gold, including correction and resumption of the trend (Figure 17).

Looking at the price of gold as a safe-haven asset in isolation can overlook commodity price cycles, periods of market panic, and declines in the number of lots purchased with borrowed money. Therefore, in addition to gold quotes, quotes for the USD/RUB currency pair, BRENT oil, the dollar index (DXY), and bitcoin (BTC) are also downloaded. The following indicators are calculated for each exchange instrument (ticker):

• A 200-day moving average (200MA).
• The closing price is above or below the 200-day average (AboveMA).
• The number of consecutive days during which the quote value exceeds the moving average value. The greater the number of days, the longer the upward trend develops without significant corrective movement.
• Relative strength indicator (RSI), reflecting overbought or oversold conditions.
• When trading in the above-mentioned exchange instruments did not take place, holidays and weekends are supplemented with quotes from the last trading day.

The relationship between intraday volatility (the absolute difference between the maximum and minimum prices) and the number of mentions of a stock exchange instrument was analyzed. The p-value does not exceed 0.001 in all cases. This analysis made it possible to check for the presence of channels whose publications are related to the volatility of the aforementioned exchange instruments (

Table 14. Correlation between the volatility of an exchange-traded instrument and the frequency of its mentions in channel messages.

Exchange-Traded Instrument	Channel	Correlation
Gold (futures contract)	@CalendarBG	0.30
USDRUB	@bogdanoffinvest	0.311
	@scalpon	0.302
	@marketsnapshot	0.301
Bitcoin	@whalebotalerts	0.567
	@futures_Utushkin	0.536
	@PKNCash	0.339
	@crypto_nwz	0.335
	@scalpon	0.333
	@usertrader3	0.315
BRENT crude oil (futures contract)	@tass_agency	0.382
	@cbrstocks	0.376
	@markettwits	0.362
	@if_market_news	0.362
	@trade_system007	0.322
	@marketsnapshot	0.321
	@macroresearch	0.316
	@prime1	0.313
	@oil_capital	0.307
Dollar index	@marketsnapshot	0.37
	@finchehov	0.331

).

For each of the exchange instruments, channels were identified in which the frequency of mentions of the instrument correlates with volatility. An increase in volatility traditionally attracts the attention of economic analysts and the interested audience. The identified channels confirm the presence of authors and readers who follow price changes of the exchange instrument.

7. Conclusions and Discussion

This paper presents a new open dataset and methodological toolkit developed to address key challenges in text data analysis and continuous authentication. Our main contribution is methodological and consists of three interrelated components:

• A resource for stylometry in Social Media Publishing Economic News. We have collected and structured a dataset of Russian-language Telegram channels on economic topics, enriched it with metadata, and synchronized the financial indicators. Its structure allows for the study of linguistic patterns in relation to external context, while maintaining a balance between research utility and ethical requirements, as the data does not allow for author identification.
• A framework for generating realistic test data. The core methodological innovation of this work is our proposed method for generating synthetic labeled datasets designed to simulate an author-change scenario. This framework models a realistic account compromise, where messages from different authors are interwoven while preserving a unified thematic focus. The controlled anomaly level (set at ~10%) is crucial for validating models’ ability to perform early detection of authorship shifts—a fundamental requirement for continuous authentication systems.
• A tool for research reproducibility. We provide a complete set of scripts for dataset formation, enrichment, and the generation of synthetic collections. This ensures full reproducibility of the results and offers researchers a ready-made instrument for creating similar datasets for other subject areas and languages.

Thus, the primary contribution of this work lies not in economic analysis, but in advancing the methodology for evaluating machine learning models in the field of continuous text-based authentication, while providing a unique testing ground. The resources presented enable the comparison of models under controlled yet realistic conditions, where the core challenge is the detection of stylistic anomalies against a backdrop of thematic homogeneity.

This challenge is further amplified by the specific nature of the data—namely, a substantial volume of texts from professional market analysts. Messages of this type combine a rigorous logical framework with elements of expressiveness; they are logical and structured (akin to reports) on one hand, yet often emotional and persuasive (like forecasts) on the other. This duality allows for a more nuanced validation of algorithms in tasks of stylometry, including sentiment analysis in professional discourse and the extraction of cause-and-effect assertions from text. This opens avenues for further research in the security of text data streams, adaptive authentication methods, and style analysis in social networks.