# RTbust: Exploiting Temporal Patterns for Botnet Detection on Twitter

arXiv: https://arxiv.org/abs/1902.04506 · HTML: https://mlsanity.com/paper/1902.04506/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Feb 2019.

## Built on by (most cited first, 27 of 27)

- [TwiBot-22: Towards Graph-Based Twitter Bot Detection](https://mlsanity.com/paper/2206.04564/) (2022)
- [What Does the Bot Say? Opportunities and Risks of Large Language Models in Social Media Bot Detection](https://mlsanity.com/paper/2402.00371/) (2024)
- [RoSGAS: Adaptive Social Bot Detection with Reinforced Self-Supervised GNN Architecture Search](https://mlsanity.com/paper/2206.06757/) (2022)
- [MGTAB: A Multi-Relational Graph-Based Twitter Account Detection Benchmark](https://mlsanity.com/paper/2301.01123/) (2023)
- [Simplistic Collection and Labeling Practices Limit the Utility of Benchmark Datasets for Twitter Bot Detection](https://mlsanity.com/paper/2301.07015/) (2023)
- [BotDGT: Dynamicity-aware Social Bot Detection with Dynamic Graph Transformers](https://mlsanity.com/paper/2404.15070/) (2024)
- [Fine-Grained Prediction of Political Leaning on Social Media with Unsupervised Deep Learning](https://mlsanity.com/paper/2202.12382/) (2022)
- [Exposing Influence Campaigns in the Age of LLMs: A Behavioral-Based AI Approach to Detecting State-Sponsored Trolls](https://mlsanity.com/paper/2210.08786/) (2022)
- [Demystifying Misconceptions in Social Bots Research](https://mlsanity.com/paper/2303.17251/) (2023)
- [Socialbots on Fire: Modeling Adversarial Behaviors of Socialbots via Multi-Agent Hierarchical Reinforcement Learning](https://mlsanity.com/paper/2110.10655/) (2021)
- [Identification of Twitter Bots Based on an Explainable Machine Learning Framework: The US 2020 Elections Case Study](https://mlsanity.com/paper/2112.04913/) (2021)
- [MulBot: Unsupervised Bot Detection Based on Multivariate Time Series](https://mlsanity.com/paper/2209.10361/) (2022)
- [Unmasking Social Bots: How Confident Are We?](https://mlsanity.com/paper/2407.13929/) (2024)
- [On the efficacy of old features for the detection of new bots](https://mlsanity.com/paper/2506.19635/) (2025)
- [Political Communities on Twitter: Case Study of the 2022 French Presidential Election](https://mlsanity.com/paper/2204.07436/) (2022)
- [Bayes Risk Consistency of Nonparametric Classification Rules for Spike Trains Data](https://mlsanity.com/paper/2308.04796/) (2023)
- [BSG4Bot: Efficient Bot Detection based on Biased Heterogeneous Subgraphs](https://mlsanity.com/paper/2410.05356/) (2024)
- [RABot: Reinforcement-Guided Graph Augmentation for Imbalanced and Noisy Social Bot Detection](https://mlsanity.com/paper/2602.21749/) (2026)
- [Healthy Twitter discussions? Time will tell](https://mlsanity.com/paper/2203.11261/) (2022)
- [BotArtist: Generic approach for bot detection in Twitter via semi-automatic machine learning pipeline](https://mlsanity.com/paper/2306.00037/) (2023)
- [Posts of Peril: Detecting Information About Hazards in Text](https://mlsanity.com/paper/2405.17838/) (2024)
- [Iteration over event space in time-to-first-spike spiking neural networks for Twitter bot classification](https://mlsanity.com/paper/2407.08746/) (2024)
- [Do We Trust What They Say or What They Do? A Multimodal User Embedding Provides Personalized Explanations](https://mlsanity.com/paper/2409.02965/) (2024)
- [Behavioral Sequence Modeling with Ensemble Learning](https://mlsanity.com/paper/2411.02174/) (2024)
- [What is a Social Media Bot? A Global Comparison of Bot and Human Characteristics](https://mlsanity.com/paper/2501.00855/) (2025)
- [Multimodal Coordinated Online Behavior: Trade-offs and Strategies](https://mlsanity.com/paper/2507.12108/) (2025)
- [Bots Don't Sit Still: A Longitudinal Study of Bot Behaviour Change, Temporal Drift, and Feature-Structure Evolution](https://mlsanity.com/paper/2512.17067/) (2025)

## Abstract (arXiv)

Within OSNs, many of our supposedly online friends may instead be fake accounts called social bots, part of large groups that purposely re-share targeted content. Here, we study retweeting behaviors on Twitter, with the ultimate goal of detecting retweeting social bots. We collect a dataset of 10M retweets. We design a novel visualization that we leverage to highlight benign and malicious patterns of retweeting activity. In this way, we uncover a 'normal' retweeting pattern that is peculiar of human-operated accounts, and 3 suspicious patterns related to bot activities. Then, we propose a bot detection technique that stems from the previous exploration of retweeting behaviors. Our technique, called Retweet-Buster (RTbust), leverages unsupervised feature extraction and clustering. An LSTM autoencoder converts the retweet time series into compact and informative latent feature vectors, which are then clustered with a hierarchical density-based algorithm. Accounts belonging to large clusters characterized by malicious retweeting patterns are labeled as bots. RTbust obtains excellent detection results, with F1 = 0.87, whereas competitors achieve F1 < 0.76. Finally, we apply RTbust to a large dataset of retweets, uncovering 2 previously unknown active botnets with hundreds of accounts.