If you’ve spent more than five minutes on social media, you’ve probably noticed that the platforms occasionally feel like they’re being run by a particularly vindictive committee of parrots, each endlessly repeating whatever phrase they last overheard. And sometimes, that’s not too far from the truth. Coordinated online influence campaigns, state-run, commercially manufactured, or produced by very enthusiastic conspiracy uncles, have become so common that merely scrolling your feed can feel like wading through a shallow lake of weaponised stupidity.

Naturally, you might want to detect this nonsense. And to do that, you need what any respectable intelligence analyst, cybersecurity researcher, or chronically online hobbyist would demand: a behavioural baseline. You need to know what normal looks like before you can identify the suspiciously shiny, suspiciously synchronised gremlins lurking underneath the trending hashtags.

So let’s treat this as a small project. Imagine you’re writing up a research plan for a nosy supervisor, or drafting a threat-intelligence report for the sort of organisation that insists on using “impactful” in business meetings without flinching. We’ll walk through the entire pipeline, from dataset assembly to modelling, through to producing some vaguely respectable output. We’ll even add a sprinkle of code, mostly for dramatic effect.

Grab your metaphorical lab coat. And maybe a stiff drink.

Step Zero: Acquiring a Historical Social Media Dataset (or, How to Excavate a Digital Landfill Without Crying)

To analyse disinformation, you first need data, preferably a large pile of it. Fortunately, social-media platforms generate more data than the average Victorian chimney generates soot, and it’s about as clean. Twitter, TikTok, Facebook, Reddit, Telegram, they all vomit out streams of content, much of it deeply unnecessary, but occasionally useful for research.

The trick is to put together something meaningful. If your dataset contains nothing but three tweets from your aunt and a cat meme from 2017, you will discover precisely nothing except that your modelling pipeline works fine in the presence of utter irrelevance.

A historical dataset, ideally spanning several months or years, should include posts, user metadata, and the relationships between users. In some platforms, Twitter, for example, these relationships are explicit: retweets, replies, mentions. In others, Telegram, for instance, relationships are more inferred: people reposting content from particular channels, bot accounts spamming the same images, that sort of thing.

Before you can do anything useful, you must clean the data. This is the part of the pipeline that everyone pretends is trivial and then spends 80 per cent of their project fixing. Timestamps might be missing. Some posts will have been deleted. Others will be in languages you can’t read but will pretend you can because you once ordered noodles in a Thai restaurant. And then there are the bots, the spammers, the zero-follower accounts which exist solely to broadcast motivational quotes in Comic Sans.

You’ll need to normalise timestamps. You’ll need to strip out corrupted entries. You’ll need to tokenise text into something that a machine can process without having a nervous breakdown. If you’re ambitious, you might even build a graph representation of the data: users as nodes, interactions as edges. This is the data-science equivalent of putting everything into Tupperware before sticking it in the freezer. It’s not essential, but it makes the later cooking a lot easier.

For example, if you’re collecting a small slice of Twitter data using Python, you might end up with something like this:

import pandas as pd

df = pd.read_json("tweet_archive.json", lines=True)
df["timestamp"] = pd.to_datetime(df["timestamp"], utc=True)
df = df.dropna(subset=["user_id", "text"])
df["clean_text"] = df["text"].str.replace(r"http\S+", "", regex=True)

This, of course, hides the truth that you actually spent six days dealing with 47 different timestamp formats, three unexpected crashes, and one user whose account location field contains only the phrase “The Void.”

Such is life.

Dissecting the Dataset: What Exactly Are We Looking For?

Once the data is tidy enough to not immediately induce despair, you can start analysing it. The goal is to uncover patterns of normal behaviour, because once you’ve done that, the abnormal patterns will stand out like a man in a trench coat who thinks wearing sunglasses indoors makes him invisible.

Humans are delightfully inconsistent. Our posting patterns fluctuate depending on when we wake up, when we have lunch, when we get bored at work, and whether or not we’re in a hotel room desperately trying to connect to a Wi-Fi network named after a Tudor period curse. Bots and coordinated networks, by contrast, often exhibit a sinister regularity: evenly spaced posts, suspiciously precise synchronisation, and the remarkable ability to amplify content without the slightest trace of fatigue or sarcasm.

Real users tend to interact with the same small clusters of people. Disinformation networks tend to behave like multi-level marketing recruits, interacting with absolutely everyone in sight. Real linguistic patterns are messy and chaotic. Coordinated networks frequently produce eerily similar phrasing, as though they all followed the same instruction sheet. (Spoiler: they usually do.)

So what we need is a baseline: a portrait of ordinary social-media life. What is the typical posting frequency? How diverse is real human language? What sort of network structure emerges naturally? Once we understand “normal,” we can identify the pockets of “absolutely not normal unless you’re a machine or paid propagandist.”

It’s a bit like ornithology, except instead of birdsong you’re analysing timestamp distributions, and instead of birds you’re dealing with people arguing about geopolitics in the comment sections of a fast-food chain.

Feature Engineering: Turning Behaviour Into Something Mathematical Enough to Impress a Reviewer

Now comes the real work: turning all that organic, messy human behaviour (and inhuman behaviour) into quantifiable features. Feature engineering is the point in the project where you simultaneously feel like a brilliant scientist and a taxonomist labelling beetles. But it must be done.

Consider postings over time. You might expect a normal user to post mostly in the evening, with occasional midnight bursts when they can’t sleep. A bot, however, often posts with the regularity of a metronome. And a coordinated network might explode into activity around specific events with suspicious unity, like a choir that only knows one hymn.

So you compute inter-post intervals. You compute the variance of those intervals. You compute how “bursty” someone’s posting is. You might even compute entropy scores for active hours. It all helps build a portrait of behaviour.

And then there’s the network analysis, the part of the project that determines whether you’re a normal data scientist or someone who looks at a page full of adjacency matrices and thinks, “yes, this is where I belong.” If you happen to find graph theory appealing or, even more dangerously, attractive, this is the moment you can go absolutely feral. You can compute clustering coefficients until your eyes glaze over, build k-shell decompositions like a structural engineer with a caffeine addiction, and generate centrality metrics for every account until the whole thing starts looking like social-network horoscopes. The rest of us will observe from a safe distance, offering supportive noises and pretending we understand why modularity optimisation brings you joy.

Linguistics joins the party too. Real people use slang, make typos, mix metaphors, switch tones, and, most crucially, don’t copy and paste entire sentences from each other. Coordinated accounts often repeat exactly the same phrases, sometimes with only the barest attempt at variety, as though they believed synonym replacement counts as creativity.

Text-similarity analysis becomes useful here. Using sentence embeddings from transformer models, you can measure how semantically alike two posts are, even when they differ slightly in text. If you measure lots of accounts and find some are essentially shouting the same thing in slightly different accents, you’ve likely stumbled across a disinformation cluster.

Even something as simple as the speed of engagement can be a feature. Real people take time to react. Coordinated networks sometimes retweet content within seconds of each other, like a platoon responding to a whistle.

If you want to compute some of these features in Python, it might look like this:

import numpy as np

def burstiness(timestamps):
    intervals = np.diff(sorted(timestamps))
    if len(intervals) == 0:
        return 0
    mu = np.mean(intervals)
    sigma = np.std(intervals)
    return (sigma - mu) / (sigma + mu)

df["burstiness"] = df.groupby("user_id")["timestamp"].transform(burstiness)

This little function calculates burstiness. Humans tend to have positive burstiness values: long periods of silence interspersed with sudden activity. Bots often produce values around zero, steady, robotic, dull.

This is, incidentally, how you distinguish between a real user and an account that behaves like it runs on AA batteries.

Building the Baseline Model: Teaching the Machine What “Normal” Actually Looks Like

Once you’ve engineered enough features to fill a small textbook and alienate several friends, it’s time to build models. The whole point of constructing a behavioural baseline is to avoid the exhausting task of manually identifying disinformation one unhinged post at a time. Instead, the machine learns what ordinary humans do, and then calmly points out all the accounts behaving like malfunctioning photocopiers.

This, incidentally, is also an excellent moment to encourage the average layperson to dip their toes into the soothing, predictable world of statistics, especially if their primary motivation is surviving yet another Christmas dinner where their drunk uncle cites Twitter threads as a source of cosmic truth. Statistics won’t save your family, but it will at least give you the intellectual tools to recognise when cousin Dave’s new worldview was clearly produced by a dozen bots operating out of a damp basement in Saint Petersburg. Because let’s face it: families are being ruined by disinformation at an astonishing rate, and frankly, it’s getting harder to maintain seasonal cheer when someone starts a fight over a meme they found on a Telegram channel run by a man called “PatriotEagle1776.”

Back to the models. A baseline is best built using unsupervised anomaly detection: Isolation Forests, Local Outlier Factors, One-Class SVMs, all the toys that allow you to detect weirdness without having to label thousands of posts manually like a particularly miserable intern. You give the model all your features, let it build its internal sense of normality, and then ask it to highlight the accounts that simply refuse to behave like actual humans with jobs, hobbies, or circadian rhythms.

Of course, this does occasionally flag the truly eccentric, someone live-posting their spiritual awakening at 3am from inside a Tesco car park, but more often, the anomalies start forming tidy little clusters. And tidy clusters, as any intelligence analyst will tell you, are rarely a sign of innocence.

Graph neural networks help from here: Graph Convolutional Networks, attention models, community anomaly scoring, tools that operate on the structure of interactions rather than the content. They’re especially useful for detecting coordination, because coordination is the one thing real people are truly terrible at, whereas disinformation networks excel at it to an unnerving degree.

You can even approach the problem as time-series modelling. Train a neural network to predict someone’s usual posting behaviour, then compare it with what they actually do. When a cluster suddenly snaps into military-grade synchronised posting, the model will quietly raise an eyebrow.

Here’s a tiny example of anomaly scoring using scikit-learn:

from sklearn.ensemble import IsolationForest

features = df[["burstiness", "text_entropy", "avg_interaction_delay"]].fillna(0)
model = IsolationForest(contamination=0.01)
df["anomaly_score"] = model.fit_predict(features)

A score of -1 means “this account behaves weirdly enough to warrant suspicion,” while +1 means “appears normal, though may still be using Comic Sans unironically.”

Making Sense of the Results: Visuals, Summaries, and Other Ways to Impress Funding Agencies

Once your model finishes judging the entire population of social-media users like a disapproving aforementioned aunt, you need to present the results. Preferably in a format more substantial than “look at this red blob; the red blob is bad.”

Visualisations are indispensable. A graph-based layout of user interactions, coloured by anomaly score, can reveal tight clusters of propagandists huddling together like penguins in a blizzard. Heatmaps of posting times can show unnervingly regular activity cycles. Dendrograms of text similarity can expose groups of accounts that all seem to have learned English from the same malfunctioning textbook.

Narrative summaries help too. Perhaps you uncover that a suspicious cluster of 200 accounts, all created within the same four-day period, began amplifying each other’s posts about a political scandal within sixty seconds of each drop. Perhaps their language patterns are suspiciously homogeneous. Perhaps their engagement ratios defy all logic, like receiving 500 retweets from accounts that appear otherwise dormant.

The magic of building a baseline is that these things become measurable. Deviance is no longer a matter of intuition, it becomes statistically visible.

And once you can measure a thing, you can explain it, publish it, cite it in reports, present it to policymakers, and then immediately watch them ignore your recommendations. It’s the full research experience.

The Humorous Tragedy of Normality

The irony, of course, is that “normal” social-media behaviour is itself fairly deranged. Humans post at strange hours. They respond to nonsense with more nonsense. They follow influencers who sell herbal tea as a cure for heartbreak. They propagate memes, join arguments they didn’t understand, and sometimes accidentally retweet extremist content because they thought it was about a TV show.

Yet normality is still distinct from coordination. Even the weirdest humans do not behave like perfectly aligned spam clusters. A normal user does not retweet forty political messages per minute with nanosecond precision. A normal user does not join a network of hundreds of accounts that all type in the same peculiar rhythm. A normal user doesn’t use exactly the same set of hashtags as 200 others who were born online less than a fortnight ago.

What’s comforting, in the bleakest possible way, is that disinformation networks, while crafty, are rarely subtle. They try to appear human but often forget what humans actually do. Humans procrastinate. Bots don’t. Humans argue. Bots agree too quickly. Humans get bored and go to bed. Bots don’t. Humans use far too many emojis. Bots usually can’t be bothered.

And so the baseline prevails.

A Final Reflection, As Cheerful as a Wet Weekend in Blackpool

The digital landscape will, of course, continue to be flooded by coordinated influence operations for as long as nation-states wish to destabilise each other, trolls crave attention, and marketing teams discover that astroturfed engagement looks good on a quarterly slide deck. That part is inevitable. But the far more depressing truth is that the platforms themselves, the very "institutions" tasked with managing our collective information ecosystem, remain structurally incapable of dealing with the mess. Not unwilling, mind you. Incapable.

Social media companies have the governance sophistication of a Victorian circus: dazzling lights, unpredictable accidents, and absolutely no safety inspectors. Their moderation teams are consistently understaffed, their policies change weekly, and their internal research departments enjoy all the autonomy of a potted plant placed in direct sunlight and asked to innovate. Every scandal results in the same corporate choreography: a hastily assembled blog post, a promise that “we’re listening,” and then a new feature nobody asked for, usually involving AI or emojis.

And accountability? Please. Platforms operate with the regulatory transparency of a magician who refuses to reveal the secret to a trick that is both unimpressive and probably stolen. Even when internal research teams publish warnings, “disinformation surge detected,” “hate speech up 300 per cent,” “user trust collapsing faster than a flimsy camping chair”, upper management often responds by burying the report so deep it could be used as insulation.

Which brings us neatly to the world’s most famously self-declared genius, a man whose approach to running a social-media platform resembles a toddler driving a forklift: Elon Musk. One would think that after acquiring Twitter (or “X,” as it’s now been rebranded in the world’s least imaginative mid-life crisis), he might have adopted a sense of stewardship or public responsibility. Instead, the platform now feels like a late-stage group chat between libertarians, crypto evangelists, and men who own one book but quote it constantly.

The most bewildering part isn’t Musk’s behaviour, after all, billionaires frequently confuse “running a platform” with “yeeting levers until something catches fire.” No, the truly surreal aspect is the subset of demographic who treat him as a sort of techno-messiah, amplifying his every utterance as though he is delivering commandments instead of firing off half-baked shower thoughts at 3am. Their devotion is fervent, loud, and entirely unearned. It’s one of the world’s most chaotic parasocial relationship, built on the belief that a man who cannot reliably manage a website is somehow going to elevate civilisation into a glorious new era. Spoiler: he won’t. And he certainly won’t elevate them. The man can’t even elevate his own platform’s user numbers.

Meanwhile, the toxic cocktail of lax moderation, algorithmic amplification, and monetisation incentives ensures that disinformation spreads faster than actual information, because actual information tends to be dull, takes time, and contains nuance. Disinformation, by contrast, is shiny, angry, and available in easy-to-share bite-sized packets for the terminally impatient.

That’s why building behavioural baselines matters. Because someone has to try. Someone has to map the digital sludge, identify the bad actors, understand the mechanisms of manipulation, and maybe, just maybe, crawl out of this attention-economy quagmire with enough clarity to explain to a policymaker why “just ban the bots” isn’t a strategy but a wish.

With the right data, the right models, and a generous supply of emotional resilience, we can at least distinguish between organic human chaos and synthetic, weaponised chaos. It won’t solve everything. It won’t fix the structural rot inside social-media corporations. It won’t stop billionaires from cosplaying as philosopher-kings. And it certainly won’t save your family WhatsApp group.

But it gives us something rare in the digital world: a fighting chance at clarity. And sometimes, clarity is enough to preserve sanity.

References:

Allcott, H. and Gentzkow, M. (2017) ‘Social media and fake news in the 2016 election’, Journal of Economic Perspectives, 31(2), pp. 211–235. Available at: https://www.jstor.org/stable/44235006 (Accessed: 13 November 2025).

Bakshy, E., Messing, S. and Adamic, L.A. (2015) ‘Exposure to ideologically diverse news and opinion on Facebook’, Science, 348(6239), pp. 1130–1132. Available at: https://doi.org/10.1126/science.aaa1160 (Accessed: 13 November 2025).

Barabási, A.-L. (2005) ‘The origin of bursts and heavy tails in human dynamics’, Nature, 435, pp. 207–211. Available at: https://doi.org/10.1038/nature03459 (Accessed: 13 November 2025).

Ferrara, E. (2017) ‘Disinformation and social bot operations in the run up to the 2017 French presidential election’, First Monday, 22(8). Available at: https://doi.org/10.48550/arXiv.1707.00086 (Accessed: 13 November 2025).

Gorwa, R. (2019) ‘What is platform governance?’, Information, Communication & Society, 22(6), pp. 854–871. Available at: https://doi.org/10.1080/1369118X.2019.1573914 (Accessed: 13 November 2025).

Grinberg, N., Joseph, K., Friedland, L., Swire-Thompson, B. and Lazer, D. (2019) ‘Fake news on Twitter during the 2016 U.S. presidential election’, Science, 363(6425), pp. 374–378. Available at: https://doi.org/10.1126/science.aau2706 (Accessed: 13 November 2025).

Lazer, D.M.J., Baum, M.A., Benkler, Y., Berinsky, A.J., et al. (2018) ‘The science of fake news’, Science, 359(6380), pp. 1094–1096. Available at: https://doi.org/10.1126/science.aao2998 (Accessed: 13 November 2025).

Mihaylov, T., Georgiev, G. and Nakov, P. (2015) ‘Finding opinion manipulation trolls in news community forums’, in Proceedings of the Nineteenth Conference on Computational Natural Language Learning. Beijing: ACL, pp. 310–314. Available at: https://doi.org/10.18653/v1/K15-1032 (Accessed: 13 November 2025).

Oxford Internet Institute (2021) Industrialized Disinformation: 2020 Global Inventory of Organized Social Media Manipulation. Oxford: University of Oxford. Available at: https://www.oii.ox.ac.uk/news-events/reports/industrialized-disinformation-2020-global-inventory-of-organized-social-media-manipulation/ (Accessed: 13 November 2025).

Woolley, S. and Howard, P. (2017) ‘Computational propaganda worldwide: Executive summary’, Computational Propaganda Research Project. Oxford: University of Oxford. Available at: https://ora.ox.ac.uk/objects/uuid:d6157461-aefd-48ff-a9a9-2d93222a9bfd (Accessed: 13 November 2025).

Zannettou, S., Sirivianos, M., Blackburn, J. and Kourtellis, N. (2019) ‘The web of false information: Rumors, fake news, hoaxes, clickbait, and various other shenanigans’, Journal of Data and Information Quality, 11(3), pp. 1–37. Available at: https://doi.org/10.1145/3309699 (Accessed: 13 November 2025).