Behind the Mask: A Taxonomic Analysis of Activities in Online Social Networks

As disinformation campaigns become increasingly sophisticated, researchers struggle to identify malicious actors due to the context-specific nature of existing detection models. This paper presents a new, event-independent taxonomy designed to classify malicious actors on online social networks (OSNs). By integrating insights from subject matter experts (SMEs) and an extensive review of academic literature, the authors created a structured framework that moves beyond simple binary classifications (e.g., bot vs. human) to capture the nuanced strategies and behaviors of those orchestrating deceptive content.

The researchers employed a collaborative, interdisciplinary approach to build the taxonomy. They conducted structured workshops with SMEs to map out actor behaviors and motivations, which were then synthesized with findings from 39 peer-reviewed articles. The development process followed established taxonomy design principles, utilizing axial coding to organize concepts into three primary dimensions: the nature of the actor (who), their specific methods of manipulation (what they do), and their strategic coordination tactics (how they act). This framework was subsequently tested in a real-world case study focusing on anti-migration discourse on Telegram.

The resulting taxonomy provides a four-layer classification system that allows researchers to analyze malicious activity across different platforms and topics. The framework categorizes actors into three roles—creators, spreaders, and ambiguous entities—and maps these against 22 distinct manipulation approaches and six overarching coordination tactics. By focusing on observable behaviors and strategies rather than just content keywords, this taxonomy aims to provide a more robust, transferable tool for identifying and mitigating disinformation campaigns in real-time.