Detection of Coordinated Behavior

Detection methods are organized here across network science, machine learning, simulation-based papers, and report papers, with one section menu linking the full survey evidence.

Open survey section

Network Science Methods

Network science methods model coordination through co-actions, content, users, temporal windows, and network representations.

Network science framework for coordinated behavior detection — Main steps of the network science methods for the detection of coordinated online behavior. 1: The selected users become nodes in a network. 2: User similarities are computed with a similarity function and assigned to the edge weights of the network. 3: The network is filtered so as to retain only similarities with given properties. 4: Community discovery is performed to detect groups of strongly coordinated users.

Network representation differences — Differences between social, interaction, and coordination networks.

Time window types, their parameters, and their effect on valid co-actions. To the right, a sequence of actions occurs at times 𝑡1,…,𝑡6. The same sequence results in different valid co-actions, marked by the lock icon, depending on the time window type.

Single Network

Network science methods for detecting coordinated behavior based on single layer user networks. For each group of works we report the considered co-actions, similarity functions, filtering criteria, and community detection methods.

51rows

data/source/tables/tab_single_network.csvOpen source CSV

Reference	Action	Similarity	Filters	Community Detection
cima2024coordinated	retweet	cardinality	threshold, ADJ	modularity clustering
graham2020like	retweet	cardinality	EDO	Louvain
kulichkina2025protest kulichkina2026connective	retweet	cardinality	threshold, ADO	Louvain
linhares2022uncovering	retweet	cardinality	backbone, ADJ	Louvain
schliebs2021china	retweet	cardinality	EDO	-
nizzoli2021coordinated cinelli2022coordinated hristakieva2022spread loru2024influence di2025post tardelli2024multifaceted	retweet	cosine similarity TF-IDF	backbone	Louvain
tardelli2024temporal sartori2025insights	retweet	cosine similarity TF-IDF	backbone, EDO	Leiden
weber2021temporal	retweet	cardinality	threshold, ADJ	-
axelrod2025structure	retweet	cosine similarity	kNN graph, correlation	HDBSCAN
chomel2023manipulation	retweet, tweet	cardinality	threshold, EDO	Louvain, connected components
keller2020political	retweet, tweet	cardinality	threshold, EDO	Louvain
schoch2022coordination	retweet, tweet	cardinality	threshold, EDO	-
blas2025large	tweet	cosine similarity	threshold, EDO	-
de2024detecting	tweet	cardinality	ADO	-
lee2013campaign	tweet	cardinality	threshold	cohesive campaign
pacheco2020unveiling	tweet	text similarity	threshold, ADO	-
ng2023coordinating	parley	cardinality	threshold, kNN graph	Leiden
venancio2024unraveling	text	cardinality	backbone	Louvain
wu2025unmasking	tweet	-	threshold, kNN graph, ADO	-
kansaon2025fake	message	cardinality	threshold, ADO	Louvain
ng2023you	tweet, URL	cardinality, cosine similarity	threshold, EDO	Louvain
ng2022cross	tweet, parley, URL, username	text similarity, cardinality, cosine similarity	threshold, kNN graph	Louvain
luceri2024unmasking	retweet, tweet, URL, hashtag	cosine similarity TF-IDF, text similarity	threshold, ADO	-
pante2025beyond	retweet, tweet, URL, hashtag, fast retweet	cosine similarity TF-IDF	ADO (fast retweet)	connected components
weber2020who weber2021amplifying	retweet, URL, hashtag, mention, reply	cardinality	ADJ	focal structures
vargas2020detection	retweet, tweet, URL, hashtag, mention	cosine similarity TF-IDF	ADJ	Leiden
pacheco2021uncovering	retweet, hashtag, image, handle change, synchronization	Jaccard coefficient, cardinality, cosine similarity	threshold, EDO	-
dash2024decoding	retweet, tweet, image, synchronization	cosine similarity TF-IDF	threshold	Louvain
loru2025compression	interaction, text, synchronization	Normalized Compression Distance	kNN graph	-
luceri2026coordinated	text, synchronization, hashtag, URL, duet, stitch, reply	cosine similarity TF-IDF	threshold	connected components
wohlert2025detecting	hashtag, URL, video description, music, audio	cardinality	kNN graph	connected components
cinus2025exposing	URL	cosine similarity TF-IDF	threshold, EDO	connected components
cao2015organic	URL	cardinality	kNN graph	Louvain
giglietto2020coordinated giglietto2020takes broniatowski2021towards gruzd2022coordinated ghasiya2022rapid righetti2022political rogers2025coordinated song2025spread	URL	cardinality	threshold, ADO	connected components
yang2025coordinated	URL	cardinality	-	-
minici2024uncovering	URL	TFIDF cosine similarity	threshold	-
alieva2022investigating	URL, hashtag, mention	unweighted	EDO	Leiden
ng2022online	URL, hashtag, mention	cardinality	threshold, EDO	Louvain
colizzi2025investigating	URL, text	cosine similarity TF-IDF	threshold, ADJ	-
giglietto2023workflow soares2023sharing	URL, text-image	cardinality	threshold, ADO	connected components
ng2022coordinated	image	cardinality	threshold, kNN graph	-
yu2022framework	image, video	cardinality	threshold, ADO	connected components
burghardt2024socio	hashtag	cardinality	threshold	connected components
ng2023coordinated	hashtag	cardinality	threshold, backbone	Louvain
wang2023evidence	hashtag	cardinality	-	-
jahn2023towards	like	cardinality	threshold	-
kirdemir2022towards	comment	cardinality	threshold	k-means, hierarchical clustering
piercey2023coordinated	comment	cardinality	threshold, ADO	connected components
neha2024understanding	mention	cosine similarity TF-IDF	threshold	Louvain
zhao2025unveiling	report	cardinality	threshold	connected components
zouzou2024unsupervised	follow	cosine similarity	-	Louvain

Table 2 in survey

Time Window

Types and characteristics of the time windows and the coordination networks used by network science methods.

27rows

data/source/tables/tab_time_window.csvOpen source CSV

Reference	Type	Size	Target	Layers
weber2020who weber2021amplifying weber2021temporal	adjacent	15 min, 1 hour, 6 hour, 1 day	user	single
vargas2020detection	adjacent	1 day, 1 week	user	single
linhares2022uncovering cima2024coordinated colizzi2025investigating	adjacent	1 week	user	single
al2025coordinated	adjacent	1 hour, 1 day,	content	single
graham2020like	evenly distributed overlapping	1 sec	user	single
chomel2023manipulation	evenly distributed overlapping	from 1 sec to 250 sec	content	single
keller2020political schliebs2021china schoch2022coordination	evenly distributed overlapping	1 min	user	single
ng2022online	evenly distributed overlapping	from 1 min to 30 min	user	single
alieva2022investigating	evenly distributed overlapping	5 min	user	single
magelinski2020detecting ng2023you	evenly distributed overlapping	5 min	user	multiple (L=2)
magelinski2022synchronized ng2022combined graham2024coordination	evenly distributed overlapping	5 min	user	multiple (L=3)
pacheco2021uncovering	evenly distributed overlapping	30 min	user	single
cinus2025exposing luceri2026coordinated	evenly distributed overlapping	1 day	user	single
blas2025large	evenly distributed overlapping	2 day	user	single
mannocci2026multimodal	evenly distributed overlapping	6 hour, 1 week	user	multiple (L=5)
tardelli2024temporal	evenly distributed overlapping	1 week	user	single
kulichkina2025protest	action-driven overlapping	from 1 sec to 1 hour	user	single
de2024detecting	action-driven overlapping	from 1 sec to 11 day	user	single
pacheco2020unveiling pante2025beyond	action-driven overlapping	10 sec	user	single
luceri2024unmasking dey2024coordinated	action-driven overlapping	10 sec	user	single, multiple (L=4)
gruzd2022coordinated ghasiya2022rapid giglietto2020coordinated giglietto2020takes giglietto2023workflow soares2023sharing righetti2022political	action-driven overlapping	from 10 sec to 1 min	user	single
broniatowski2021towards	action-driven overlapping	25 sec	user	single
yu2022framework kansaon2025fake	action-driven overlapping	1 min	user	single
kulichkina2026connective	action-driven overlapping	2 min	user	single
emeric2023interpretable	action-driven overlapping	1 min, 1 hour, 1 day	user	multiple (L=4)
wu2025unmasking	action-driven overlapping	1 hour	user	single
suresh2023tracking	action-driven overlapping	10 tweets	content	single

Table 3 in survey

Multiplex Network

Network science methods for detecting coordinated behavior based on multiplex user networks, where each layer corresponds to a different co-action. For each group of works we report the considered co-actions, similarity functions, filtering criteria, and the optional flattening step applied before the community detection method.

10rows

data/source/tables/tab_multiplex_network.csvOpen source CSV

Reference	Action	Similarity	Filters	Flattening	Community Detection
emeric2023interpretable	share, message, URL, hashtag	cardinality	threshold, ADO	-	Louvain, IPVC
luceri2024unmasking dey2024coordinated	retweet, tweet, URL, hashtag	cosine similarity TF-IDF	threshold, ADO	unweighted edge union	-
elmas2026israel	retweet, URL, hashtag, image, token	cosine similarity TF-IDF	threshold	unweighted edge union	connected components
iannucci2026detecting	retweet, URL, hashtag, mention	temporal weighted cardinality	-	-	Generalized Leiden
graham2024coordination	retweet, text, URL, reply	cardinality	EDO	multigraph	connected components
magelinski2020detecting	URL, hashtag	cardinality	EDO	-	multi-view clustering
magelinski2022synchronized	URL, hashtag, mention	cardinality	EDO	-	multi-view clustering
ng2022combined ng2024tiny	URL, hashtag, mention	cardinality	EDO	sum cardinality	-
mannocci2026multimodal	URL, hashtag, mention, reply, retweet	cosine similarity TF-IDF	threshold, EDO	-	Generalized Louvain, Generalized Infomap
ng2023you	URL, tweet	cardinality, cosine similarity	threshold, EDO	unweighted edge union	Louvain

Table 5 in survey

Content Networks

Network science methods for detecting coordinated behavior based on content networks, where nodes are posted contents and edge weights encode the similarity between the linked contents. For each group of works we report the types of content, similarity functions, filtering criteria, and the community detection methods.

7rows

data/source/tables/tab_content_networks.csvOpen source CSV

Reference	Nodes	Similarity	Filters	Community Detection
antonakaki2026coordinated	texts	cosine similarity TF-DID	-	-
lee2013campaign	texts	text similarity scores	threshold	loose strict campaign, cohesive campaign
suresh2023tracking	texts, hashtags	cosine similarity, cardinality	EDO, threshold	hierarchical clustering
danaditya2022curious weber2021amplifying	hashtags	cardinality	threshold	Louvain
cresci2018fake cresci2019cashtag	cashtags	cardinality	threshold	-
ng2022coordinated	images	Euclidean distance	kNN graph	Louvain
al2025coordinated	comments	message similarity	-	Louvain

Table 6 in survey

Machine Learning

Machine learning approaches detect coordination from activity traces, text, metadata, temporal patterns, or learned representations.

Machine Learning Unsupervised

Data mining and machine learning methods, based on unsupervised learning for detecting coordinated behavior. For each group of works we report the input types, the machine learning approach, and whether the method takes time into account.

18rows

data/source/tables/tab_machine_learning_unsupervised_approach.csvOpen source CSV

Reference	Input	Machine Learning Approach	Time
assenmacher2020towards assenmacher2020two pohl2022artificial stampe2024benchmarking	text streams	text stream clustering	yes
stampe2023towards	text streams, image captions	text stream clustering	yes
barbero2023multi	text, user-content network	clustering of text and node embeddings	yes
keller2017manipulate	daily tweeting activity	expectation-maximization	yes
steinert2015online	hashtags	peak detection	yes
bellutta2023investigating	account creation timestamps	burst detection	yes
manchanayaka2024identifying	user activities	contrast pattern mining	yes
manchanayaka2025using	user activities	convergent cross mapping	yes
erhardt2023detecting erhardt2024hidden	URL, hashtag, image, mention	networked Markov chains	yes
sharma2021identifying	user activities	temporal point processes, gaussian mixture models	yes
zhang2021vigdet	user activities	temporal point processes, expectation-maximization	yes
kalenkova2025discovering	user activities	Petri net	yes
zareie2025identifying	user activities	outlier detection	yes
jakesch2021trend	text, posting time	text similarity, timings of campaign launch and posting tweets	yes
smith2025unsupervised	hashtags	bayesan model	-
uyheng2022mapping	user activities	cluster interactions networks	-
kuznetsova2025amplifying	mention	cluster interactions networks	-
stringhini2024understanding	YouTube links shared on 4chan	exploratory analysis	-

Table 7 in survey

Machine Learning Supervised

Data mining and machine learning methods, based on supervised learning, for detecting coordinated behavior. For each group of works we report the input types, the machine learning approach, whether the method takes time into account, and the prediction target.

9rows

data/source/tables/tab_machine_learning_supervised_approach.csvOpen source CSV

Reference	Input	Machine Learning Approach	Time	Target
zhang2023capturing	user activities	representation learning, conditional embedding, neural encoding	yes	user
francois2021measuring	network, temporal, semantic features	outlier detection	yes	network
saeed2024tuberaider	text	peak detection, multiclass classification	yes	community
pote2025coordinated	user activities	classifier	yes	user, target
mariconti2019you	metadata, audio transcripts, thumbnails	ensemble classification	-	target
anand2025density	user activities	random weighted walk	-	network
matsuzaki2025edcoc	co-retweet network	graph neural network	-	community
kanakaris2025network	retweet	retrieval-augmented generation	-	network
minici2025iohunter	network, text	graph neural network	-	user

Table 8 in survey

Simulation-based papers

Simulation works in the coordinated behavior survey.

3rows

data/source/csv/cited_papers.csvOpen source CSV

Reference	Year	Title	Authors	Venue
jahn2023detecting	2023	Detecting coordinated inauthentic behavior in likes on social media: Proof of concept	Jahn, Laura and Rendsvig, Rasmus K. and Sterk-, Jacob	arXiv
mehta2022estimating	2022	Estimating the impact of coordinated inauthentic behavior on content recommendations in social networks	Mehta, Swapneel S. and Baydin, Atilim G. and State, Bogdan and Bonneau, Richard and Nagler, Jonathan and Torr, Philip	AI4ABM
orlando2026emergent	2026	Emergent coordinated behaviors in networked LLM agents: Modeling the strategic dynamics of information operations	Orlando, Gian Marco and Ye, Jinyi and La Gatta, Valerio and Saeedi, Mahdi and Moscato, Vincenzo and Ferrara, Emilio and Luceri, Luca	ACM WWW

Simulation in survey

Report Papers

Report works in the coordinated behavior survey.

7rows

data/source/csv/cited_papers.csvOpen source CSV

Reference	Year	Title	Authors	Venue
milzner2025just	2025	Just the tip of the iceberg? State of the art of coordinated social media manipulation research	Milzner, Miriam and Thiele, Daniel and Gong, Baoning	Information, Communication & Society
murero2023coordinated	2023	Coordinated inauthentic behavior: An innovative manipulation tactic to amplify COVID-19 anti-vaccine communication outreach via social media	Murero, Monica	Frontiers in Sociology
starbird2019disinformation	2019	Disinformation as collaborative work: Surfacing the participatory nature of strategic information operations	Starbird, Kate and Arif, Ahmer and Wilson, Tom	ACM CSCW
thiele2025attributing	2025	Attributing coordinated social media manipulation: A theoretical model and typology	Thiele, Daniel and Milzner, Miriam and Heft, Annett and Gong, Baoning and Pfetsch, Barbara	New Media & Society
yoo2024speak	2024	Speak with one voice? Examining content coordination and social media engagement during disasters	Yoo, Changseung and Yoo, Eunae and Yan, Lu and Pedraza-Martinez, Alfonso	Information Systems Research
chan2024online	2024	Online astroturfing: A problem beyond disinformation	Chan, Jovy	Philosophy \& Social Criticism
jovanovic2026beyond	2026	Beyond detection: How Serbia's SNS party mimics authentic support through coordinated inauthentic behaviour	Jovanovic-Harrington, Ana and Cornia, Alessio	European Journal of Communication