{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T08:27:47Z","timestamp":1787905667578,"version":"build-2784847793"},"reference-count":60,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2023,1,5]],"date-time":"2023-01-05T00:00:00Z","timestamp":1672876800000},"content-version":"vor","delay-in-days":4,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001343","name":"University of Pretoria","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001343","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100010039","name":"SMU","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100010039","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,1,5]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Users of online social network (OSN) platforms, e.g. Twitter, are not always humans, and social bots (referred to as bots) are highly prevalent. State-of-the-art research demonstrates that bots can be broadly categorized as either malicious or benign. From a cybersecurity perspective, the behaviors of malicious and benign bots differ. Malicious bots are often controlled by a botmaster who monitors their activities and can perform social engineering and web scraping attacks to collect user information. Consequently, it is imperative to classify bots as either malicious or benign on the basis of features found on OSNs. Most scholars have focused on identifying features that assist in distinguishing between humans and malicious bots; the research on differentiating malicious and benign bots is inadequate. In this study, we focus on identifying meaningful features indicative of anomalous behavior between benign and malicious bots. The effectiveness of our approach is demonstrated by evaluating various semi-supervised machine learning models on Twitter datasets. Among them, a semi-supervised support vector machine achieved the best results in classifying malicious and benign bots.<\/jats:p>","DOI":"10.1093\/cybsec\/tyac015","type":"journal-article","created":{"date-parts":[[2023,1,8]],"date-time":"2023-01-08T03:26:46Z","timestamp":1673148406000},"source":"Crossref","is-referenced-by-count":19,"title":["Classifying social media bots as malicious or benign using semi-supervised machine learning"],"prefix":"10.1093","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9240-8035","authenticated-orcid":false,"given":"Innocent","family":"Mbona","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Pretoria , Pretoria 0002, South Africa"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jan H P","family":"Eloff","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Pretoria , Pretoria 0002, South Africa"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2023,1,5]]},"reference":[{"key":"2023052911454399500_bib1","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1007\/s11747-019-00695-1","article-title":"The future of social media in marketing","volume":"48","author":"Appel","year":"2020","journal-title":"J Acad Mark Sci"},{"key":"2023052911454399500_bib2","first-page":"91","article-title":"Detecting clusters of fake accounts in online social networks categories and subject descriptors","author":"Freeman","year":"2015","journal-title":"Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security, AIsec 15"},{"key":"2023052911454399500_bib3","doi-asserted-by":"crossref","first-page":"292","DOI":"10.1016\/j.neucom.2019.08.109","article-title":"A survey of CAPTCHA technologies to distinguish between human and computer","volume":"408","author":"Xu","year":"2020","journal-title":"Neurocomputing"},{"key":"2023052911454399500_bib4","first-page":"963","article-title":"The paradigm-shift of social spambots: evidence, theories, and tools for the arms race","volume-title":"Proceedings of the 26th International Conference on World Wide Web Companion 2017","author":"Cresci","year":"2017"},{"key":"2023052911454399500_bib5","doi-asserted-by":"crossref","DOI":"10.1109\/ICCCNT.2017.8204141","article-title":"Anomalous behavior detection in social networking","volume-title":"Proceedings of the 8th International Conference on Computing, Communications and Networking Technologies, ICCCNT 2017","author":"Chauhan","year":"2017"},{"key":"2023052911454399500_bib6","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.osnem.2017.09.001","article-title":"Privacy and security in online social networks: a survey","volume":"3\u20134","author":"Kayes","year":"2017","journal-title":"Online Soc Networks Media"},{"key":"2023052911454399500_bib7","article-title":"Fake twitter accounts: profile characteristics obtained using an activity-based pattern detection approach","volume-title":"Proceedings of the 5th ACM on International Conference on Multimedia Retrieval","author":"Gurajala","year":"2015"},{"key":"2023052911454399500_bib8","first-page":"237","article-title":"The automated detection of trolling bots and cyborgs and the analysis of their impact in the social media","volume-title":"Proceedings of the European Conference on Cyber Warfare and Security ECCWS 2016","author":"Paavola","year":"2016"},{"key":"2023052911454399500_bib9","doi-asserted-by":"crossref","first-page":"1200","DOI":"10.1109\/ACCESS.2017.2656635","article-title":"Sybil defense techniques in online social networks: a survey","volume":"5","author":"Al-Qurishi","year":"2017","journal-title":"IEEE Access"},{"key":"2023052911454399500_bib10","first-page":"709","article-title":"Implementation of ensemble-based prediction model for detecting sybil accounts in an osn","volume-title":"Advances in Intelligent Systems and Computing","author":"Roy","year":"2021"},{"key":"2023052911454399500_bib11","first-page":"92","article-title":"On profiling bots in social media","volume-title":"Lecture Notes Computer Science (Including Subseries Lecture Notes in Artificial Intelligence, Lecture Notes on Bioinformatics) 10046 LNCS","author":"Oentaryo","year":"2016"},{"key":"2023052911454399500_bib12","first-page":"1","article-title":"Do social bots dream of electric sheep? A categorisation of social media bot accounts","volume-title":"Proceedings of the 28th Australasian Conference on Information Systems ACIS 2017","author":"Stieglitz","year":"2017"},{"key":"2023052911454399500_bib13","doi-asserted-by":"crossref","first-page":"113383","DOI":"10.1016\/j.eswa.2020.113383","article-title":"Detection of malicious social bots: a survey and a refined taxonomy","volume":"151","author":"Latah","year":"2020","journal-title":"Expert Syst Appl"},{"key":"2023052911454399500_bib14","doi-asserted-by":"crossref","first-page":"102250","DOI":"10.1016\/j.ipm.2020.102250","article-title":"Detection of bots in social media: a systematic review","volume":"57","author":"Orabi","year":"2020","journal-title":"Inf Process Manag"},{"key":"2023052911454399500_bib15","doi-asserted-by":"crossref","first-page":"102498","DOI":"10.1016\/j.ijhcs.2020.102498","article-title":"\u201cIt wouldn't happen to me\u201d: privacy concerns and perspectives following the Cambridge Analytica scandal","volume":"143","author":"Hinds","year":"2020","journal-title":"Int J Hum Comput Stud"},{"key":"2023052911454399500_bib16","doi-asserted-by":"crossref","first-page":"102","DOI":"10.1016\/j.cose.2017.10.008","article-title":"Social engineering in cybersecurity: the evolution of a concept","volume":"73","author":"Hatfield","year":"2018","journal-title":"Comput Secur"},{"key":"2023052911454399500_bib17","article-title":"Bot development for social engineering attacks on Twitter","author":"Abreu","year":"2020"},{"key":"2023052911454399500_bib18","doi-asserted-by":"crossref","DOI":"10.1109\/ASYU48272.2019.8946437","article-title":"Instagram fake and automated account detection","volume-title":"Proceedings of the Conference on Innovations in Intelligent Systems and Applications, ASYU 2019","author":"Akyon","year":"2019"},{"key":"2023052911454399500_bib19","volume-title":"DECIFE: Detecting Collusive Users Involved in Blackmarket following Services on Twitter","author":"Dutta","year":"2021"},{"key":"2023052911454399500_bib20","first-page":"1","article-title":"Political bots and the manipulation of public opinion in Venezuela","volume-title":"SSRN Electron J","author":"Forelle","year":"2015"},{"key":"2023052911454399500_bib21"},{"key":"2023052911454399500_bib22","first-page":"1","article-title":"Threat or opportunity? Examining social bots in social media crisis communication","volume-title":"Proceedings of the 29th Australian Conference on Information Systems, ACIS 2019","author":"Brachten","year":"2018"},{"key":"2023052911454399500_bib23"},{"key":"2023052911454399500_bib24","first-page":"496","article-title":"SocialBotHunter: Botnet detection in twitter-like social networking services using semi-supervised collective classification","volume-title":"Proceedings of the 16th IEEE International Conference on Dependable, Autonomic and Secure Computing, IEEE International Conference on Pervasive Intelligence and Computing, 4th IEEE International Conference on Big Data Intelligence and Computing","author":"Dorri","year":"2018"},{"key":"2023052911454399500_bib25","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1002\/hbe2.115","article-title":"Arming the public with artificial intelligence to counter social bots","volume":"1","author":"Yang","year":"2019","journal-title":"Hum Behav Emerg Technol"},{"key":"2023052911454399500_bib26","first-page":"129","article-title":"A soft computing approach for benign and malicious web robot detection","volume-title":"Expert Syst Appl","author":"Zabihimayvan","year":"2017"},{"key":"2023052911454399500_bib27","doi-asserted-by":"crossref","first-page":"101715","DOI":"10.1016\/j.cose.2020.101715","article-title":"A one-class classification approach for bot detection on Twitter","volume":"91","author":"Rodr\u00edguez-Ruiz","year":"2020","journal-title":"Comput Secur"},{"key":"2023052911454399500_bib28","first-page":"280","article-title":"Online Human Bot Interaction","volume-title":"Proceedings of the 11th International AAAI Conference on Web and Social Media, ICWSM 2017","author":"Varol","year":"2017"},{"key":"2023052911454399500_bib29","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1145\/2818717","article-title":"The rise of social bots","volume":"59","author":"Ferrara","year":"2016","journal-title":"Commun ACM"},{"key":"2023052911454399500_bib30","doi-asserted-by":"crossref","first-page":"6540","DOI":"10.1109\/ACCESS.2018.2796018","article-title":"Using machine learning to detect fake identities: bots vs humans","volume":"6","author":"Van\u00a0Der\u00a0Walt","year":"2018","journal-title":"IEEE Access"},{"key":"2023052911454399500_bib31","first-page":"3672","article-title":"Detecting fake accounts on social media","volume-title":"Proceedings of the 2018 IEEE International Conference on Big Data, Big Data 2018","author":"Khaled","year":"2019"},{"key":"2023052911454399500_bib32","first-page":"349","article-title":"Of bots and humans (on Twitter)","volume-title":"Proceedings of the 2017 IEEE\/ACM International Conference on Advances in Social Network Analysis and Mining, ASONAM 2017","author":"Gilani","year":"2017"},{"key":"2023052911454399500_bib33","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3298789","article-title":"A large-scale behavioural analysis of bots and humans on twitter","volume":"13","author":"Gilani","year":"2019","journal-title":"ACM Trans Web"},{"key":"2023052911454399500_bib34","first-page":"817","article-title":"DeBot: Twitter bot detection via warped correlation","volume-title":"Proceedings of the 16th IEEE International Conference on Data Mining (ICDM)","author":"Chavoshi","year":"2017"},{"key":"2023052911454399500_bib35","doi-asserted-by":"crossref","first-page":"28855","DOI":"10.1109\/ACCESS.2019.2901864","article-title":"Detecting malicious social bots based on clickstream sequences","volume":"7","author":"Shi","year":"2019","journal-title":"IEEE Access"},{"key":"2023052911454399500_bib36","doi-asserted-by":"crossref","first-page":"085201","DOI":"10.1088\/1751-8113\/44\/8\/085201","article-title":"A \u201cmissing\u201d family of classical orthogonal polynomials","volume":"44","author":"Vinet","year":"2011","journal-title":"J Phys A Math Theor"},{"key":"2023052911454399500_bib37","doi-asserted-by":"crossref","first-page":"54","DOI":"10.3390\/fi12030054","article-title":"Feature selection algorithms as one of the Python data analytical tools","volume":"12","author":"Pilnenskiy","year":"2020","journal-title":"Futur Internet"},{"key":"2023052911454399500_bib38","doi-asserted-by":"crossref","first-page":"14629","DOI":"10.1109\/ACCESS.2018.2805712","article-title":"Benford's law and Dunbar's number: does Facebook have a power to change natural and anthropological laws?","volume":"6","author":"Striga","year":"2018","journal-title":"IEEE Access"},{"key":"2023052911454399500_bib39","doi-asserted-by":"crossref","first-page":"e0135169","DOI":"10.1371\/journal.pone.0135169","article-title":"Benford's law applies to online social networks","volume":"10","author":"Golbeck","year":"2015","journal-title":"PLoS ONE"},{"key":"2023052911454399500_bib40","first-page":"977","article-title":"Let's see your digits: anomalous-state detection using Benford's Law","volume-title":"Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Part F1296","author":"Maurus","year":"2017"},{"key":"2023052911454399500_bib41","first-page":"1","article-title":"Benford's Law can detect malicious social bots","volume-title":"First Monday","author":"Golbeck","year":"2019"},{"key":"2023052911454399500_bib42","doi-asserted-by":"crossref","first-page":"369","DOI":"10.1016\/j.ins.2021.09.038","article-title":"Feature selection using Benford's law to support detection of malicious social media bots","volume":"582","author":"Mbona","year":"2022","journal-title":"Inf Sci"},{"key":"2023052911454399500_bib43","volume-title":"Benford\u02bcs Law: Theory and Applications","author":"Miller","year":"2015"},{"key":"2023052911454399500_bib44","doi-asserted-by":"crossref","first-page":"106458","DOI":"10.1016\/j.compeleceng.2019.106458","article-title":"Real-time anomaly detection based on long short-term memory and Gaussian Mixture Model","volume":"79","author":"Ding","year":"2019","journal-title":"Comput Electr Eng"},{"key":"2023052911454399500_bib45","volume-title":"Mastering Machine Learning Algorithms: Expert Techniques for Implementing Popular Machine Learning Algorithms, Fine-Tuning your Models, and Understanding How They Work","author":"Bonaccorso","year":"2020"},{"key":"2023052911454399500_bib46","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2019\/2686378","article-title":"Recent progress of anomaly detection","volume":"2019","author":"Xu","year":"2019","journal-title":"Complex"},{"key":"2023052911454399500_bib47","first-page":"1","article-title":"Inoculating against fake news about COVID-19","volume":"11","author":"van\u00a0der\u00a0Linden","year":"2020","journal-title":"Front Psychol"},{"key":"2023052911454399500_bib48","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s13278-020-00696-x","article-title":"Deep learning for misinformation detection on online social networks: a survey and new perspectives","volume":"10","author":"Islam","year":"2020","journal-title":"Soc Netw Anal Min"},{"key":"2023052911454399500_bib49","doi-asserted-by":"crossref","first-page":"42","DOI":"10.1186\/s40537-020-00320-x","article-title":"A comprehensive survey of anomaly detection techniques for high dimensional big data","volume":"7","author":"Thudumu","year":"2020","journal-title":"J Big Data"},{"key":"2023052911454399500_bib50","first-page":"1","article-title":"Online social network analysis: a survey of research applications in computer science","volume":"1","author":"Kurka","year":"2015","journal-title":"Soc Inf Process Netw"},{"key":"2023052911454399500_bib51","doi-asserted-by":"crossref","first-page":"373","DOI":"10.1007\/s10994-019-05855-6","article-title":"A survey on semi-supervised learning","volume":"109","author":"van\u00a0Engelen","year":"2020","journal-title":"Mach Learn"},{"key":"2023052911454399500_bib52","doi-asserted-by":"crossref","first-page":"609","DOI":"10.1016\/j.procs.2017.12.078","article-title":"Anomaly detection in multiplex networks","volume":"125","author":"Mittal","year":"2018","journal-title":"Proc Comput Sci"},{"key":"2023052911454399500_bib53","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1016\/j.jocs.2017.05.029","article-title":"Detecting users\u2019 anomalous emotion using social media for business intelligence","volume":"25","author":"Sun","year":"2018","journal-title":"J Comput Sci"},{"key":"2023052911454399500_bib54","first-page":"1096","article-title":"Scalable and generalizable social bot detection through data selection","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Yang","year":"2020"},{"key":"2023052911454399500_bib55","first-page":"183","article-title":"RTbust: exploiting temporal patterns for botnet detection on twitter","volume-title":"Proceedings of the 11th ACM Conference on Web Science, WebSci 2019","author":"Mazza","year":"2019"},{"key":"2023052911454399500_bib56","volume-title":"Hands-on Machine Learning with Scikit-Learn and Scientific Python Toolkits","author":"Amr","year":"2019"},{"key":"2023052911454399500_bib57","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s12864-019-6413-7","article-title":"The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation","volume":"21","author":"Chicco","year":"2020","journal-title":"BMC Genomics"},{"key":"2023052911454399500_bib58","doi-asserted-by":"crossref","first-page":"429","DOI":"10.1016\/j.ins.2019.11.004","article-title":"Data imbalance in classification: experimental evaluation","volume":"513","author":"Thabtah","year":"2020","journal-title":"Inf Sci"},{"key":"2023052911454399500_bib59","doi-asserted-by":"crossref","first-page":"969","DOI":"10.1007\/s00521-015-2113-7","article-title":"An overview on semi-supervised support vector machine","volume":"28","author":"Ding","year":"2017","journal-title":"Neural Comput Appl"},{"key":"2023052911454399500_bib60","doi-asserted-by":"crossref","first-page":"857","DOI":"10.1145\/3038912.3052677","article-title":"An army of me: Sockpuppets in online discussion communities","volume-title":"Proceedings of the 26th International Conference on World Wide Web","author":"Kumar","year":"2017"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/9\/1\/tyac015\/50476441\/tyac015.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/9\/1\/tyac015\/50476441\/tyac015.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,11]],"date-time":"2024-10-11T20:29:34Z","timestamp":1728678574000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyac015\/6972135"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,1]]},"references-count":60,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1,5]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyac015","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"value":"2057-2085","type":"print"},{"value":"2057-2093","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2023,1,1]]},"published":{"date-parts":[[2023,1,1]]},"article-number":"tyac015"}}