A null model to detect coordinated online behavior integrating evidence from multiple indicators

Abstract

Coordinated online accounts can amplify messages and manipulate attention, but detecting such behavior is challenging due to confounding factors like account activity and item popularity. We propose a statistical null-model framework that assesses behavioral similarity between accounts by comparing observed coordination indicators against activity- and popularity-conditioned reference distributions. By combining evidence across multiple indicators and partners, our method can identify suspicious coordination links more accurately. Evaluations on nine labeled information-operation datasets involving over 152 thousand accounts show that aggregating p-values multiplicatively across indicators and partners yields improved detection performance. While results vary across information operations, this approach offers a generalizable and statistically principled tool for uncovering coordinated online behavior.