2026· Computers, Materials & Continua· 0 citations· 48 references
Abstract
: Social network platforms have become primary channels for information dissemination, yet they are increasingly exploited by anomalous users such as bots, fake accounts, and coordinated disinformation spreaders. These malicious actors manipulate public opinion, spread misinformation and undermine platform integrity, posing severe threats to the security of the online ecosystem. Accurate detection of such users is challenging because they often organize into sophisticated high-order connection patterns that extend beyond local neighborhoods. Existing methods address this by either injecting predefined motifs as handcrafted features, which lack flexibility to discover unknown patterns, or employing higher-order Graph neural networks (GNNs) at prohibitive costs. Crucially, neither method treats structural information as learnable knowledge that can be automatically acquired from data and explicitly represented. To bridge this gap, we propose SparseGNN, a structural-knowledge-enhanced framework for anomalous user detection. It regards atomic subgraph patterns as fundamental, learnable units of structural knowledge. This framework is concatenated with original node features and fed into any standard GNN, without modifying the backbone architecture. Experiments on real-world datasets demonstrate that SparseGNN improves the accuracy and F1-score of standard GNNs for anomalous users detection without requiring predefined patterns, while maintaining linear complexity. Because the learned atomic patterns capture global high-order topology, the resulting structural knowledge representation is inherently less sensitive to localized edge perturbations, incidentally conferring improved stability under adversarial structural attacks.
Social bots threaten the integrity of online ecosystems by engaging in coordinated opinion manipulation. While Graph Neural Networks (GNNs) have become a dominant paradigm for bot detection, modern camouflaged bots strategically follow benign users to evade detection, creating structural heterophily that degrades the performance of standard homophilic GNN aggregators; moreover, many existing detectors offer limited forensic explainability. To address these challenges jointly, we propose XHBot (eXplainable Heterophily-aware Bot detector), a framework that is robust to heterophilic relation camouflage while providing transparent, multi-level forensic evidence for platform moderation. XHBot couples three components: Spectral-Guided Topology Refinement (SGTR), which down-weights camouflage edges by their contribution to the graph’s high-frequency (Dirichlet) energy before aggregation; Tri-Channel Heterophily-Aware Aggregation (THCA), which separates homophilic, heterophilic, and self-identity signals; and Contrastive Prototype Disentanglement (CPD), which decouples behavioural signatures from social positioning. Evaluated on TwiBot-20, TwiBot-22, and Cresci-2017 under a unified protocol, XHBot reaches an F1 score of 0.9474 on TwiBot-20, improving over a competitive suite of recent baselines (including RGT, NeighborSense, and HW-GNN) by 9.64%. Its Hierarchical Forensic Explanation (HFE) module extracts both instance-level subgraphs and community-level diagnostic motifs, which we assess quantitatively (Fidelity, Sparsity) and through qualitative case studies. These results indicate that decoupling behavioural signatures from adversarial social positioning is valuable for modern bot detection, and that combining accuracy with interpretable evidence supports deployment in real-world moderation settings.
Quang-Vinh Dang, Phuong-Lan Nguyen, Dat Le et al.· EAI Endorsed Transactions on...· 0 citations
Misinformation on social media platforms poses significant risks to public opinion and decision-making due to its rapid dissemination. Traditional text-based approaches often struggle to capture the complex interactions between textual content, user behavior, and contextual relationships. To address this limitation, we propose a heterogeneous graph-based misinformation detection framework integrating user, tweet, and hashtag relations with diverse text representations. In our design, tweets are encoded using both sparse lexical features (Term Frequency–Inverse Document Frequency (TF-IDF)) and dense semantic embeddings (Sentence-Bidirectional Encoder Representations from Transformers (SBERT)), while classification is performed through multiple Graph Neural Network (GNN) architectures, namely Graph Sample and Aggregate (GraphSAGE), Graph Convolutional Network (GCN), and Graph Attention Network (GAT). To account for potential class imbalance, class-weighted loss functions are incorporated during training. Experiments on the TruthSeeker dataset demonstrate that GraphSAGE consistently outperforms GCN and GAT across all feature settings. In particular, the best-performing configuration—TF-IDF combined with GraphSAGE—achieves 94% Accuracy and 94% F1-score, with comparable performance under both standard and class-weighted training. Analysis of training dynamics indicates stable convergence across configurations; GraphSAGE-based models continue to benefit from longer training, reaching 96.73% accuracy at 200 epochs. Comparative evaluations suggest that modeling heterogeneous relations with diverse feature representations provides advantages over purely text-based baselines within the examined setting. These results highlight the value of integrating relational graph structures with complementary feature representations for misinformation detection. While class-weighted training does not substantially alter performance under the near-balanced dataset distribution, it maintains stable learning across classes without degrading overall results. The proposed framework provides a foundation for future extensions, including federated learning, explainability techniques, and cross-domain applications in multilingual contexts.
Gözde KARATAŞ BAYDOĞMUŞ, Onder Demir· PeerJ Computer Science· 0 citations
Reinforcement learning-based intrusion detection systems achieve strong detection performance in unbalanced network traffic, but offer limited insight into which features have played a significant role in driving their decisions. To determine the key network features in detecting malicious packets, this paper presents a Graph Attention Network (GAT) model architecture applied to a feature dependency graph to analyze inter-feature influence in an RL-based intrusion detection system. Rather than ranking features independently, the framework uses GAT attention weights to reveal which feature relationships the model relies on most and how those relationships differ between malicious and benign traffic networks. Applied to a Rainbow DQN agent, a well-known RL-based agent, and trained on real botnet network traffic, the analysis identifies interpretable behavioral signatures in the feature influence structure that distinguish attack traffic from legitimate connections. The results demonstrate that attention-based influence analysis provides a richer characterization of detection decisions than per-feature importance methods alone.
Tania-Amanda Nkoyo Fredrick Eneye, A. Namin· Annual International Compute...· 0 citations
The proliferation of social bots poses a persistent threat to online social platforms, making accurate and efficient detection increasingly critical. Although recent graph-based methods have achieved notable progress by modeling user interactions, many of them implicitly assume neighborhood consistency and degrade in sparse, directed, and heterophilic social graphs, where a user's neighborhood may poorly reflect its own attributes. In this work, we propose SNBot, a novel social bot detection framework that explicitly models the discrepancy between node self-representations and their neighborhood embeddings. SNBot first learns unified self-representations from multi-modal user attributes through a lightweight type-aware encoding scheme. It then performs message passing on an augmented directed graph using a bidirectional aggregation mechanism, which separately captures incoming and outgoing interactions to better characterize asymmetric behaviors. By preserving and exploiting self–neighborhood representation discrepancies rather than over-smoothing them, SNBot produces more discriminative node representations. Extensive experiments on multiple real-world benchmark datasets demonstrate that SNBot consistently outperforms state-of-the-art methods.
Qilong Lin, Jingya Zhou· Annual International ACM SIG...· 0 citations
Errors in graph-structured data introduce significant noise, severely constraining the performance of downstream tasks. Existing anomaly detection methods face the dual challenges of unknown error patterns and scarce annotated data. Traditional rule-based approaches suffer from poor generalizability, while embedding-based methods, which typically generate negative samples via random substitution, struggle to capture complex error types that are semantically related yet structurally incorrect. To address these issues, this paper proposes a graph embedding-based error detection method via contrastive learning. Specifically, the method first establishes a complementary shared view through structural linking rules. Departing from traditional node-centric modeling paradigms, it treats each triple as a hyper-node, enabling data-driven modeling of semantic consistency. Subsequently, we design local and global semantic-aware encoding modules. These modules not only leverage Bidirectional Gated Recurrent Units (Bi-GRU) to model the local semantic structure of triples, but also employ attention mechanisms to mitigate the negative propagation of potential errors at the global level. Finally, by integrating a semantic matching-based scoring mechanism with a contrastive learning-based scoring mechanism, our model can jointly evaluate the internal self-consistency of triples with complex relational patterns and their external consistency. In addition, our experimental results on two open-source datasets demonstrate that the proposed method outperforms or ranks second to existing state-of-the-art baselines in error detection tasks, exhibiting strong validity and performance.
Gaojun Shan, Liping Cong, Xiaohong Sun et al.· International journal of sof...· 0 citations
With the increasing heterogeneity of social networks and online interaction systems, generalist graph anomaly detection (GAD) has become essential for identifying abnormal and fraudulent behaviors in complex environments. However, most existing GAD approaches rely heavily on domain-specific semantic alignment, which substantially restricts their ability to learn transferable node representations and often leads to poor generalization on unseen graph domains. To address this challenge, we propose HIerarchical Interaction MOdeling for zero-shot generalist GAD (termed HIMO-GAD). HIMO-GAD enables anomaly detection across diverse graph domains without retraining or access to target-domain supervision by modeling the evolutionary trajectories of node representations across hierarchical structural depths, thereby capturing interaction patterns that exhibit strong cross-domain stability. Specifically, HIMO-GAD integrates two core components: (1) a Dynamic Interaction Modeling Module that characterizes cross-layer interaction evolution to extract transferable representations, and (2) an Anomaly-Aware Regulation Mechanism that combines gradient immunity and centralization regularization to suppress overfitting and stabilize cross-domain generalization. Extensive experiments on multiple real-world graph datasets demonstrate that HIMO-GAD consistently outperforms state-of-the-art baselines in strict zero-shot settings, achieving up to a 10% improvement in key evaluation metrics and exhibiting strong generalization across heterogeneous graph domains.
Xiangping Zheng, Xuan Feng, Bo Wu et al.· Proceedings of the 32nd ACM...· 0 citations