Detection and Characterization of Coordinated Online Behavior: A Survey
Pith reviewed 2026-05-23 22:36 UTC · model grok-4.3
The pith
A survey reconciles definitions of coordinated online behavior and proposes a framework to guide detection and characterization efforts.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central claim is that a unified framework, built by reconciling industry and academic definitions of coordinated online behavior, allows for a systematic review and critical discussion of detection and characterization methods, revealing open challenges and promising research directions.
What carries the argument
The comprehensive framework to study coordinated online behavior, which serves to categorize and integrate various definitions, detection methods, and characterization approaches.
If this is right
- Standardized definitions enable more consistent research across academic and industry settings.
- Detection methods can be evaluated and compared within the proposed categories.
- Characterization techniques become more structured for analyzing coordinated activities.
- Open challenges guide the development of new tools for addressing online manipulation.
Where Pith is reading between the lines
- Applying the framework to emerging platforms could reveal new coordination patterns not covered in current literature.
- Integration with machine learning advancements might improve the scalability of detection methods discussed.
- Policymakers could use the framework to design regulations targeting specific types of coordinated behavior.
Load-bearing premise
The existing body of work on coordinated online behavior is sufficiently mature and representative to allow a comprehensive categorization and framework proposal without significant omissions.
What would settle it
Discovery of a major coordinated behavior phenomenon or detection method that does not fit into any category of the proposed framework would challenge its comprehensiveness.
Figures
read the original abstract
Coordination is a fundamental aspect of life. The advent of social media has made it integral also to online human interactions, such as those that characterize thriving online communities and social movements. At the same time, coordination is also core to effective disinformation, manipulation, and hate campaigns. This survey collects, categorizes, and critically discusses the body of work produced as a result of the growing interest on coordinated online behavior. We reconcile industry and academic definitions, propose a comprehensive framework to study coordinated online behavior, and review and critically discuss the existing detection and characterization methods. Our analysis identifies open challenges and promising directions of research, serving as a guide for scholars, practitioners, and policymakers in understanding and addressing the complexities inherent to online coordination.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript is a survey that collects, categorizes, and critically discusses research on coordinated online behavior. It reconciles industry and academic definitions of coordination, proposes a comprehensive framework for studying such behavior, reviews existing detection and characterization methods, and identifies open challenges and promising research directions to guide scholars, practitioners, and policymakers.
Significance. If the proposed framework is robustly derived and the review is representative, the work could standardize terminology and provide a useful synthesis for an emerging interdisciplinary area. The manuscript earns credit for explicitly attempting to bridge industry and academic perspectives and for structuring the discussion around both detection and characterization methods rather than detection alone.
major comments (1)
- [Abstract] Abstract and introduction: the claim of delivering a 'comprehensive framework' and review without 'significant omissions' is load-bearing for the central contribution, yet the text provides no description of literature search strategy, databases queried, time window, or inclusion/exclusion criteria. This omission prevents readers from assessing whether the categorization and framework are representative of the field.
minor comments (1)
- [Abstract] The abstract states that the survey 'critically discusses' methods, but the provided text does not illustrate the depth of that critique (e.g., no explicit comparison of false-positive rates or scalability across cited approaches). Adding one or two concrete examples of critical analysis would strengthen the claim.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback and the recommendation of minor revision. We address the single major comment below.
read point-by-point responses
-
Referee: [Abstract] Abstract and introduction: the claim of delivering a 'comprehensive framework' and review without 'significant omissions' is load-bearing for the central contribution, yet the text provides no description of literature search strategy, databases queried, time window, or inclusion/exclusion criteria. This omission prevents readers from assessing whether the categorization and framework are representative of the field.
Authors: We agree that explicitly describing the literature search process is necessary to substantiate claims of comprehensiveness. In the revised version we will insert a dedicated 'Survey Methodology' subsection (placed after the introduction) that details: (i) the databases and repositories queried (Google Scholar, Scopus, arXiv, ACM Digital Library, and selected conference proceedings), (ii) the time window (2010–2024), (iii) the Boolean search strings and keywords employed, and (iv) the inclusion/exclusion criteria together with the number of papers screened and retained. This addition will allow readers to evaluate the representativeness of the proposed framework and categorization. revision: yes
Circularity Check
No significant circularity: survey of external literature
full rationale
This is a survey paper that collects, categorizes, and critically discusses an existing body of external work on coordinated online behavior. It reconciles industry/academic definitions and proposes a framework based on reviewed literature, without any derivations, equations, fitted parameters, or predictions that reduce to self-referential content. No load-bearing self-citations or self-definitional steps are present; the central claims rest on synthesis of independent prior research. The weakest assumption (representativeness of the literature) is standard for surveys and does not create internal circularity.
Axiom & Free-Parameter Ledger
Reference graph
Works this paper leans on
-
[1]
Iuliia Alieva, Lynnette H. X. Ng, and Kathleen M. Carley. 2022. Investigating the spread of Russian disinformation about biolabs in Ukraine on Twitter using social network analysis. In IEEE BigData. 1770–1775
work page 2022
-
[2]
Hans Asenbaum. 2018. Cyborg activism: Exploring the reconfigurations of democratic subjectivity in Anonymous. New Media & Society 20, 4 (2018)
work page 2018
-
[3]
Dennis Assenmacher, Lena Adam, Heike Trautmann, and Christian Grimme. 2020. Towards real-time and unsupervised campaign detection in social media. In AAAI FLAIRS. 303–307
work page 2020
-
[4]
Pohl, Heike Trautmann, and Christian Grimme
Dennis Assenmacher, Lena Clever, Janina S. Pohl, Heike Trautmann, and Christian Grimme. 2020. A two-phase framework for detecting manipulation campaigns in social media. In HCII. 201–214
work page 2020
-
[5]
Helmy H. Baligh. 1986. Decision rules and transactions, organizations and markets. Management Science 32, 11 (1986), 1480–1491
work page 1986
-
[6]
Helmy H. Baligh and Richard M. Burton. 1981. Describing and designing organizational structures and processes. International Journal of Policy Analysis and Information Systems 5, 4 (1981), 251–266
work page 1981
-
[7]
Fabio Barbero, Sander op den Camp, et al. 2023. Multi-modal embeddings for isolating cross-platform coordinated information campaigns on social media. In MISDOOM. 14–28
work page 2023
-
[8]
Daniele Bellutta and Kathleen M. Carley. 2023. Investigating coordinated account creation using burst detection and network analysis. Journal of Big Data 10, 1 (2023), 1–17
work page 2023
-
[9]
Lance Bennett and Alexandra Segerberg
W. Lance Bennett and Alexandra Segerberg. 2012. The logic of connective action. Information, Communication & Society 15, 5 (2012), 739–768
work page 2012
- [10]
-
[11]
D. A. Broniatowski. 2021. Towards statistical foundations for detecting coordinated inauthentic behavior on Facebook . Technical Report. Institute for Data, Democracy and Politics, The George Washington University
work page 2021
-
[12]
Axel Bruns, Tim Highfield, and Jean Burgess. 2013. The Arab Spring and social media audiences: English and Arabic Twitter users and their networks. American Behavioral Scientist 57, 7 (2013), 871–898
work page 2013
-
[13]
Keith Burghardt, Ashwin Rao, Georgios Chochlakis, Baruah Sabyasachee, Siyi Guo, Zihao He, Andrew Rojecki, Shrikanth Narayanan, and Kristina Lerman. 2024. Socio-linguistic characteristics of coordinated inauthentic accounts. In AAAI ICWSM, Vol. 18. 164–176
work page 2024
-
[14]
Cheng Cao, James Caverlee, Kyumin Lee, Hancheng Ge, and Jin-Wook Chung. 2015. Organic or organized?: Exploring URL sharing behavior. In ACM CIKM. 513–522
work page 2015
-
[15]
Valerio Capraro and Matjaž Perc. 2024. In search of the most cooperative network. Nature Computational Science 4, 4 (2024), 257–258
work page 2024
-
[16]
Matthias Carnein, Dennis Assenmacher, and Heike Trautmann. 2017. Stream clustering of chat messages with applications to Twitch streams. In ER. 79–88
work page 2017
-
[17]
Victor Chomel, Maziyar Panahi, and David Chavalarias. 2023. Manipulation during the French presidential campaign: Coordinated inauthentic behaviors and astroturfing analysis on text and images. In CNA. 121–134. Manuscript submitted to ACM 32 Mannocci et al
work page 2023
-
[18]
Lorenzo Cima, Lorenzo Mannocci, Marco Avvenuti, Maurizio Tesconi, and Stefano Cresci. 2024. Coordinated behavior in information operations on Twitter. IEEE Access 11 (2024), 61568–61585
work page 2024
-
[19]
Matteo Cinelli, Stefano Cresci, Walter Quattrociocchi, Maurizio Tesconi, and Paola Zola. 2022. Coordinated inauthentic behavior and information spreading on Twitter. Decision Support Systems 160 (2022), 113819
work page 2022
-
[20]
Aaron Clauset, Mark EJ Newman, and Cristopher Moore. 2004. Finding community structure in very large networks. Physical Review E 70, 6 (2004), 066111
work page 2004
-
[21]
Stefano Cresci. 2020. A decade of social bot detection. Commun. ACM 63, 10 (2020), 72–83
work page 2020
-
[22]
Stefano Cresci, Fabrizio Lillo, Daniele Regoli, Serena Tardelli, and Maurizio Tesconi. 2018. $FAKE: Evidence of spam and bot activity in stock microblogs on Twitter. In AAAI ICWSM. 580–583
work page 2018
-
[23]
Stefano Cresci, Fabrizio Lillo, Daniele Regoli, Serena Tardelli, and Maurizio Tesconi. 2019. Cashtag Piggybacking: Uncovering spam and bot activity in stock microblogs on Twitter. ACM Transactions on the Web 13, 2 (2019), 11:1–11:27
work page 2019
- [24]
-
[25]
Adya Danaditya, Lynnette H. X. Ng, and Kathleen M. Carley. 2022. From curious hashtags to polarized effect: Profiling coordinated actions in Indonesian Twitter discourse. Social Network Analysis and Mining 12, 1 (2022), 105
work page 2022
-
[26]
Bart De Clerck, Juan Carlos Fernandez Toledano, Filip Van Utterbeeck, and Luis EC Rocha. 2024. Detecting coordinated and bot-like behavior in Twitter: the Jürgen Conings case. EPJ Data Science 13, 1 (2024), 40
work page 2024
-
[27]
Priyanka Dey, Luca Luceri, and Emilio Ferrara. 2024. Coordinated activity modulates the behavior and emotions of organic users: A case study on tweets about the Gaza conflict. In ACM WWW. 682–685
work page 2024
-
[28]
Di Marco, Sara Brunetti, Matteo Cinelli, and Walter Quattrociocchi
N. Di Marco, Sara Brunetti, Matteo Cinelli, and Walter Quattrociocchi. 2024. Post-hoc evaluation of nodes influence in information cascades: The case of coordinated accounts. arXiv:2401.01684
-
[29]
Carlotta Dotto, Seb Cubbon, Stefano Cresci, Serena Tardelli, and Leonardo Nizzoli. 2021. How to improve our analysis of ‘coordinated inauthentic behavior’. https://medium.com/1st-draft/how-to-improve-our-analysis-of-coordinated-inauthentic-behavior-a4ec62ce9bff (accessed: 31/07/2024)
work page 2021
-
[30]
coordinated inauthentic behaviour
Evelyn Douek. 2020. What does “coordinated inauthentic behaviour” actually mean? https://slate.com/technology/2020/07/coordinated-inauthentic- behavior-facebook-twitter.html. (accessed: 31/07/2024)
work page 2020
-
[31]
Auriant Emeric and Chomel Victor. 2023. Interpretable cross-platform coordination detection on social networks. In CNA. 143–155
work page 2023
-
[32]
Keeley Erhardt and Dina Albassam. 2023. Detecting the hidden dynamics of networked actors using temporal correlations. In ACM WWW. 1214–1217
work page 2023
-
[33]
Keeley Erhardt and Alex Pentland. 2024. Hidden messages: mapping nations’ media campaigns. Computational and Mathematical Organization Theory 30, 2 (2024), 161–172
work page 2024
-
[34]
Fatima Ezzeddine, Omran Ayoub, Silvia Giordano, Gianluca Nogara, Ihab Sbeity, Emilio Ferrara, and Luca Luceri. 2023. Exposing influence campaigns in the age of LLMs: A behavioral-based AI approach to detecting state-sponsored trolls. EPJ Data Science 12, 1 (2023), 46
work page 2023
-
[35]
Facebook. 2018. Coordinated inauthentic behavior explained. https://about.fb.com/news/2018/12/inside-feed-coordinated-inauthentic-behavior/. (accessed: 31/07/2024)
work page 2018
-
[36]
Facebook. 2018. Removing bad actors from Facebook. https://about.fb.com/news/2018/07/removing-bad-actors-on-facebook/. (accessed: 31/07/2024)
work page 2018
-
[37]
Facebook. 2019. How we respond to inauthentic behavior on our platforms: Policy update. https://about.fb.com/news/2019/10/inauthentic- behavior-policy-update/. (accessed: 31/07/2024)
work page 2019
-
[38]
Facebook. 2019. Inauthentic behavior. https://transparency.fb.com/policies/community-standards/inauthentic-behavior/. (accessed: 31/07/2024)
work page 2019
-
[39]
Facebook. 2019. Removing coordinated inauthentic behavior in UAE, Egypt and Saudi Arabia. https://about.fb.com/news/2019/08/cib-uae-egypt- saudi-arabia/. (accessed: 31/07/2024)
work page 2019
-
[40]
Facebook. 2021. Advancing our policies on online bullying and harassment. https://about.fb.com/news/2021/10/advancing-online-bullying- harassment-policies/. (accessed: 31/07/2024)
work page 2021
-
[41]
Facebook. 2021. Removing new types of harmful networks. https://about.fb.com/news/2019/10/inauthentic-behavior-policy-update/. (accessed: 31/07/2024)
work page 2021
-
[42]
Camille Francois, Vladimir Barash, and John Kelly. 2023. Measuring coordinated versus spontaneous activity in online social movements. New Media & Society 25, 11 (2023), 3065–3092
work page 2023
- [43]
-
[44]
Piyush Ghasiya and Kazutoshi Sasahara. 2022. Rapid sharing of Islamophobic hate on Facebook: The case of the Tablighi Jamaat controversy. Social Media + Society 8, 4 (2022)
work page 2022
-
[45]
Fabio Giglietto, Giada Marino, Roberto Mincigrucci, and Anna Stanziano. 2023. A workflow to detect, monitor, and update lists of coordinated social media accounts across time: The case of the 2022 Italian election. Social Media + Society 9, 3 (2023)
work page 2023
-
[46]
Fabio Giglietto, Nicola Righetti, Luca Rossi, and Giada Marino. 2020. Coordinated link sharing behavior as a signal to surface sources of problematic information on Facebook. In ACM SMSociety. 85–91. Manuscript submitted to ACM Detection and Characterization of Coordinated Online Behavior: A Survey 33
work page 2020
-
[47]
Fabio Giglietto, Nicola Righetti, Luca Rossi, and Giada Marino. 2020. It takes a village to manipulate the media: Coordinated link sharing behavior during 2018 and 2019 Italian elections. Information, Communication & Society 23, 6 (2020), 867–891
work page 2020
-
[48]
Fabio Giglietto, Massimo Terenzi, Giada Marino, Nicola Righetti, and Luca Rossi. 2020. Adapting to mitigation efforts: Evolving strategies of coordinated link sharing on Facebook. SSRN:3775469
work page 2020
-
[49]
Google. 2020. Updates about government-backed hacking and disinformation. https://blog.google/threat-analysis-group/updates-about- government-backed-hacking-and-disinformation/. (accessed: 31/07/2024)
work page 2020
-
[50]
Timothy Graham, Axel Bruns, Guangnan Zhu, and Rod Campbell. 2020. Like a virus: The coordinated spread of coronavirus disinformation . Technical Report. Centre for Responsible Technology, The Australia Institute
work page 2020
-
[51]
Timothy Graham, Sam Hames, and Elizabeth Alpert. 2024. The coordination network toolkit: A framework for detecting and analysing coordinated behaviour on social media. Journal of Computational Social Science (2024), 1–22
work page 2024
-
[52]
Anatoliy Gruzd, Philip Mai, and Felipe B. Soares. 2022. How coordinated link sharing behavior and partisans’ narrative framing fan the spread of COVID-19 misinformation and conspiracy theories. Social Network Analysis and Mining 12, 1 (2022), 118
work page 2022
-
[53]
Bing He, Mustaque Ahamad, and Srijan Kumar. 2021. PETGEN: Personalized text generation attack on deep sequence embedding-based classification models. In ACM KDD
work page 2021
-
[54]
Howard, Aiden Duffy, Deen Freelon, Muzammil M
Philip N. Howard, Aiden Duffy, Deen Freelon, Muzammil M. Hussain, Will Mari, and Marwa Maziad. 2011. Opening closed regimes: What was the role of social media during the Arab Spring? SSRN:2595096
work page 2011
-
[55]
Kristina Hristakieva, Stefano Cresci, Giovanni Da San Martino, Mauro Conti, and Preslav Nakov. 2022. The spread of propaganda by coordinated communities on social media. In ACM WebSci. 191–201
work page 2022
-
[56]
Roberto Interdonato, Matteo Magnani, Diego Perna, Andrea Tagarelli, and Davide Vega. 2020. Multilayer network simplification: Approaches, models and methods. Computer Science Review 36 (2020), 100246
work page 2020
- [57]
-
[58]
Rendsvig, and Jacob Stærk-Østergaard
Laura Jahn, Rasmus K. Rendsvig, and Jacob Stærk-Østergaard. 2023. Detecting coordinated inauthentic behavior in likes on social media: Proof of concept. arXiv:2305.07350
-
[59]
Maurice Jakesch, Kiran Garimella, Dean Eckles, and Mor Naaman. 2021. Trend alert: A cross-platform organization manipulated Twitter trends in the Indian general election. In ACM CSCW. 1–19
work page 2021
-
[60]
Julian Jaursch, Jakob Ohme, and Ulrike Klinger. 2024. Enabling research with publicly accessible platform data: Early DSA compliance issues and suggestions for improvement. Technical Report. Weizenbaum Institute
work page 2024
-
[61]
Keller, David Schoch, Sebastian Stier, and JungHwan Yang
Franziska B. Keller, David Schoch, Sebastian Stier, and JungHwan Yang. 2017. How to manipulate social media: Analyzing political astroturfing using ground truth data from South Korea. In AAAI ICWSM. 564–567
work page 2017
-
[62]
Keller, David Schoch, Sebastian Stier, and JungHwan Yang
Franziska B. Keller, David Schoch, Sebastian Stier, and JungHwan Yang. 2020. Political astroturfing on Twitter: How to coordinate a disinformation campaign. Political Communication 37, 2 (2020), 256–280
work page 2020
-
[63]
Baris Kirdemir, Oluwaseyi Adeliyi, and Nitin Agarwal. 2022. Towards characterizing coordinated inauthentic behaviors on YouTube. In ROMCIR. 100–116
work page 2022
-
[64]
Charles Kriel and Alexa Pavliuc. 2019. Reverse engineering Russian Internet Research Agency tactics through network analysis. Defence Strategic Communication 6 (2019)
work page 2019
-
[65]
Aytalina Kulichkina, Nicola Righetti, and Annie Waldherr. 2024. Protest and repression on social media: Pro-Navalny and pro-government mobilization dynamics and coordination patterns on Russian Twitter. New Media & Society (2024)
work page 2024
-
[66]
Kyumin Lee, James Caverlee, Zhiyuan Cheng, and Daniel Z. Sui. 2013. Campaign extraction from social media. ACM Transactions on Intelligent Systems and Technology 5, 1 (2013), 9:1–9:28
work page 2013
-
[67]
Renan S. Linhares, José M. Rosa, Carlos H. G. Ferreira, Fabricio Murai, Gabriel Nobre, and Jussara Almeida. 2022. Uncovering coordinated communities on Twitter during the 2020 US election. In IEEE/ACM ASONAM. 80–87
work page 2022
-
[68]
Sahil Loomba, Alexandre De Figueiredo, Simon J Piatek, Kristen De Graaf, and Heidi J Larson. 2021. Measuring the impact of COVID-19 vaccine misinformation on vaccination intent in the UK and USA. Nature Human Behaviour 5, 3 (2021), 337–348
work page 2021
- [69]
-
[70]
Lorenzo Lucchini, Luca M. Aiello, Laura Alessandretti, Gianmarco De Francisci Morales, Michele Starnini, and Andrea Baronchelli. 2022. From Reddit to Wall Street: The role of committed minorities in financial collective action. Royal Society Open Science 9, 4 (2022), 211488
work page 2022
-
[71]
Luca Luceri, Silvia Giordano, and Emilio Ferrara. 2020. Detecting troll behavior via inverse reinforcement learning: A case study of Russian trolls in the 2016 US election. In AAAI ICWSM. 417–427
work page 2020
-
[72]
Luca Luceri, Valeria Pantè, Keith Burghardt, and Emilio Ferrara. 2024. Unmasking the Web of deceit: Uncovering coordinated activity to expose information operations on Twitter. In ACM WWW
work page 2024
-
[73]
Thomas Magelinski and Kathleen M. Carley. 2020. Detecting coordinated behavior in the Twitter campaign to reopen America . Technical Report. School of Computer Science, Carnegie Mellon University
work page 2020
-
[74]
Thomas Magelinski, Lynnette H. X. Ng, and Kathleen Carley. 2022. A synchronized action framework for detection of coordination on social media. Journal of Online Trust and Safety 1, 2 (2022)
work page 2022
-
[75]
Matteo Magnani, Obaida Hanteer, Roberto Interdonato, Luca Rossi, and Andrea Tagarelli. 2021. Community detection in multiplex networks. ACM Computing Surveys (CSUR) 54, 3 (2021), 1–35. Manuscript submitted to ACM 34 Mannocci et al
work page 2021
-
[76]
Thomas W. Malone. 1987. Modeling coordination in organizations and markets. Management Science 33, 10 (1987), 1317–1332
work page 1987
-
[77]
Thomas W. Malone. 1988. What is coordination theory? Technical Report 182. Massachusetts Institute of Technology (MIT), Sloan School of Management
work page 1988
-
[78]
Thomas W. Malone and Kevin Crowston. 1990. What is coordination theory and how can it help design cooperative work systems?. InACM CSCW. 357–370
work page 1990
-
[79]
Thomas W. Malone and Stephen A. Smith. 1988. Modeling the performance of organizational structures. Operations Research 36, 3 (1988), 421–436
work page 1988
-
[80]
Zaidi, Shanika Karunasekera, and Christopher Leckie
Isura Manchanayaka, Zainab R. Zaidi, Shanika Karunasekera, and Christopher Leckie. 2024. Identifying coordinated activities on online social networks using contrast pattern mining. In IEEE IJCNN
work page 2024
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.