Detecting the Undetectable: Advancing Bot Detection in the Age of Generative AI
Understanding and Detecting Modern Bot Networks
The rapid evolution of digital communication has created unprecedented opportunities for information exchange, but it has also enabled new forms of manipulation at scale. Among the most significant threats to the integrity of online discourse is the growing sophistication of automated and coordinated inauthentic behaviour, commonly referred to as bot activity. Once relatively easy to identify through repetitive messaging or abnormal account metrics, bot operations have become increasingly advanced due to developments in generative artificial intelligence, automation tools and networked amplification strategies. Malicious actors can now mimic human behaviour, diversify narratives and strategically deploy hybrid networks that combine automated accounts with compromised or orchestrated human profiles.
Detecting bot-generated content is therefore no longer a purely technical challenge; it is a democratic imperative. Coordinated bot campaigns can artificially inflate the visibility of harmful narratives, distort public debate, manipulate political processes and accelerate the spread of hate speech and disinformation. When left undetected, such activity risks creating a false perception of consensus, deepening societal polarization and undermining trust in digital platforms and democratic institutions. Understanding how these networks operate — and developing robust methods to identify them — is essential for safeguarding the authenticity of online spaces and protecting the public sphere from systemic manipulation.
Bot behaviour
Posting patterns and timing are essential aspects of bot behaviour. The mathematical algorithm for entropy analyses can shed light on these patterns within a dataset.
In terms of content, it still regularly occurs that bot farms just duplicate the same message en masse. Cosine similarity calculations are also used to track similar message outreach. Recent developments in generative AI unfortunately make it a lot easier for malicious actors to diversify their messages and posting behaviour.
Other methods focus on tracking bot accounts using metrics such as the ratio between followers of an account and the amount of accounts the account in question follows. Unfortunately, depending on the platform, these metrics are hard or expensive to acquire. We can take notice of the changes in bot behaviour during the last national elections in The Netherlands for example, where human user accounts were used to spread malicious content by expressing bot-conforming behaviour. There are many tools on the market that allow such hijacking of human accounts. Similarly there are newer tools that a single person can use to set up their own bot farm to spread or amplify certain narratives. The result of these tools is that we cannot simply rely on one or two factors to find malicious bots on social media. Using alternative tools such as creating irregularities in posting schedules or making many different accounts that post once or twice, it becomes imperative for researchers and policy makers to understand and track these advanced procedures of spreading malicious narratives.
Automated detection
In this iteration of the Cyber Hate Neutralization Hub we want to focus on identifying and tracking these harmful practices. The first method we used in the first iteration of the Hub relied on supervised machine learning that could identify bot accounts using account metrics. This became almost impossible due to changes in the third party data provision metadata when profile information was no longer available.
Therefore, in 2025, we changed the algorithm to focus more on bot behaviour using entropy analysis, which is a feasible, faster, language and platform independent metric.
However, due to advances in bot automation and generative AI, we need to advance our own methods of bot detection in kind.
For this purpose, we will use a variety of advanced network analyses. We will devise networks that can map graphs of social properties. We will also use network analyses to find propagation patterns that can reveal strategised online campaigns.
In addition to this, we will also leverage unsupervised learning to find anomalies, and in turn possible indicators, of bot behaviour. We combine this with network detection of communities through clusters.
At the basis lies the data, which we will enrich further, not only with the current toxicity metrics that are already implemented in the first version of the Hub, but also with adding more metadata layers such as frequency of hashtags, urls, and named entities.
Implications of Bot Activity
Using these methods, we want to map the changing landscape in bot behaviour and online malicious actor campaigns so that we can inform policy makers and build more robust safeguards to arm us against these malicious actors. We will use the Cyber Hate Neutralization Hub to expose social media information manipulation, political attacks, repercussions of malicious online organised campaigns in real life, and whichever other online events that have negative serious consequences.
As bot technologies continue to evolve, so too must the methods used to detect and analyze them. The increasing accessibility of automation tools and generative AI means that influence operations are no longer limited to well-resourced actors; smaller groups and even individuals can now coordinate large-scale campaigns capable of shaping public narratives. This shifting landscape requires continuous methodological innovation, combining behavioural analysis, network mapping and anomaly detection to uncover patterns that would otherwise remain invisible.
Detecting bot activity is critical not only for identifying malicious campaigns but also for preserving the integrity of democratic discourse. Artificial amplification can legitimize extremist viewpoints, intensify online hate, and influence public perception in ways that may translate into real-world consequences. By advancing detection capabilities through the Cyber Hate Neutralization Hub, we aim to provide policymakers, researchers and civil society with actionable insights that strengthen resilience against information manipulation.
Ultimately, improving our ability to detect coordinated inauthentic behaviour is about more than technological advancement — it is about protecting democratic processes, maintaining trust in the digital information environment, and ensuring that public debate reflects genuine participation rather than manufactured influence.
SIDN Fonds
The project was selected as part of SIDN Fund From Liking to Listening call, a themed initiative designed to support ideas that strengthen online debate, counter harmful platform logic, and build tools that foster connection rather than division.