$1.00 per RT #BostonMarathon #PrayForBoston: Analyzing Fake

Content on Twitter

Sep  17,  2013  

eCrime  Research  Summit  2013  

Adi$  Gupta,  Hemank  Lamba,    

Ponnurangam  Kumaraguru  (PK)  

IIIT-­‐Delhi,  India  

Unifying the Global Response to Cybercrime

2  

About  Precog@IIITD  

Is  spreading  fake  content  an  eCrime?  

FAKE  

RUMORS  

3  

$  

Boston  Blasts  

•  Twin  blasts  occurred  during  the  Boston  Marathon  

– April  15th,  2013  at  18:50  GMT  

•  3  people  were  killed  and  264  were  injured  

•  Suspects  Tamerlan  Tsarnaev  (deceased)  and  Dzhokhar  Tsarnaev  (in  custody)  

•  Huge  volume  of  content  posted  on  social  media  websites,  including  TwiVer  

4  

First  Image  on  TwiIer  (within  4  mins)  

5  

Sample  Fake  Tweets  

6  

>50,000  RTs  

>30,000  RTs  

Our  Contribu$ons  

•  We  characterized  the  spread  of  fake  content  on  TwiVer  using  temporal,  source  and  user  aVributes.  

•  We  applied  linear  regression  model  to  predict  how  viral  a  rumor  would  in  future  based  on  its  current  user  characterisYcs.  

•  We  analyzed  the  acYvity  and  interacYon  graphs  for  the  suspended  user  profiles  created  during  Boston  blasts.    

7  

Data  Descrip$on  

Total tweets 7,888,374 Total users 3,677,531 Tweets with URLs 3,420,228 Tweets with Geo-tag 62,629 Retweets 4,464,201 Replies 260,627 Time of the blast Mon Apr 15 18:50 2013 Time of first tweet Mon Apr 15 18:53 2013 Time of first image Mon Apr 15 18:54 2013 Time of last tweet Thu Apr 25 01:23 2013

8  

Data  Descrip$on  

9  

Data  Descrip$on  

10  

Methodology  

11  

Annota$ng  Viral  Tweets  

Annota$ng  Viral  Tweets  

Six  Rumors  130,690  ReTweets  

128,019  Users  Affected  

Temporal  PaIerns  

14  

Temporal  PaIerns  

15  

True  informaYon  propagaYon  begins  only  a\er  eight  hours  of  the  blast  

Predic$ng  Spread  of  Fake  Content  

•  Using  linear  regression  •  Predict  how  viral  fake  informaYon  /  rumor  would  be  in  future  

based  on  impact  of  users  tweeYng  the  rumor  

•  Impact  based  on:  –  Social  reputaYon  –  Global  engagement  –  Topical  engagement  

–  Likability  –  Credibility  

16  

Predic$ng  Spread  of  Fake  Content  

17  

Results  show  it  is  possible  to  predict  how  viral  a  rumor  would  become  in  future  based  on  aVributes  of  users  currently  propagaYng  the  rumor.  

Suspended  Accounts  

•  31,919  new  TwiVer  accounts  created  during  Boston  blasts,  that  tweeted  about  the  event  

•  Out  of  these  19%  [6,073  accounts]  were  deleted  or  suspended  by  TwiVer  

18  

Fake  /  Malicious  Accounts  

19  

Network  Analysis  of  Fake  Accounts  

20  

Self-­‐loops  

Network  Analysis  of  Fake  Accounts  

21  

Closed  community  

Network  Analysis  of  Fake  Accounts  

22  

Star  topology  

Network  Analysis  of  Fake  Accounts  

23  

Single  links  

Conclusions  &  Future  Work  

•  Based  on  the  insights  from  around  10  events  in  last  two  years  including:  –  England  riots  –  Libya  crisis  –  Mumbai  triple  blasts  

–  Hurricane  Sandy  –  Boston  Blasts  

•  We  are  building  Real-­‐Yme  soluYons  – Browser  plug-­‐in  – Monitoring  tools  

24  

Media  Coverage  

25  

Ques$ons  

? 26  

27  

Thank You!�

aditig@iiitd.ac.in �pk@iiitd.ac.in �

precog.iiitd.edu.in �

Unifying the Global Response to Cybercrime

For any further information, please write to  pk@iiitd.ac.in  

precog.iiitd.edu.in