Social-Media Bot Analyzer / Detector · Hacking Project

Detect and score automated and coordinated inauthentic social-media accounts with explainable, feature-level evidence.

**The problem**
Coordinated inauthentic behavior (CIB), bot armies, and automated amplification networks distort public discourse, manipulate trending topics, and inflate engagement metrics. Platforms and researchers lack accessible, transparent tooling to distinguish automated accounts from genuine users at scale. This gap enables influence operations, astroturfing, and financial-fraud botnets to operate undetected across social platforms.

**What you'll build**
Build a multi-signal bot-detection system that ingests account metadata, posting cadence, network graph structure, and linguistic features, then classifies accounts using supervised ML (gradient-boosted trees / neural nets) combined with behavioral heuristics and temporal-burst analysis. Layer in coordination detection via graph clustering (e.g., co-retweet / co-timing networks) to surface bot swarms rather than isolated accounts, with an explainable scoring dashboard.

**Objective** — Detect and score automated and coordinated inauthentic social-media accounts with explainable, feature-level evidence.

**Expected outcome** — A deployed detection pipeline plus dashboard that classifies accounts, visualizes coordination networks, and outputs a per-account bot-likelihood report with contributing signals.

**Difficulty** — Advanced — requires ML feature engineering, graph analytics, and adversarial-robustness awareness against evasive bots.

**Primary category** — OSINT / SOCMINT Analytics; Secondary = AI/ML Security, Threat Hunting, Data Science

**Security domains** — Primary = Threat Intelligence; Secondary = Security Research, AI Security, Blue Team

**Technical focus** — Behavioral analytics, coordinated inauthentic behavior detection, social network analysis, graph clustering, temporal/burst analysis, NLP feature extraction, supervised classification, anomaly detection, adversarial ML

**Core technologies** — Languages: Python; Frameworks/Libraries: scikit-learn, XGBoost/LightGBM, NetworkX/igraph, spaCy, pandas, PyTorch (optional GNN); Security Tools: Botometer (benchmark), Maltego (pivoting); Cloud/Infra: Docker, cloud VM/serverless for collectors; AI/Data: feature stores, embeddings, GNN (GraphSAGE) optional; Databases: PostgreSQL, Neo4j (graph), Redis

**Where it's valued** — Social platforms/trust & safety, threat-intel vendors, elections integrity/civil society, brand-protection & fraud, journalism/fact-checking

**Careers it builds toward** — Trust & Safety Analyst, Threat Intelligence Analyst, OSINT/SOCMINT Analyst, Data Scientist (Integrity), Influence-Operations Researcher

**Framework alignment**
• MITRE ATT&CK: Not a host-intrusion project; maps conceptually to influence-operation tradecraft — use DISARM (AMITT) framework for disinformation TTPs (e.g., Develop Personas, Amplify, Automate). ATT&CK Enterprise is largely N/A.
• NIST CSF 2.0: Identify (asset/threat mapping), Detect (anomalous behavior identification)
• OWASP: N/A (API Top 10 relevant if exposing detection API — API4 Unrestricted Resource Consumption)
• CIS Controls v8: Control 8 (Audit Log Management) for collection provenance; largely N/A

**Innovation** — Improved Existing Solution — bot detection exists (Botometer), but adding transparent coordination-network mapping and explainable scoring differentiates it. Scores: Innovation 6/10, Startup 6/10, Enterprise-Readiness 6/10, Patent = Possible.