davidbgk
/
larlet-fr-david-cache

title: This is what a graph of 8,000 fake Twitter accounts looks like
url: https://shkspr.mobi/blog/2015/03/this-is-what-a-graph-of-8000-fake-twitter-accounts-looks-like/
hash_url: 7e0da5e7753f006ab85507ff826850aa

<p>Recently I've been plagued with Tweets saying that I'm "trending in London." </p>
<img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Twitter-Spam-Trending-fs8.png" alt="Twitter Spam Trending-fs8" width="846" height="227" class="aligncenter size-full wp-image-20730"/>
<img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Twitter-Spam-Trending-Again-fs8.png" alt="Twitter Spam Trending Again-fs8" width="793" height="245" class="aligncenter size-full wp-image-20742"/>
<img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/More-bloody-spammers-fs8.png" alt="More bloody spammers-fs8" width="770" height="222" class="aligncenter size-full wp-image-20746"/>
<p>As flattering as that is, it's not true. There appears to be a network of Twitter bots which are randomly repeating other people's tweets, ripping off avatars and bios, and generally causing a nuisance.</p>
<p>Looking at the users' Twitter name, I don't think it's unreasonable to think that "ekip_uhokoqeq" and "utadaqusoxeh" are randomly generated sequence of characters. And, without wishing to judge, that photo doesn't <em>look</em> like a Susan...</p>
<p>Let's take a look at one of the user's profile :</p>
<img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Twitter-Spam-Profile-fs8.png" alt="Twitter Spam Profile-fs8" width="814" height="731" class="aligncenter size-full wp-image-20731"/>
<p>It's possible to trace back the bio and photo to different users - they've had their details misappropriated. The Tweets seem to be just randomly taken from other users.</p>
<p>Let's take a look at who this bot is following :</p>
<img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Twitter-Spam-Following-fs8.png" alt="Twitter Spam Following-fs8" width="1186" height="880" class="aligncenter size-full wp-image-20732"/>
<p>Again, random sequences of letters, hijacked bios and photos. Clicking through each of these profiles reveals a network of <em>thousands of fake accounts</em>. </p>
<p>I adapted <a href="http://mark-kay.net/blog/2014/08/15/generating-a-network-graph-of-twitter-followers-using-python-and-networkx/">a script to visualise the network of accounts</a> - this is only looking 3 levels deep (Twitter's API limits make going much further a time consuming task) :</p>
<a href="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Spam-Graph-fs8.png"><img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Spam-Graph-fs8.png" alt="Spam Graph-fs8" width="1060" height="786" class="aligncenter size-full wp-image-20738"/></a>
<p>I used <a href="https://gephi.github.io/">Gephi</a> to draw the graph.</p>
<p>As you can see - there are dozens of randomly named accounts. They appear to only be following each other - I don't think any "real" users are in there. I can only assume that by forming a network like this, they can evade Twitter's filters. The bots can then either start generating spam, be sold off as fake followers, or used for some other unsavoury purpose.</p>
<p>I ran the script over the weekend to a recursive depth of 4 and <strong>identified over 8,000 spam accounts</strong>. Using <a href="http://apps.cytoscape.org/apps/allegrolayout">Cytoscape and Allegro Layout</a> I was able to create this visualisation of the tangled web of connections.</p>
<a href="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Big-Graph-of-Twitter-Spammers-fs8.png"><img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Big-Graph-of-Twitter-Spammers-fs8.png" alt="Big Graph of Twitter Spammers-fs8" width="855" height="790" class="aligncenter size-full wp-image-20747"/></a>
<p>Using <a href="http://graph-tool.skewed.de/">Python's Graph-Tool</a> I generated a somewhat prettier visualisation of how all these accounts are connected.<br/>
<a href="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Network-Diagram-Spammers-fs8.png"><img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Network-Diagram-Spammers-fs8.png" alt="Network Diagram Spammers-fs8" width="1024" height="1024" class="aligncenter size-full wp-image-20750"/></a><br/>
They each mostly follow around 8 accounts - there's a fair bit of clustering. While there are a few accounts with larger follower numbers, it's hard to discern if there's a definitive pattern. The large gap appears to be users who have been suspended.</p>
<p>As the weekend drew to a close, I'd reached the fifth level of my recursive algorithm. Using Cytoscape's "Organic" layout, another interesting pattern emerges.<br/>
<a href="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Circles-of-Spam-fs8.png"><img src="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Circles-of-Spam-fs8.png" alt="Circles of Spam-fs8" width="1024" height="640" class="aligncenter size-full wp-image-20752"/></a><br/>
There appears to be several "loops" - that is bots which are in an almost closed network with each other. I see at least half a dozen circles - the rest appear to be following other fake accounts at random.</p>
<p>The centre of those circles <em>appear</em> to be real people. I can't say <em>why</em> they have lots of fake followers - it's possible that they - or someone else - has just bought them to make it look like they're more popular than they really are. There's no suggestion that they control the fake accounts.</p>
<p>One of the central nodes has <strong>650,000 followers</strong>. It's not possible to know quite how many of those are fake - I'm guessing the majority are.</p>
<p>It seems that there's a nasty nest of these bots. In the last few weeks I've reported a dozen or so for spam - but with literately tens of thousands in the network it's impossible for any individual to make a meaningful impact. </p>
<p>I wish Twitter could track down the source of this problem and eradicate it.</p>
<p>If you want to have a play with this dataset - you can <a href="https://shkspr.mobi/blog/wp-content/uploads/2015/03/Fake-Followers.zip">download a .zip file of the relationships and their metadata</a>.</p>