  Online manipulation of information has become more prevalent in recent years
as state-sponsored disinformation campaigns seek to influence and polarize
political topics through massive coordinated efforts. In the process, these
efforts leave behind artifacts, which researchers have leveraged to analyze the
tactics employed by disinformation campaigns after they are taken down.
Coordination network analysis has proven helpful for learning about how
disinformation campaigns operate; however, the usefulness of these forensic
tools as a detection mechanism is still an open question. In this paper, we
explore the use of coordination network analysis to generate features for
distinguishing the activity of a disinformation campaign from legitimate
Twitter activity. Doing so would provide more evidence to human analysts as
they consider takedowns. We create a time series of daily coordination networks
for both Twitter disinformation campaigns and legitimate Twitter communities,
and train a binary classifier based on statistical features extracted from
these networks. Our results show that the classifier can predict future
coordinated activity of known disinformation campaigns with high accuracy (F1 =
0.98). On the more challenging task of out-of-distribution activity
classification, the performance drops yet is still promising (F1 = 0.71),
mainly due to an increase in the false positive rate. By doing this analysis,
we show that while coordination patterns could be useful for providing evidence
of disinformation activity, further investigation is needed to improve upon
this method before deployment at scale.

Social and Information Networks;Cryptography and Security