# The Prevalence of Cybersecurity Misinformation on Social Media: Case Studies
on Phishing Reports and Zoom’s Threats

Mohit Singhal, Nihal Kumarswamy, Shreyasi Kinhekar, Shirin Nilizadeh  The
University of Texas at ArlingtonArlingtonTexasUSA (mohit.singhal,
nihal.kumarswamy<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract.

Recently, threat intelligence and security tools have been augmented to use
the timely and relevant security information extracted from social media.
However, both ordinary users and malicious actors may spread misinformation,
which can misguide not only the end-users but also the threat intelligence
tools. In this work, for the first time, we study the prevalence of
cybersecurity and privacy misinformation on social media, focusing on two
different topics: _phishing websites_ and _Zoom’s security & privacy_. We
collected Twitter posts that were warning users about phishing websites and
tried to verify these claims. We found about 22% of these tweets to be not
valid claims. We then investigated posts about Zoom’s security and privacy on
multiple platforms, including Instagram, Reddit, Twitter, and Facebook. To
detect misinformation related to Zoom, we first created a groundtruth dataset
and a taxonomy of misinformation and identified the textual and contextual
features to be used for training classifiers to detect posts that discuss the
security and privacy of Zoom and detect misinformation. Our classifiers showed
great performance, e.g., Reddit and Facebook misinformation classifier reached
an accuracy of 99% while Twitter and Instagram reached an accuracy of 98%.
Employing these classifiers on the posts from Instagram, Facebook, Reddit, and
Twitter, we found that respectively about 3%, 10%, 4% and 0.4% of Zoom’s
security and privacy posts as misinformation. This highlights the need for
social media platforms to dedicate resources to curb the spread of
misinformation, and for data-driven security tools to propose methods to
minimize the impact of such misinformation on their performance.

Phishing, Misinformation, Zoom, Security & Privacy, Classification

††ccs: Security and privacy††ccs: Information systems Social networking
sites††ccs: Social and professional topics Phishing††ccs: Information systems
World Wide Web

##  1\. Introduction

Recently, cybersecurity experts use social media to publish the threat
information in real-time. For example, recent research has shown that 25% of
vulnerabilities appear on social media before the National Vulnerability
Database (NVD) (PNN, 2020). As a result, social media is seen as a source for
extracting timely and relevant security information, and numerous threat
intelligence tools, such as Spider-Foot (spi, 2021) and IntelMQ (Int, 2021),
collect open source intelligence from them. Scholars (Alves et al., 2021; Le
et al., 2019; Le Sceller et al., 2017; Okutan et al., 2017; Sabottke et al.,
2015; Khandpur et al., 2017; Ritter et al., 2015) have also proposed methods
for identifying new vulnerabilities from social media and updating security
databases.

Additionally, social media is used by non-cybersecurity experts to express
their concerns over the security and privacy of new technologies. For example,
with the surge in the use of video conferencing tools, such as Zoom (nyt,
2020) during the pandemic, came the concerns about the company handling of
security and privacy of its user base. Users discuss issues, such as
Zoombombing (zoo, 2020), and private Zoom meetings that can be available to
the public (zoo, 2020a). Such discussions can affect how users use these
technologies, and how companies address these concerns (Hodge, 2020).

Prior work has extensively studied misinformation related to political news
(Rashkin et al., 2017; Ruchansky et al., 2017; Monti et al., 2019; Karimi and
Tang, 2019; Wang, 2017) and public health (Love et al., 2020; Jin et al.,
2013; Brennen et al., 2020; Kouzy et al., 2020; Hornik et al., 2021). While
the spread of political and health related posts might have roots in people’s
political and cultural views and beliefs, in this paper, we investigate if
misinformation on technological topics, such as emerging security and privacy
threats, are prevalent. Misinformation in general, can misguide end users, but
misinformation about cybersecurity and privacy can also mislead data-driven
security tools, such as anti-phishing and malware detection tools.

In this work, for the first time, we examine the correctness of Twitter posts
about newly detected phishing websites. We define a claim about phishing
website misinformation if the phishing link provided in the tweet refers to a
benign website, and therefore the report is false. We chose to examine
inaccurate reports about phishing websites, because: first, phishing is one of
the most common threats on the web (fbi, 2020; kno, 2021), second, many of the
anti-phishing tools rely on reports provided by Internet users (phi, 2020;
apw, 2021; saf, 2021; kas, 2018). False reports about websites can have
various consequences, but the most immediate effect is the decrease in the
websites’ visits, especially if these websites are added to blocklists used by
anti-phishing websites. For investigating the correctness of such phishing
reports on social media, we employ a multi-step approach, which includes
obtaining tweets about phishing, extracting unique URLs, and then regularly
checking them via VirusTotal (Vir, 2020b), on PhishTank (phi, 2020) and
manually.

As a second case study, we examine the correctness of Instagram, Reddit,
Facebook & Twitter posts about _Zoom_ ’s security and privacy threats. During
the global outbreak of the COVID-19 pandemic, society has found ways to
connect via online video calling apps, such as Zoom, Microsoft Teams, Skype,
etc.

Figure 1. Claim about Zoom

During this time, we also observed a great number of discussions on the
security and privacy threats of these technological tools. Not all the
discussions were accurate. We define a post about Zoom’s security and privacy
threats as misinformation if it fails the criteria of providing any supporting
evidence from trusted sources, or if it provides information that is fully or
partially in contrast with that of trusted sources. For example, Figure 1
shows a claim that Zoom is a “Chinese spying tool.” However, the author has
not provided any supporting evidence, also, the tweet claims that Zoom does
not use any encryption service, which is not true on the date this tweet was
posted (see this article (zoo, 2020b)). For investigating the correctness of
such claims, we employed a multi-step approach, by first obtaining posts from
Facebook, Instagram, Reddit, and Twitter, second, creating a ground truth
dataset, third, identifying the features that make misinformation posts
distinguishable from accurate posts, and finally using the features to build a
classifier that detects misinformation. To identify features, we first created
a taxonomy of misinformation in our groundtruth dataset using the open coding
technique (Glaser and Strauss, 2017), analyzed the meta-data obtained from the
posts and authors, and examined the textual and linguistic features.

With these two case studies,our goal is to understand if this is a real
problem that needs to be considered and mitigated by data-driven security
tools that try to enhance their systems using data obtained from social media,
and by social media platforms to minimize the spread of misinformation.

Thus, in this paper, we have the following contributions:

  1. (1)

For the first time, we studied the problem of misinformation about phishing
claims on social media and showed that they are prevalent on Twitter.

  2. (2)

We presented a new annotated groundtruth dataset for security & privacy issues
regarding Zoom, and a Zoom misinformation taxonomy based on the open source
coding.

  3. (3)

We developed classifiers that detect misinformation about Zoom’s security and
privacy on four different social media platforms and they all showed very good
performances.

  4. (4)

Through our analysis, we found that misinformation about Zoom’s security and
privacy is prevalent on Twitter, Facebook, Instagram, and Reddit.

##  2\. Related Work

Obtaining new cyberecurity threats from social media. Recently, some works
have proposed using social media, such as Twitter and Facebook, as the main
source of identifying new vulnerabilities. Alves et al. (Alves et al., 2021)
introduced a Twitter streaming threat monitor that generates a continuously
updated summary of the threat landscape related to a monitored infrastructure.
Okutan et al. (Okutan et al., 2017) integrated tweets with posts from the
GDELT news service and Hackmageddon to detect new threats related to one of
three topics: Defacement, Denial of Service, and Malicious Email/URL. Sabottke
et al. (Sabottke et al., 2015) performed a qualitative and quantitative
analysis of the vulnerability-related information disseminated on Twitter.
Sapienza et al. (Sapienza et al., 2017) introduced a system that leverages the
communication of malicious actors on the darkweb, as well as activity of cyber
security experts on Twitter to automatically generate warnings of imminent or
current cyber-threats.

Misinformation Detection in Social Media. A large body of work has tried
detecting fake political news (Shu et al., 2017; Shu et al., 2019; Zhou et
al., 2020; Elhadad et al., 2019), investigating various linguistic features
(Guo et al., 2019; Hosseinimotlagh and Papalexakis, 2018; Markowitz and
Hancock, 2014) as well as deep neural networks (Karimi et al., 2018; Karimi
and Tang, 2019; Wang et al., 2018; Cueva et al., 2020). In recent months,
scholars have analyzed misinformation related to COVID-19 (Shahi et al., 2021;
Kouzy et al., 2020; Loomba et al., 2021; Singh et al., 2020; Huang and Carley,
2020). Brennen et al. (Brennen et al., 2020) identified some of the main
types, sources, and claims of COVID-19 misinformation. The authors found that
the majority of misinformation on social media came from ordinary people. To
the best of our knowledge, our work is the first longitudinal & data driven
study to find misinformation about security claims made on Twitter about a
website being “phishing” and claims made on social media that “Zoom” is a
security and privacy threat.

Phishing websites. Researchers have extensively addressed phishing attacks by:
(1) studying several techniques used by the attackers (Chiew et al., 2018;
Aleroud and Zhou, 2017; Gupta et al., 2016; Butavicius et al., 2016; Gupta et
al., 2017; Sumner and Yuan, 2019; Goel et al., 2017; Lin et al., 2019; Bitaab
et al., 2021), (2) determining how phishing detection measures fare against
these attacks (Tewari et al., 2016; Gupta et al., 2018; Chorghe and Shekokar,
2016; Sharma et al., 2017; Oest et al., 2018; Sahingoz et al., 2019; Basnet et
al., 2012; Khonji et al., 2013; Prakash et al., 2010; Whittaker et al., 2010;
Zhang et al., 2007; Roy et al., 2021), and, 3) investigating a myriad of
obfuscation strategies used by the attackers to prevent detection by these
prevention tools. For detecting phishing websites, researchers have proposed
mechanisms that rely on URL blocklists (Sonowal and Kuppusamy, 2020; Tan et
al., 2016; Shirazi et al., 2018; Abutair and Belghith, 2017; Oest et al.,
2020; Maroofi et al., 2020; Bell and Komisarczuk, 2020) , and machine learning
(Sahingoz et al., 2019; Peng et al., 2018; Rao and Pais, 2019; Yi et al.,
2018; Hassanpour et al., 2018).

##  3\. Analysis of Phishing Reports

In this section, we focus on security warnings related to phishing websites
and study the presence and prevalence of misinformation and disinformation
about these websites on Twitter. We conduct our study on Twitter because of
its popularity and accessibility, and its extensive use by security experts
(Sabottke et al., 2015; Khandpur et al., 2017; Ritter et al., 2015). To detect
misinformation, we identified _benign_ websites that are falsely reported as
_phishing_ by Twitter users. Collecting such tweets then we tried to validate
these claims.

Figure 2. The framework developed for detecting phishing misinformation on
Twitter

Figure 2 shows our framework, that we developed for detecting _phishing_
misinformation, with the following modules: (1) Collection of tweets, (2) Pre-
processing and filtering, (3) URL extraction, and (4) Checking the URLs via
VirusToal and obtaining their labels, i.e., _malicious_ or _benign_.

(1) Collection of tweets: First module using the Twitter streaming API (Twi,
2020) collected 1% sample of daily tweets on Twitter that include the keyword
_phishing_ , from January 11, 2021, to April 11, 2021. (2) Pre-processing and
filtering: Second module filtered tweets to obtain those that were posted on
the same day, as the Twitter API provides tweets posted over the last 7 days.
(3) URL extraction: After manually inspecting a random sample of 100 tweets,
we found that many “phishing” tweets are _educational_ , and are about
phishing threats in general, or provide some stories about phishing events. We
also found that the tweets with phishing reports usually include the
obfuscated URL of the potential phishing website, e.g., using
“hxxps[:]//xyz[.]com,” or “hXXp:[//]xyz[dot]com.” Therefore, the third module
employed regular expressions to retrieve the tweets with obfuscated URLs and
obtain those tweets claiming about specific websites being phishing websites.
We manually checked the obtained tweets and found that the precision of this
module is 1, and our final dataset only includes tweets with phishing claims.
Finally, we extracted the URLs from these tweets to be validated.

Final Dataset: Our aggregated dataset includes about 165K tweets with the
keyword “phishing,” from which 17,770 tweets are phishing claims. Since we
obtained only phishing claims with obfuscated URLs, our analysis provides an
estimate of the prevalence of misinformation regarding phishing websites on
Twitter.

After data collection, on May 3, 2021, the following modules were employed:
(4) Checking unique URLs via VirusToal:  This module evaluated the URLs daily
by passing them through VirusTotal API (Vir, 2020a). VirusTotal provides
aggregated results for an URL obtained from 80 scan engines by third-party
security vendors. Given a particular URL, the API (Vir, 2020b) returns the
labels from all the vendors, and it shows the number of scan engines that
detected the URL as _malicious_ and _benign_. Previous work (Peng et al.,
2019; Kantchelian et al., 2015) has pointed out that VirusTotal is slow in
updating its database and hence there is a high probability that a website
that was flagged as benign on the first day, be flagged malicious later on. To
overcome this limitation, the module employed VirusTotal three weeks after the
last day of data collection. Using the results from VirusTotal, the module
labeled each URL either as _benign_ or _malicious_. (5) Checking benign URLs
on PhishTank: Since anti-phishing engines can misclassify malicious URLs as
benign, this module further passed all the URLs labeled as _benign_ to
PhishTank. PhishTank (phi, 2020) is a free community-based site, where anyone
can submit phishing reports. These reports are then validated by some human
verifiers, and added to/ removed from the database.

We assume that if a website is active, benign, and not reported to Phishtank,
then with a high probability they are misinformation. (6) Manual inspection of
_benign_ URLs: Since it is also possible that the malicious URLs have not been
reported to the PhishTank, additionally, we manually checked the _benign_
URLs. Particularly, on a virtual machine, we checked whether the URL is
mimicking a login page or prompting users to download something (commonly
known as Drive-by-Download).

Table 1. We found 22% of phishing reports to be misinformation, as they were
inaccurately reported as phishing websites.

No. of Tweets |  Unique Users |  Unique URLs |  Malicious URLs |  Benign URLs |  Malicious Tweets |  Benign Tweets (Misinformation) |  Accounts with true claims |  Accounts with false claims
---|---|---|---|---|---|---|---|---
17,770 |  11,472 |  10,578 |  9,603 |  975 (9%) |  13,875 |  3,895 (22%) |  11,200 |  148

Final Results: Table 1 shows our final dataset. We found a union set of 11,472
users who posted 17,770 phishing reports on Twitter. In total, among 10,578
unique URLs, we identified 9,603 as _malicious_ and 975 (about 9%) as _benign_
, which are corresponding to 13,875 and 3,895 tweets, respectively. Therefore,
we can conclude that about 9% of all obfuscated URLs, and about 22% of tweets,
are _misinformation_. We also found that 11,472 unique users with true and 148
unique users with false claims, with 124 users posting a mix of true and false
claims.

Our results show that the spread of misinformation about phishing websites in
social media is very comparable with that of misinformation in other domains,
specifically health misinformation. For example, previous scholarships
(Blankenship et al., 2018; Dunn et al., 2015; Massey et al., 2016) have found
a similar prevalence of misinformation about _vaccines_ (24%, 25%, and 25%,
respectively).

###  3.1. Accounts and Campaign Characterization

Table 2. Descriptive statistics of our final datasets.

| Users with true claims | Users with false claims
---|---|---
Feature | Mean | Min | Max | Median | Mean | Min | Max | Median
Followers | 6,210 | 0 | $\sim 12M$ | 302 | 2,049 | 0 | $\sim 35K$ | 426
Friends | 1,347 | 0 | $\sim 275K$ | 416 | 1,264 | 0 | $\sim 22K$ | 458
Tweets | 29,972 | 1 | $\sim 3.4M$ | 4,883 | 60,293 | 6 | $\sim 2.2M$ | 5,426
Verified | 0.02 | 0 | 1 | NA | 0.01 | 0 | 1 | NA

We study the visibility of false phishing claims in terms of the number of
followers and retweets. We also identify and characterize campaigns against
benign websites that are claimed to be phishing.

####  3.1.1. Descriptive Statistics

Table 2 statistically describes the user accounts with true and false claims,
i.e., those whose claims about phishing websites were labeled as true or
false, accordingly. If a user had posted both true and false claims, we
considered them in both sets. We compared the account characteristics of users
with true claims vs. false claims. To compare features, such as _Followers,
Friends, & Tweets_, we ran Mann-Whitney U tests because they do not follow a
normal distribution. We could not reject the null hypothesis that users with
_false_ and _true_ claims have the same distribution of followers counts,
friends count, and tweet counts. We ran chi-square test for the _verified_
variable, and could not reject the null hypothesis. We also compared the
account characteristics of these users with random Twitter users and found
users posting about phishing have different characteristics than random users.
The results are presented in Appendix A.1.

Figure 3. Communities detected in false claim dataset

####  3.1.2. Spread of Misinformation: Followers Count

The first viewers of misinformation are followers of the accounts posting
false claims. From Table 2, you can see that a user with false claims has had
about 35K followers on the date of collection, and the mean number of
followers is about 2K. On May 3rd, we obtained the list of followers. We could
not obtain the union set of all followers, because about 34 accounts have made
their profiles protected since our data collection. In total, these accounts
have 172K followers. Interestingly, we found that most accounts posting
misinformation are following each other, and only 40 of such accounts were not
following other accounts in our false claim dataset. For example, one such
account was following 37 other accounts with false claims which was the
highest count. Our analysis showed that a lot of accounts (about 3%) echoed
the false claim (misinformation) and hence further increasing the
dissemination of misinformation.

####  3.1.3. Spread of Misinformation: Campaigns

We constructed a network based on _following_ relationships between all users
in our false claim dataset using the Louvain Community Detection method
(Blondel et al., 2008). We considered a directed graph as (x,y) $\in$ E does
not necessarily mean that (y,x) $\in$ E. Figure 3 shows the communities that
were detected. In total, our network has 121 nodes and 618 edges. This is only
a subset of the users, as we were not able to obtain the followers of 34
accounts. The average weighted degree is 5.1. The longest shortest path or
network diameter between nodes is 9, and the average path length from one
randomly selected node to another is 2.47. In total, we were able to obtain 6
communities which are shown in different colors such as, pink (37 nodes),
green (34 nodes), purple (22 nodes), red (22 nodes), blue (4 nodes), and light
green (2 nodes).

The biggest community shown in pink has 30.58% of all the nodes, while the
smallest community shown in light green has only 2 nodes. Interestingly, we
found that 66 accounts posted the same false claims in their community. Also,
the community shown in pink contributes to about 51% of the false claims.

(a) Retweet counts

(b) Tweet counts

Figure 4. Histogram of retweets and tweets for false claims.  Figure 5.
Histogram of users based on false claim rate

####  3.1.4. Spread of Misinformation: Retweets Count

To capture the spread of false phishing claims beyond an account’s followers,
we studied retweet counts for each false claim. Retweets can indicate
agreement, endorsement, and even trust (Metaxas, 2017), therefore retweeting
the false claims can even cause higher damage, as people might trust the
content more. Figure 4a shows the histogram of the number of retweets for URLs
with false claims. Interestingly, we found that 764 (67%) of all URLs with
false claims were retweeted more than once. This can show that: first, some
Twitter users have already had some level of trust in the accounts posting the
false phishing claims, and second, the followers of users, who retweeted the
claims, might trust the content even more as two accounts have posted it.

####  3.1.5. Campaign Detection: Campaigns against Specific Websites.

Figure 4b shows the histogram of tweet counts for all the websites in our
false claimed dataset. While most of the websites have been falsely reported
in only one tweet, there are some campaigns where a phishing claim against a
specific website has been tweeted multiple times. We identified 32 URLs, that
were tweeted more than 3 times, by a total of 24 unique users. This suggests
the existence of campaigns against specific websites.

####  3.1.6. Campaign Detection: Users with Many False Claims

Figure 5 shows the histogram of users with false claims divided by their total
number of phishing claims. We found that only a small number of users have
posted many phishing claims. Interestingly, we found one user with 650 false
claims and 3K true claims. About 78% of the users in our dataset, i.e., 8,942
users, have only true claims, while 29 users have only _false claims_. Also,
502 (4.37%) users have a false claim rate of around 0.5. Almost all of these
users have an equal amount of tweets, i.e., one true claim and one false claim
(310 users) or two true claims and two false claims (174 users). Users that
have only posted _false claims_ are suspicious and they might have maliciously
and deliberately sent these tweets.

##  4\. Analysis of Social Media Discussions about Zoom’s Security and Privacy

Figure 6. The framework developed for detecting Zoom security & privacy
misinformation.

In this section, we focus on social media discussions around Zoom’s security
and privacy during the COVID-19 pandemic and study the presence and prevalence
of misinformation regarding it on Facebook, Instagram, Twitter, and Reddit.
Analyzing public data from multiple social media platforms can help us to
investigate how misinformation is circulated differently on these platforms.

To detect misinformation posts in each social media platform, we developed a
binary classifier specific to that platform. Figure 6 shows the steps that
were employed for building such classifiers: (1) Data collection, (2)
Groundtruth and taxonomy creation, (3) Feature selection, (4) Training and
testing classifiers, and (5) Detecting the misinformation in each platform.

###  4.1. Data Collection

In order to collect data from Facebook, Instagram, Reddit, and Twitter, we
used the “posts/search” endpoint of the CrowTangle API (Team, 2020). The
CrowdTangle API provides about 2% of all public Facebook groups and pages, 2M+
public Instagram pages, and about 20K+ of most active sub-reddits (cro, 2021).

using the Observatory on Social Media API (Davis et al., 2016), which allows
us to search tweets from the Decahose, a 10% random sample of public tweets.

We restricted our data to English and from June 1, 2019, to Nov. 30, 2020,
because we wanted to see if users were discussing security and privacy issues
of Zoom before the pandemic, and how the discussions changed when the pandemic
started. We initially obtained posts that include the keyword _Zoom_.

Table 3. The number of posts in each platform

Platform | 2019 | 2020 | After filtering
---|---|---|---
Instagram | 42,639 | 422,874 | 6,885
Facebook | 167,718 | 4,537,280 | 74,590
Reddit | 21,250 | 134,866 | 9,167
Twitter | 4,051 | 114,420 | 8,127

_Pre-processing and filtering:_ Table 3 shows the data collected from the four
platforms. Since we collected the posts that included the keyword “Zoom,” our
dataset contained many posts not talking about security and privacy. To find
additional keywords, we used the snowball sampling technique (Goodman, 1961).
We started by using a couple of seed keywords, including Zoom, Security, and
Privacy. We then extracted posts from our dataset for the month of March for
each respective platform. Using the seed keywords, we iteratively identified
potential keywords that frequently co-occur with the seeds, adding them to our
seed list only after manually ensuring they are closely related to our topic.
After saturation was reached, we manually combined keywords into composites.
In total, we identified 18 such keywords, namely, _Zoom Malware, Zoom
Phishing, Zoom Virus, Zoom Security, Zoom Exploit, Zoom Hijacking, Zoom Bug,
Zoom Hackers, Zoom Privacy, Zoom Backdoor, Zoom Hacked, Zoom Security Bug,
Zoom Windows, Zoom Passwords, Zoom Windows Steal, Zoombombing, and Zoom Data_.
We then used our new expanded keyword list, to filter out the posts. The last
column of Table 3 shows the final dataset that was obtained after our
filtering.

###  4.2. Groundtruth Dataset

####  4.2.1. Groundtruth Creation

For training the classifiers, we first manually labeled a subset of the posts
on each platform to create a groundtruth dataset. Creating a groundtruth is
not a trivial task because we need to verify the correctness of claims and
discussions. We used the following three criteria to label the posts: (a) The
post is talking about “Zoom,” (b) The post is talking about Zoom’s security or
privacy, and (c) The post is either providing some evidence, i.e., links,
videos, etc., from reputable blogs or articles that are verifiable, or not
providing supporting evidence, but we could verify the claims by cross-
checking them with the reputable sources. For that, we checked the post
context and ran a Google search to determine if the post context is already
addressed by the company or reputable sources and if the claim can be
validated. Using these criteria, we defined three labels: _(1) Zoom’s security
and privacy:_ if a post satisfies all of the above mentioned criteria, _(2)
Misinformation:_ if the third criteria is not satisfied, and _(3) Irrelevant:_
if it fails to satisfy either first or second criteria.

Some examples of the posts that were labeled are shown in Table 11 in Appendix
A.2.

####  4.2.2. Annotation Process

To hand-label the posts, two authors annotated 13,200 posts (3,300 randomly
chosen posts from each of Twitter, Instagram, Facebook & Reddit). For
inconsistent results, coders discussed how to resolve disagreements. To assess
the inter-coder reliability, we performed a Cohen-Kappa test (Schuster, 2004).
The inter-rater agreement measured with Kappa score was 0.972, which shows
almost perfect agreement. Table 4 shows the groundtruth dataset that was
obtained after the annotation. We can observe that there are a significant
number of _irrelevant_ posts in our dataset, however, we do find evidence of
misinformation in our dataset. We found 23 instances of users inviting other
users to “Zoombomb” their classes or meetings. We found that 20 of these
targets were for the platform _Zoom_ , while the remaining three were for
_Google Meet_ (gme, 2021).

Table 4. The size of groundtruth datasets per platform.

Platform | Zoom security & privacy | Misinformation | Irrelevant
---|---|---|---
Instagram | 545 | 15 | 2,740
Facebook | 560 | 42 | 2,734
Reddit | 1,045 | 16 | 2,234
Twitter | 1,865 | 36 | 1,468

###  4.3. Taxonomy Creation

Taxonomies help in understanding and representing data into categories and
subcategories. Prior work has successfully implemented taxonomies to better
understand the targets and the types of fake news and hate speech in the
online discourse (Molina et al., 2019; Kapantai et al., 2020; Zannettou et
al., 2019). This motivates our research to build a taxonomy for misinformation
about Zoom’s security and privacy threats, so that we can understand their
types and targets, and also can use the information about their categories and
properties as features for classifying the posts.

We created a taxonomy of misinformation about Zoom’s security and privacy
threats, applying the open coding process (Glaser and Strauss, 2017).
Following this process, one of the authors coded the misinformation posts
identified in the previous subsection until no new categories emerged. To
improve the quality of the categories, we used an iterative process (Corbin
and Strauss, 1990), so that new categories were added, or existing ones were
reorganized. To create the taxonomy, we followed certain guidelines: (1) Read
through the posts, and identify themes and sub-themes; (2) While creating the
categories, identify the motive and meaning of the post; and (3) Consider
various features that can help in the identification of categories.

Table 5. Description of Categories in Taxonomy

Category |  Description
---|---
Accusation |  Accusing various countries and/or businesses of wrongdoing without relevant evidence.
Misleading |  Misleading the audience, promoting and solidifying a myth that rejects accepted narrative, is aligned towards one way of thinking and draws conclusions based on a limited number of facts.
Sources |  Providing altered videos or photos that are not in the context to create confusion; posting URLs that are invalid or are redirected to a third party site.
Structural |  Post has all CAPS headline and content, and misspelling in the content.
Network |  Has a large audience, is verified by the platform. Two or more sources show the same news with the same context over time.
Security |  Post is about fake Zoombombing attacks, sponsors notion that using Zoom leads to hacking, data theft, leads to the backdoor for NSA, is malware and suggests no encryption used for chats and using Zoom leads to phishing attacks.
Privacy |  Post suggests that users are being watched by government, promotes that user data is being mined by other companies, and sponsors the notion that since no encryption, anyone can read your chats.

Figure 7 shows the hierarchical structure of the taxonomy. The taxonomy has 4
main classes (sources, structural, network & post type), 4 sub-classes for
_post type_ class, i.e., accusation, misleading, security & privacy, and 22
subcategories in total. Table 5 gives a high level overview of the description
of each of the classes. We discovered 4 main topics: (i) _Sources_ : Posts
which provide misleading sources videos, URLs or invalid links to other sites,
(ii) _Structural_ : Posts containing irregularities in the content like
misspellings or written in capitalization, (iii) _Network_ : Relates to the
reach or perceived audience of the author, and (iv) _Post Type_ : subdivided
into 3 categories talking about security related or privacy terms and text
containing logic flaws, biased authors, or propagating conspiracy.

After saturation, two authors coded the 206 posts that were labeled as
misinformation. To find the agreement score, we gave a value of 1, if two or
more coders had a perfect agreement, otherwise, we divided the number of
labels where two or more coders agreed by the number of possible values. Using
this methodology, we found a substantial agreement of 72.3%.

The distribution of these posts among different classes are: Sources (78),
Structural (56), Network (12), Accusation (69), Misleading (65), Security
(194), and Privacy (98). Note that one post could be assigned to multiple
classes.

Interestingly, during our manual labeling, we found that two accounts, i.e.,
_NTD News_ & _Epoch Times_ , were constantly sharing the same news, with the
same content. New York Times in an investigation found that _The publication
and its affiliates employed a novel strategy that involved creating dozens of
Facebook pages, filling them with feel-good videos and viral clickbait, and
using them to sell subscriptions and drive traffic back to its partisan news
coverage_ (nyt, 2021).

Figure 7. Zoom Misinformation Taxonomy

Table 6. Performance of classifiers detecting posts about Zoom security and
privacy.

Platform | Accuracy | F1-Score | Precision | Recall
---|---|---|---|---
Instagram |  | 0.94
---
(+/- 0.02)
| 0.93
---
(+/- 0.02)
| 0.93
---
(+/- 0.04)
| 0.94
---
(+/- 0.01)
Facebook |  | 0.91
---
(+/- 0.02)
| 0.91
---
(+/- 0.02)
| 0.91
---
(+/- 0.02)
| 0.91
---
(+/- 0.04)
Reddit |  | 0.93
---
(+/- 0.01)
| 0.93
---
(+/- 0.02)
| 0.93
---
(+/- 0.02)
| 0.93
---
(+/- 0.03)
Twitter |  | 0.81
---
(+/- 0.02)
| 0.81
---
(+/- 0.01)
| 0.81
---
(+/- 0.03)
| 0.81
---
(+/- 0.01)

Table 7. Percentage of Zoom’s security and privacy posts.

Platform | Zoom’s security & privacy | Irrelevant
---|---|---
Instagram | 551 (15%) | 3,034
Facebook | 11,400 (16%) | 59,890
Reddit | 627 (11%) | 5,240
Twitter | 2,927 (61%) | 1,900

###  4.4. Detecting Posts about Zoom’s Security and Privacy Threats

Initially, we tried to use a multi label classifier to classify posts as
either irrelevant, security and privacy related, or misinformation. We noticed
mediocre results with this classifier, possibly due to the unbalanced nature
of our dataset when comparing the number of misinformation posts with
irrelevant posts. We then tried to use a binary classifier to differentiate
misinformation posts from other irrelevant or security and privacy related
posts. Similar to the first classifier model, this also yielded mediocre
results due to an unbalanced dataset. We then built a binary classifier to
detect Zoom’s security and privacy posts. We used the groundtruth dataset
created in Section 4.2, where we combined the misinformation posts with Zoom’s
security and privacy set and labeled them as “0,” and labeled irrelevant posts
as “1.” We built one classifier for each of the four platforms as each
platform gives a different style of data, e.g., Twitter allows up to 280
characters while there is no constraint on that of Facebook posts. To build
our supervised classifiers, we used n-gram features. We found that a mix of
uni-gram & bi-gram features provide a better result compared to uni-gram, bi-
gram or tri-gram. Before extracting the features, we performed pre-processing
on our dataset, removed stop words, emojis, hashtags, and URLs. We vectorized
our data using the TF-IDF (Jones, 1972).

Since our groundtruth dataset for each platform was unbalanced (see Table 4),
we employed several oversampling techniques, such as RandomOversampler,
Synthetic Minority Over-sampling Technique (SMOTE) (Chawla et al., 2002), and
Adaptive Synthetic Sampling (ADASYN) (He et al., 2008) using the imbalanced-
learn library (Lemaître et al., 2017) and we tested multiple classification
algorithms such as Random Forests, SVM, Naive-Bayes & Multi-Layer neural
network using the scikit-learn library (Pedregosa et al., 2011). To evaluate
our classifiers, we used k-cross validation, where $k=3$. From our analysis we
found that RandomOversampler was the best for Instagram, however, SMOTE
provides better results for Facebook and Reddit. We did not oversample Twitter
data because the groundtruth for this platform was already balanced. Table 6
shows the classification performance of Random Forrest classifier as it
provided the best accuracy across all four platforms.

After developing classifiers that can detect posts related to Zoom’s security
and privacy, we ran the classifier on the whole dataset obtained from all the
platforms. Table 7 shows the number and percentage of posts that discuss
Zoom’s security and privacy. As you can see, the percentage of security and
privacy-related posts in our Instagram, Facebook, Reddit, and Twitter datasets
are 15%, 16%, 11%, and 61%.

###  4.5. Detecting Misinformation about Zoom’s Security and Privacy Threats

To estimate the prevalence of misinformation about Zoom’s security and privacy
issues, we developed another classifier, which receives posts related to
Zoom’s security and privacy and detect if they are misinformation. We trained
a new binary classifier for each platform, using our already labeled
groundtruth dataset.

####  4.5.1. Textual and Contextual Feature Selection.

Textual Features: For each platform, we extracted bi-grams and uni-grams from
all the posts and considered the top 100 of them with the highest values of
TF-IDF, which resulted in 37 uni-grams and 63 bi-grams. We tested our
classifiers with 100, 500, 1000, 1500, and 2000 top n-grams, and across all
platforms but Instagram, 100 provided the best results, while 500 provided the
best results for Instagram. Contextual Features: Along with the textual
features obtained from the posts, we extracted a set of contextual features
from the meta-data, which include: (1) _Taxonomy-inspired features:_ Creating
the taxonomy, we found some features that are more apparent in misinformation
posts. For example, in terms of post linguistics, they tend to have all CAPS
content, in terms of network structure, they tend to have a large audience,
and are verified, or in terms of sources, tend to provide altered videos or
photos. Inspired by these properties, we used the following contextual
features: _word counts_ , _noun counts_ , _pronouns counts_ , _number of all
CAPS words_ , _misspelled words count_ , _verified account_ , _followers
count_ , _has a photo/video_ and _has a URL_. (2) _Reaction-inspired
features:_ Posts can get some reaction, e.g., _likes_ , _retweets/shares_ ,
_comments_ , etc. We used appropriate statistical tests, such as Mann-Whitney
U test, T-Test, & Chi-Square test, to examine if such features are
statistically different across the classes.

Based on the test results, we used the following features: for Instagram,
_likes count_ , for Facebook, the number of _likes, comments_ , and _shares_ ,
for Reddit, the number of _likes_ , and _comments_ , for Twitter, we did not
find the number of _likes_ and _retweets_ significant, therefore we did not
use them. (3) _Features based on account characteristics:_ Having access to
Twitter account meta-data, we examined if any of the account characteristics
can distinguish misinformation posters. We used the following features:
_tweets count_ , _profile description length_ , _account age_ , _listed count_
, and _has a profile image_.

####  4.5.2. Classifiers

Since our dataset is highly unbalanced, we used several oversampling
techniques mentioned in the previous section, and we found RandomOverSampler
provides the best results for Instagram and Reddit classifiers, and SMOTE
provides the best results for Facebook and Twitter classifiers. Also, we found
that out of the five machine learning algorithms, Random Forest provides the
best accuracy across the four platforms. We compared the results of the
different algorithms after performing hyperparameter tuning using the
GridSearchCV feature from sklearn in Python. Hyperparameter tuning conducts an
exhaustive search over the parameters to find the best combination of
parameters. Table 8 shows all classifiers, using k-cross validation ($k=3$),
have great performance.

We further verified if our classifiers show consistent performance by randomly
choosing 100 posts from each platform, manually labeling them, and computing
the accuracy on these testing tests. We found that about 98% accuracy in the
case of Instagram, 97% in the case of Reddit, 97% for Facebook, and 98% for
Twitter, which is similar to those obtained during cross-validation.

We examined feature importance in the trained Random Forest model to
understand which of the features have a higher importance in the
classification tasks. The top 10 features and their scores for each model are:
Facebook: no. of all CAPS words (0.083), word count (0.081), _company_
(0.052), _behind_ (0.046), _hey_ (0.045), _live_ (0.037), _police_ (0.036),
_state_ (0.036), _data_ (0.035), and _set_ (0.035). Reddit: _company_ (0.116),
_China_ (0.087), no. of likes (0.066), word count (0.060), _security_ (0.050),
_make_ (0.047), _privacy_ (0.043), _use_ (0.042), _Zoom_ (0.040), and No. of
all CAPS words (0.039). Instagram: _Zoom_ (0.084), No. of all CAPS words
(0.034), word count (0.033), _security_ (0.029), _away_ (0.029), _would_
(0.029), _virus_ (0.028), _say_ (0.028), no. of likes (0.026), and _news_
(0.023). Twitter: Has photo/video (0.072), URL in Tweet (0.070), account age
(0.049), _say_ (0.043), has a profile image (0.042), _privacy_ (0.041),
_window_ (0.038), tweets count (0.036), _Zoom_ (0.031), and followers count
(0.030). As you can see, the top features for each platform span a variety of
feature categories, including textual features such as n-grams, and contextual
features, consisting of taxonomy-, reaction-, and account- inspired features.

Table 8. The performance of misinformation detection classifiers

Platform | Accuracy | F1 Score | Precision | Recall
---|---|---|---|---
Instagram |  | 0.98
---
(+/- 0.01)
| 0.98
---
(+/- 0.02)
| 0.98
---
(+/- 0.01)
| 0.98
---
(+/- 0.02)
Facebook |  | 0.99
---
(+/- 0.00)
| 0.99
---
(+/- 0.01)
| 0.99
---
(+/- 0.00)
| 0.99
---
(+/- 0.01)
Reddit |  | 0.99
---
(+/- 0.01)
| 0.99
---
(+/- 0.01)
| 0.99
---
(+/- 0.00)
| 0.99
---
(+/- 0.01)
Twitter |  | 0.98
---
(+/- 0.01)
| 0.98
---
(+/- 0.02)
| 0.98
---
(+/- 0.02)
| 0.98
---
(+/- 0.01)

Table 9. The percentage of misinformation in each platform.

Platform | Misinformation | Unique users
---|---|---
Instagram | 16 (3%) | 9
Facebook | 2,115 (10%) | 1,517
Reddit | 25 (4%) | 22
Twitter | 10 (0.4%) | 8

####  4.5.3. Results

Finally, we employed our trained classifiers on the posts that are related to
security and privacy to detect those that are misinformation. Table 9 shows
the percentage of misinformation posts per platform. About 3% of posts on
Instagram, 10% of them on Facebook and 4% and 0.4% of them on Reddit and
Twitter are _misinformation_. When comparing our results with groundtruth
dataset, we find that we are at par for Instagram and Facebook with the ratio
of misinformation posts: total security and privacy posts (3% vs 3% & 10% vs
10%). For Reddit, we found a little more misinformation than our groundtruth
(4% vs. 2%), while for Twitter we obtained fewer misinformation posts than our
groundtruth dataset (0.4% vs 2%). These amounts of misinformation per platform
highlight that individual platforms should dedicate resources to curb the
spread of _misinformation_ about cybersecurity & privacy.

####  4.5.4. Growth of Misinformation

To understand the growth of misinformation about Zoom security and privacy
issues, Figure 8 shows the percentages of posts that our classifiers detected
as misinformation over time. The black line represents the time when multiple
states in the US went into COVID-19 lockdown (cov, 2020). As you can see,
Twitter, Instagram, & Reddit follow similar patterns. However, in the case of
Facebook, there are posts that were in 2019, informing users about Zoom’s
security and privacy threats. We then manually inspected the posts, to
understand what issues were being talked about Zoom. Our analysis revealed
that, in the month of July 2019, users were discussing _Zoom hit by DoS_ ,
however, we found that Zoom had a new zero-day vulnerability and not a DoS
attack (zzz, 2019). We see a sudden spike, in the number of misinformation
posts first on Facebook around February 2020, and then subsequent spikes in
Instagram, Twitter, and Reddit after March 2020. Our analysis revealed that
users were claiming that Zoom is malware, a tool by the Chinese Communist
party to spy on people, etc., however, these claims have been refuted (zoo,
2020b; Zoo, 2020). The plot shows a higher percentage of misinformation posted
on Facebook when compared to other platforms. This might be because
misinformation news is easier to be spread on Facebook due to a number of
factors such as the users of Facebook, their moderation policies and also
posting techniques.

Figure 8. Misinformation growth rate.

##  5\. Limitations and Future Work

The analysis on phishing misinformation gives a lower bound of the
_misinformation_ on Twitter because we had access to a 1% sample of Twitter
data. Similarly, in our second study, the size of our datasets was restricted
by _CrowdTangle_. Also, not having access to the followers and friends of
users, we could not detect and analyze possible campaigns. In the future, we
would extend our study to understand the impact of these misinformation
websites on businesses and anti-phishing tools. We would also investigate the
diffusion of cybersecurity and privacy misinformation on various social
networks and examine if they are different from that of political or public
health misinformation.

##  6\. Conclusion

In this work, we first examined the correctness of Twitter reports about
websites being phishing. In total, we found that about 9% of all obfuscated
URLs and about 22% of tweets about phishing websites are _misinformation_.
Second, we examined the correctness of posts, about Zoom’s security and
privacy threats, that were shared on Twitter, Instagram, Reddit, and Facebook.

Using a set of textual and contextual features, we built supervised
classifiers to identify posts discussing the security and privacy of Zoom, and
to detect misinformation in our whole dataset. Our classifiers showed great
performance across all four platforms.

We found about 3%, 10%, 4% and 0.4% of posts on Instagram, Facebook, Reddit,
and Twitter, as misinformation, respectively. Our results show that
misinformation about cybersecurity and privacy not only is present on social
media platforms but also are prevalent. Therefore, the community needs to
further study the misinformation on cybersecurity and investigate its impact
on end-users and threat intelligence tools.

## References

  * (1)
  * kas (2018) 2018\.  Kaspersky Blacklist.  https://support.kaspersky.com/KSMG/1.0/en-EN/91157.htm.
  * zzz (2019) 2019\.  Zoom Zero-Day Bug Opens Mac Users to Webcam Hijacking.  https://threatpost.com/zoom-zero-day-mac-webcam-hijacking/146317/.
  * cov (2020) 2020\.  COVID-19 lockdowns.  https://en.wikipedia.org/wiki/COVID-19_lockdowns.
  * fbi (2020) 2020\.  Internet Crime Report- FBI.  https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf.
  * phi (2020) 2020\.  PhishTank.  https://www.phishtank.com/faq.php.
  * PNN (2020) 2020\.  Software Flaws Sometimes First Reported on Social Media.  https://www.pnnl.gov/news-media/software-flaws-sometimes-first-reported-social-media.
  * nyt (2020) 2020\.  The Virus Changed the Way We Internet.  https://www.nytimes.com/interactive/2020/04/07/technology/coronavirus-internet-use.html.
  * zoo (2020a) 2020a.  Thousands of Zoom video calls left exposed on open Web.  https://www.washingtonpost.com/technology/2020/04/03/thousands-zoom-video-calls-left-exposed-open-web/.
  * Twi (2020) 2020\.  Twitter Developer.  https://developer.twitter.com/en.
  * Vir (2020a) 2020a.  VirusTotal.  https://www.virustotal.com/gui/home/upload.
  * Vir (2020b) 2020b.  VirusTotal API.  https://developers.virustotal.com/reference.
  * zoo (2020b) 2020b.  Zoom Finally Has End-to-End Encryption. Here’s How to Use It.  https://www.wired.com/story/how-to-enable-zoom-encryption/.
  * Zoo (2020) 2020\.  Zoom’s Use of Facebook’s SDK in iOS Client.  https://blog.zoom.us/zoom-use-of-facebook-sdk-in-ios-client/.
  * zoo (2020) 2020\.  ‘Zoombombing’ Attacks Disrupt Classes.  https://www.insidehighered.com/news/2020/03/26/zoombombers-disrupt-online-classes-racist-pornographic-content.
  * apw (2021) 2021\.  Anti-Phishing Working Group.  https://apwg.org/.
  * gme (2021) 2021\.  Google Meet.  https://meet.google.com/.
  * saf (2021) 2021\.  Google Safebrowsing.  https://safebrowsing.google.com/.
  * nyt (2021) 2021\.  How The Epoch Times Created a Giant Influence Machine.  https://www.nytimes.com/2020/10/24/technology/epoch-times-influence-falun-gong.html.
  * Int (2021) 2021\.  IntelMQ.  http://github.com/certtools/intelmq/.
  * kno (2021) 2021\.  Phishing Remains the Most Common Form of Attack.  https://blog.knowbe4.com/phishing-remains-the-most-common-form-of-attack.
  * spi (2021) 2021\.  SpiderFoot, Open Source Intelligence Automation.  http://spiderfoot.net/.
  * cro (2021) 2021\.  What data is CrowdTangle tracking?  https://help.crowdtangle.com/en/articles/1140930-what-data-is-crowdtangle-tracking.
  * Abutair and Belghith (2017) Hassan YA Abutair and Abdelfettah Belghith. 2017.  Using case-based reasoning for phishing detection.  _Procedia Computer Science_ 109 (2017), 281–288.
  * Aleroud and Zhou (2017) Ahmed Aleroud and Lina Zhou. 2017.  Phishing environments, techniques, and countermeasures: A survey.  _Computers & Security_ 68 (2017), 160–196.
  * Alves et al. (2021) Fernando Alves, Aurélien Bettini, Pedro M Ferreira, and Alysson Bessani. 2021.  Processing tweets for cybersecurity threat awareness.  _Information Systems_ 95 (2021), 101586.
  * Basnet et al. (2012) Ram B Basnet, Andrew H Sung, and Quingzhong Liu. 2012\.  Feature selection for improved phishing detection. In _International Conference on Industrial, Engineering and Other Applications of Applied Intelligent Systems_. Springer, 252–261.
  * Bell and Komisarczuk (2020) Simon Bell and Peter Komisarczuk. 2020.  An Analysis of Phishing Blacklists: Google Safe Browsing, OpenPhish, and PhishTank. In _Proceedings of the Australasian Computer Science Week Multiconference_. 1–11.
  * Bitaab et al. (2021) Marzieh Bitaab, Haehyun Cho, Adam Oest, Penghui Zhang, Zhibo Sun, Rana Pourmohamad, Doowon Kim, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, et al. 2021\.  Scam Pandemic: How Attackers Exploit Public Fear through Phishing.  _arXiv preprint arXiv:2103.12843_ (2021).
  * Blankenship et al. (2018) Elizabeth B Blankenship, Mary Elizabeth Goff, Jinging Yin, Zion Tsz Ho Tse, King-Wa Fu, Hai Liang, Nitin Saroha, and Isaac Chun-Hai Fung. 2018.  Sentiment, contents, and retweets: a study of two vaccine-related twitter datasets.  _The Permanente Journal_ 22 (2018).
  * Blondel et al. (2008) Vincent D Blondel, Jean-Loup Guillaume, Renaud Lambiotte, and Etienne Lefebvre. 2008.  Fast unfolding of communities in large networks.  _Journal of statistical mechanics: theory and experiment_ 2008, 10 (2008), P10008.
  * Brennen et al. (2020) J Scott Brennen, Felix Simon, Philip N Howard, and Rasmus Kleis Nielsen. 2020.  Types, sources, and claims of COVID-19 misinformation.  _Reuters Institute_ 7 (2020), 3–1.
  * Butavicius et al. (2016) Marcus Butavicius, Kathryn Parsons, Malcolm Pattinson, and Agata McCormac. 2016.  Breaching the human firewall: Social engineering in phishing and spear-phishing emails.  _arXiv preprint arXiv:1606.00887_ (2016).
  * Chawla et al. (2002) Nitesh V Chawla, Kevin W Bowyer, Lawrence O Hall, and W Philip Kegelmeyer. 2002.  SMOTE: synthetic minority over-sampling technique.  _Journal of artificial intelligence research_ 16 (2002), 321–357.
  * Chiew et al. (2018) Kang Leng Chiew, Kelvin Sheng Chek Yong, and Choon Lin Tan. 2018\.  A survey of phishing attacks: their types, vectors and technical approaches.  _Expert Systems with Applications_ 106 (2018), 1–20.
  * Chorghe and Shekokar (2016) Sharvari Prakash Chorghe and Narendra Shekokar. 2016.  A survey on anti-phishing techniques in mobile phones. In _2016 International Conference on Inventive Computation Technologies (ICICT)_ , Vol. 2. IEEE, 1–5.
  * Corbin and Strauss (1990) Juliet M Corbin and Anselm Strauss. 1990.  Grounded theory research: Procedures, canons, and evaluative criteria.  _Qualitative sociology_ 13, 1 (1990), 3–21.
  * Cueva et al. (2020) Emma Cueva, Grace Ee, Akshat Iyer, Alexandra Pereira, Alexander Roseman, and Dayrene Martinez. 2020.  Detecting Fake News on Twitter Using Machine Learning Models.  (2020).
  * Davis et al. (2016) Clayton A Davis, Giovanni Luca Ciampaglia, Luca Maria Aiello, Keychul Chung, Michael D Conover, Emilio Ferrara, Alessandro Flammini, Geoffrey C Fox, Xiaoming Gao, Bruno Gonçalves, et al. 2016\.  OSoMe: the IUNI observatory on social media.  _PeerJ Computer Science_ 2 (2016), e87.
  * Dunn et al. (2015) Adam G Dunn, Julie Leask, Xujuan Zhou, Kenneth D Mandl, and Enrico Coiera. 2015.  Associations between exposure to and expression of negative opinions about human papillomavirus vaccines on social media: an observational study.  _Journal of medical Internet research_ 17, 6 (2015), e144.
  * Elhadad et al. (2019) Mohamed K Elhadad, Kin Fun Li, and Fayez Gebali. 2019.  Fake news detection on social media: a systematic survey. In _2019 IEEE Pacific Rim Conference on Communications, Computers and Signal Processing (PACRIM)_. IEEE, 1–8.
  * Glaser and Strauss (2017) Barney G Glaser and Anselm L Strauss. 2017.  _Discovery of grounded theory: Strategies for qualitative research_.  Routledge.
  * Goel et al. (2017) Sanjay Goel, Kevin Williams, and Ersin Dincelli. 2017\.  Got phished? Internet security and human vulnerability.  _Journal of the Association for Information Systems_ 18, 1 (2017), 2\.
  * Goodman (1961) Leo A Goodman. 1961\.  Snowball sampling.  _The annals of mathematical statistics_ (1961), 148–170.
  * Guo et al. (2019) Chuan Guo, Juan Cao, Xueyao Zhang, Kai Shu, and Miao Yu. 2019.  Exploiting emotions for fake news detection on social media.  _arXiv preprint arXiv:1903.01728_ (2019).
  * Gupta et al. (2018) Brij B Gupta, Nalin AG Arachchilage, and Kostas E Psannis. 2018\.  Defending against phishing attacks: taxonomy of methods, current issues and future directions.  _Telecommunication Systems_ 67, 2 (2018), 247–267.
  * Gupta et al. (2017) Brij B Gupta, Aakanksha Tewari, Ankit Kumar Jain, and Dharma P Agrawal. 2017.  Fighting against phishing attacks: state of the art and future challenges.  _Neural Computing and Applications_ 28, 12 (2017), 3629–3654.
  * Gupta et al. (2016) Surbhi Gupta, Abhishek Singhal, and Akanksha Kapoor. 2016\.  A literature survey on social engineering attacks: Phishing attack. In _2016 international conference on computing, communication and automation (ICCCA)_. IEEE, 537–540.
  * Hassanpour et al. (2018) Reza Hassanpour, Erdogan Dogdu, Roya Choupani, Onur Goker, and Nazli Nazli. 2018.  Phishing e-mail detection by using deep learning algorithms. In _Proceedings of the ACMSE 2018 Conference_. 1–1.
  * He et al. (2008) Haibo He, Yang Bai, Edwardo A Garcia, and Shutao Li. 2008\.  ADASYN: Adaptive synthetic sampling approach for imbalanced learning. In _2008 IEEE international joint conference on neural networks (IEEE world congress on computational intelligence)_. IEEE, 1322–1328.
  * Hodge (2020) Rae Hodge. 2020\.  Zoom security issues: Zoom buys security company, aims for end-to-end encryption.  https://www.cnet.com/news/zoom-security-issues-zoom-buys-security-company-aims-for-end-to-end-encryption/.
  * Hornik et al. (2021) Robert Hornik, Ava Kikut, Emma Jesch, Chioma Woko, Leeann Siegel, and Kwanho Kim. 2021\.  Association of COVID-19 misinformation with face mask wearing and social distancing in a nationally representative US sample.  _Health communication_ 36, 1 (2021), 6–14.
  * Hosseinimotlagh and Papalexakis (2018) Seyedmehdi Hosseinimotlagh and Evangelos E Papalexakis. 2018.  Unsupervised content-based identification of fake news articles with tensor decomposition ensembles. In _Proceedings of the Workshop on Misinformation and Misbehavior Mining on the Web (MIS2)_.
  * Huang and Carley (2020) Binxuan Huang and Kathleen M Carley. 2020.  Disinformation and misinformation on twitter during the novel coronavirus outbreak.  _arXiv preprint arXiv:2006.04278_ (2020).
  * Jin et al. (2013) Fang Jin, Edward Dougherty, Parang Saraf, Yang Cao, and Naren Ramakrishnan. 2013.  Epidemiological modeling of news and rumors on twitter. In _Proceedings of the 7th workshop on social network mining and analysis_. 1–9.
  * Jones (1972) Karen Sparck Jones. 1972\.  A statistical interpretation of term specificity and its application in retrieval.  _Journal of documentation_ (1972).
  * Kantchelian et al. (2015) Alex Kantchelian, Michael Carl Tschantz, Sadia Afroz, Brad Miller, Vaishaal Shankar, Rekha Bachwani, Anthony D Joseph, and J Doug Tygar. 2015.  Better malware ground truth: Techniques for weighting anti-virus vendor labels. In _Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security_. 45–56.
  * Kapantai et al. (2020) Eleni Kapantai, Androniki Christopoulou, Christos Berberidis, and Vassilios Peristeras. 2020.  A systematic literature review on disinformation: Toward a unified taxonomical framework.  _new media & society_ (2020), 1461444820959296.
  * Karimi et al. (2018) Hamid Karimi, Proteek Roy, Sari Saba-Sadiya, and Jiliang Tang. 2018.  Multi-source multi-class fake news detection. In _Proceedings of the 27th international conference on computational linguistics_. 1546–1557.
  * Karimi and Tang (2019) Hamid Karimi and Jiliang Tang. 2019.  Learning hierarchical discourse-level structure for fake news detection.  _arXiv preprint arXiv:1903.07389_ (2019).
  * Khandpur et al. (2017) Rupinder Paul Khandpur, Taoran Ji, Steve Jan, Gang Wang, Chang-Tien Lu, and Naren Ramakrishnan. 2017.  Crowdsourcing cybersecurity: Cyber attack detection using social media. In _Proceedings of the 2017 ACM on Conference on Information and Knowledge Management_. 1049–1057.
  * Khonji et al. (2013) Mahmoud Khonji, Youssef Iraqi, and Andrew Jones. 2013\.  Phishing detection: a literature survey.  _IEEE Communications Surveys & Tutorials_ 15, 4 (2013), 2091–2121.
  * Kouzy et al. (2020) Ramez Kouzy, Joseph Abi Jaoude, Afif Kraitem, Molly B El Alam, Basil Karam, Elio Adib, Jabra Zarka, Cindy Traboulsi, Elie W Akl, and Khalil Baddour. 2020\.  Coronavirus goes viral: quantifying the COVID-19 misinformation epidemic on Twitter.  _Cureus_ 12, 3 (2020).
  * Le et al. (2019) Ba Dung Le, Guanhua Wang, Mehwish Nasim, and Ali Babar. 2019\.  Gathering cyber threat intelligence from Twitter using novelty classification.  _arXiv preprint arXiv:1907.01755_ (2019).
  * Le Sceller et al. (2017) Quentin Le Sceller, ElMouatez Billah Karbab, Mourad Debbabi, and Farkhund Iqbal. 2017.  Sonar: Automatic detection of cyber security events over the twitter stream. In _Proceedings of the 12th International Conference on Availability, Reliability and Security_. 1–11.
  * Lemaître et al. (2017) Guillaume Lemaître, Fernando Nogueira, and Christos K. Aridas. 2017.  Imbalanced-learn: A Python Toolbox to Tackle the Curse of Imbalanced Datasets in Machine Learning.  _Journal of Machine Learning Research_ 18, 17 (2017), 1–5.  http://jmlr.org/papers/v18/16-365.html
  * Lin et al. (2019) Tian Lin, Daniel E Capecci, Donovan M Ellis, Harold A Rocha, Sandeep Dommaraju, Daniela S Oliveira, and Natalie C Ebner. 2019\.  Susceptibility to spear-phishing emails: Effects of internet user demographics and email content.  _ACM Transactions on Computer-Human Interaction (TOCHI)_ 26, 5 (2019), 1–28.
  * Loomba et al. (2021) Sahil Loomba, Alexandre de Figueiredo, Simon J Piatek, Kristen de Graaf, and Heidi J Larson. 2021\.  Measuring the impact of COVID-19 vaccine misinformation on vaccination intent in the UK and USA.  _Nature human behaviour_ 5, 3 (2021), 337–348.
  * Love et al. (2020) Jennifer S Love, Adam Blumenberg, and Zane Horowitz. 2020\.  The parallel pandemic: Medical misinformation and COVID-19: Primum non nocere.  _Journal of general internal medicine_ 35 (2020), 2435–2436.
  * Markowitz and Hancock (2014) David M Markowitz and Jeffrey T Hancock. 2014.  Linguistic traces of a scientific fraud: The case of Diederik Stapel.  _PloS one_ 9, 8 (2014), e105937.
  * Maroofi et al. (2020) Sourena Maroofi, Maciej Korczyński, and Andrzej Duda. 2020\.  Are You Human? Resilience of Phishing Detection to Evasion Techniques Based on Human Verification. In _Proceedings of the ACM Internet Measurement Conference_. 78–86.
  * Massey et al. (2016) Philip M Massey, Amy Leader, Elad Yom-Tov, Alexandra Budenz, Kara Fisher, and Ann C Klassen. 2016\.  Applying multiple data collection tools to quantify human papillomavirus vaccine communication on Twitter.  _Journal of medical Internet research_ 18, 12 (2016), e318.
  * Metaxas (2017) Panagiotis Metaxas. 2017\.  Retweets indicate agreement, endorsement, trust: A meta-analysis of published Twitter research.  _Arxiv. Retrieved from http://cs. wellesley. edu/~ pmetaxas/WorkingPapers/Retweet-meaning. pdf_ (2017).
  * Molina et al. (2019) Maria D Molina, S Shyam Sundar, Thai Le, and Dongwon Lee. 2019\.  “Fake news” is not simply false information: a concept explication and taxonomy of online content.  _American behavioral scientist_ (2019), 0002764219878224.
  * Monti et al. (2019) Federico Monti, Fabrizio Frasca, Davide Eynard, Damon Mannion, and Michael M Bronstein. 2019\.  Fake news detection on social media using geometric deep learning.  _arXiv preprint arXiv:1902.06673_ (2019).
  * Oest et al. (2020) Adam Oest, Yeganeh Safaei, Penghui Zhang, Brad Wardman, Kevin Tyers, Yan Shoshitaishvili, and Adam Doupé. 2020.  Phishtime: Continuous longitudinal measurement of the effectiveness of anti-phishing blacklists. In _29th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 20)_. 379–396.
  * Oest et al. (2018) Adam Oest, Yeganeh Safei, Adam Doupé, Gail-Joon Ahn, Brad Wardman, and Gary Warner. 2018\.  Inside a phisher’s mind: Understanding the anti-phishing ecosystem through phishing kit analysis. In _2018 APWG Symposium on Electronic Crime Research (eCrime)_. IEEE, 1–12.
  * Okutan et al. (2017) Ahmet Okutan, Shanchieh Jay Yang, and Katie McConky. 2017\.  Predicting cyber attacks with bayesian networks using unconventional signals. In _Proceedings of the 12th Annual Conference on Cyber and Information Security Research_. 1–4.
  * Pedregosa et al. (2011) F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. 2011.  Scikit-learn: Machine Learning in Python.  _Journal of Machine Learning Research_ 12 (2011), 2825–2830.
  * Peng et al. (2019) Peng Peng, Limin Yang, Linhai Song, and Gang Wang. 2019\.  Opening the blackbox of virustotal: Analyzing online phishing scan engines. In _Proceedings of the Internet Measurement Conference_. 478–485.
  * Peng et al. (2018) Tianrui Peng, Ian Harris, and Yuki Sawa. 2018.  Detecting phishing attacks using natural language processing and machine learning. In _2018 ieee 12th international conference on semantic computing (icsc)_. IEEE, 300–301.
  * Prakash et al. (2010) Pawan Prakash, Manish Kumar, Ramana Rao Kompella, and Minaxi Gupta. 2010.  Phishnet: predictive blacklisting to detect phishing attacks. In _2010 Proceedings IEEE INFOCOM_. IEEE, 1–5.
  * Rao and Pais (2019) Routhu Srinivasa Rao and Alwyn Roshan Pais. 2019.  Detection of phishing websites using an efficient feature-based machine learning framework.  _Neural Computing and Applications_ 31, 8 (2019), 3851–3873.
  * Rashkin et al. (2017) Hannah Rashkin, Eunsol Choi, Jin Yea Jang, Svitlana Volkova, and Yejin Choi. 2017.  Truth of varying shades: Analyzing language in fake news and political fact-checking. In _Proceedings of the 2017 conference on empirical methods in natural language processing_. 2931–2937.
  * Ritter et al. (2015) Alan Ritter, Evan Wright, William Casey, and Tom Mitchell. 2015\.  Weakly supervised extraction of computer security events from twitter. In _Proceedings of the 24th International Conference on World Wide Web_. 896–905.
  * Roy et al. (2021) Sayak Saha Roy, Unique Karanjit, and Shirin Nilizadeh. 2021\.  What Remains Uncaught?: Characterizing SparselyDetected Malicious URLs on Twitter.  https://madweb.work/preprints/madweb21-paper28-pre_print_version.pdf.  _Madweb preprint 2021_ (2021).
  * Ruchansky et al. (2017) Natali Ruchansky, Sungyong Seo, and Yan Liu. 2017.  Csi: A hybrid deep model for fake news detection. In _Proceedings of the 2017 ACM on Conference on Information and Knowledge Management_. 797–806.
  * Sabottke et al. (2015) Carl Sabottke, Octavian Suciu, and Tudor Dumitras. 2015\.  Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits. In _24th USENIX Security Symposium (USENIX Security 15)_. USENIX Association, Washington, D.C., 1041–1056.  https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/sabottke
  * Sahingoz et al. (2019) Ozgur Koray Sahingoz, Ebubekir Buber, Onder Demir, and Banu Diri. 2019.  Machine learning based phishing detection from URLs.  _Expert Systems with Applications_ 117 (2019), 345–357.
  * Sapienza et al. (2017) Anna Sapienza, Alessandro Bessi, Saranya Damodaran, Paulo Shakarian, Kristina Lerman, and Emilio Ferrara. 2017.  Early warnings of cyber threats in online discussions. In _2017 IEEE International Conference on Data Mining Workshops (ICDMW)_. IEEE, 667–674.
  * Schuster (2004) Christof Schuster. 2004\.  A note on the interpretation of weighted kappa and its relations to other rater agreement statistics for metric scales.  _Educational and Psychological Measurement_ 64, 2 (2004), 243–253.
  * Shahi et al. (2021) Gautam Kishore Shahi, Anne Dirkson, and Tim A Majchrzak. 2021\.  An exploratory study of covid-19 misinformation on twitter.  _Online Social Networks and Media_ 22 (2021), 100104.
  * Shao et al. (2017) Chengcheng Shao, Giovanni Luca Ciampaglia, Onur Varol, Alessandro Flammini, and Filippo Menczer. 2017.  The spread of fake news by social bots.  _arXiv preprint arXiv:1707.07592_ 96 (2017), 104.
  * Shao et al. (2018) Chengcheng Shao, Giovanni Luca Ciampaglia, Onur Varol, Kai-Cheng Yang, Alessandro Flammini, and Filippo Menczer. 2018.  The spread of low-credibility content by social bots.  _Nature communications_ 9, 1 (2018), 1–9.
  * Sharma et al. (2017) Himani Sharma, Er Meenakshi, and Sandeep Kaur Bhatia. 2017\.  A comparative analysis and awareness survey of phishing detection tools. In _2017 2nd IEEE International Conference on Recent Trends in Electronics, Information & Communication Technology (RTEICT)_. IEEE, 1437–1442.
  * Shirazi et al. (2018) Hossein Shirazi, Bruhadeshwar Bezawada, and Indrakshi Ray. 2018.  ” Kn0w Thy Doma1n Name” Unbiased Phishing Detection Using Domain Name Based Features. In _Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies_. 69–75.
  * Shu et al. (2017) Kai Shu, Amy Sliva, Suhang Wang, Jiliang Tang, and Huan Liu. 2017.  Fake news detection on social media: A data mining perspective.  _ACM SIGKDD explorations newsletter_ 19, 1 (2017), 22–36.
  * Shu et al. (2019) Kai Shu, Suhang Wang, and Huan Liu. 2019.  Beyond news contents: The role of social context for fake news detection. In _Proceedings of the twelfth ACM international conference on web search and data mining_. 312–320.
  * Singh et al. (2020) Lisa Singh, Shweta Bansal, Leticia Bode, Ceren Budak, Guangqing Chi, Kornraphop Kawintiranon, Colton Padden, Rebecca Vanarsdall, Emily Vraga, and Yanchen Wang. 2020\.  A first look at COVID-19 information and misinformation sharing on Twitter.  _arXiv preprint arXiv:2003.13907_ (2020).
  * Sonowal and Kuppusamy (2020) Gunikhan Sonowal and KS Kuppusamy. 2020.  PhiDMA–A phishing detection model with multi-filter approach.  _Journal of King Saud University-Computer and Information Sciences_ 32, 1 (2020), 99–112.
  * Sumner and Yuan (2019) Alex Sumner and Xiaohong Yuan. 2019.  Mitigating Phishing Attacks: An Overview. In _Proceedings of the 2019 ACM Southeast Conference_. 72–77.
  * Tan et al. (2016) Choon Lin Tan, Kang Leng Chiew, KokSheik Wong, et al. 2016\.  PhishWHO: Phishing webpage detection via identity keywords extraction and target domain name finder.  _Decision Support Systems_ 88 (2016), 18–27.
  * Team (2020) CrowdTangle Team. 2020\.  CrowdTangle. Facebook, Menlo Park, California, United States.
  * Tewari et al. (2016) Aakanksha Tewari, AK Jain, and BB Gupta. 2016.  Recent survey of various defense mechanisms against phishing attacks.  _Journal of Information Privacy and Security_ 12, 1 (2016), 3–13.
  * Wang (2017) William Yang Wang. 2017\.  ” liar, liar pants on fire”: A new benchmark dataset for fake news detection.  _arXiv preprint arXiv:1705.00648_ (2017).
  * Wang et al. (2018) Yaqing Wang, Fenglong Ma, Zhiwei Jin, Ye Yuan, Guangxu Xun, Kishlay Jha, Lu Su, and Jing Gao. 2018\.  Eann: Event adversarial neural networks for multi-modal fake news detection. In _Proceedings of the 24th acm sigkdd international conference on knowledge discovery & data mining_. 849–857.
  * Whittaker et al. (2010) Colin Whittaker, Brian Ryner, and Marria Nazif. 2010\.  Large-scale automatic classification of phishing pages.  (2010).
  * Wulczyn et al. (2017) Ellery Wulczyn, Nithum Thain, and Lucas Dixon. 2017\.  Ex machina: Personal attacks seen at scale. In _Proceedings of the 26th International Conference on World Wide Web_. 1391–1399.
  * Yi et al. (2018) Ping Yi, Yuxiang Guan, Futai Zou, Yao Yao, Wei Wang, and Ting Zhu. 2018.  Web phishing detection using a deep learning framework.  _Wireless Communications and Mobile Computing_ 2018 (2018).
  * Zannettou et al. (2019) Savvas Zannettou, Michael Sirivianos, Jeremy Blackburn, and Nicolas Kourtellis. 2019.  The web of false information: Rumors, fake news, hoaxes, clickbait, and various other shenanigans.  _Journal of Data and Information Quality (JDIQ)_ 11, 3 (2019), 1–37.
  * Zhang et al. (2007) Yue Zhang, Jason I Hong, and Lorrie F Cranor. 2007.  Cantina: a content-based approach to detecting phishing web sites. In _Proceedings of the 16th international conference on World Wide Web_. 639–648.
  * Zhou et al. (2020) Xinyi Zhou, Jindi Wu, and Reza Zafarani. 2020.  SAFE: Similarity-Aware Multi-Modal Fake News Detection.  _arXiv preprint arXiv:2003.04981_ (2020).

##  Appendix A Appendix

###  A.1. Comparison of Account Characteristics of Users Posting Phishing
Reports

Table 10. Descriptive statistics of our final datasets.

| Users with true claims | Users with false claims | Random Users
---|---|---|---
Feature | Type | Mean | Min | Max | Median | Mean | Min | Max | Median | Mean | Min | Max | Median
Followers | Count | 6,210 | 0 | 12,000,344 | 302 | 2,049 | 0 | 35,241 | 426 | 3,628 | 0 | 2,148,896 | 321
Friends | Count | 1,347 | 0 | 274,824 | 416 | 1,264 | 0 | 21,700 | 458 | 1,210 | 0 | 963,934 | 420
Tweets | Count | 29,972 | 1 | 3,427,366 | 4,883 | 60,293 | 6 | 2,233,656 | 5,426 | 32,244 | 1 | 5,982,184 | 8,921
Listed Count | Count | 101 | 0 | 14,432 | 6 | 110 | 0 | 6,785 | 10 | 19 | 0 | 18,863 | 1
Profile Descr. | Count | 87 | 0 | 229 | 98 | 84 | 0 | 175 | 81 | 69 | 1 | 200 | 57
Account Age | Count | 7 | 0 | 15 | 8 | 6 | 0 | 14 | 6 | 4 | 0 | 14 | 3
URL in Profile | Bool. | 0.46 | 0 | 1 | NA | 0.42 | 0 | 1 | NA | 0.29 | 0 | 1 | NA
Profile Image | Bool. | 0.47 | 0 | 1 | NA | 0.48 | 0 | 1 | NA | 0.76 | 0 | 1 | NA
Verified | Bool. | 0.02 | 0 | 1 | NA | 0.01 | 0 | 1 | NA | 0.008 | 0 | 1 | NA

Table 11. Examples of posts and assigned labels.

No. | Post | Label |  Reason
---|---|---|---
1 |  Security researchers have called Zoom “a privacy disaster” and “fundamentally corrupt” as allegations of the company mishandling user data snowball #Data #Breach #Zoom https://t.co/r3NcjsmuAB |  Zoom’s security & privacy |  Satisfies all the criteria and link goes to “Guardian” website
2 |  @XXX CEO @XXX: With the popularity of #Zoom, some security concerns have come to light-No end-to-end encryption for call- Sale of user data and analytics without disclosing or proper authorization. #UpskillGang #MilimaCyberAwareness @XXX’ [Tweeted on April 24th 2020] |  Misinformation |  Fails to provide evidence and that no end-to end encryption is false (check this article (zoo, 2020b)) and that it sells user data (check this article (Zoo, 2020))
3 |  [#coronavirus] Japanese fashion brand now sells T-shirts for #Zoom mtg. Change the color and design but basically only simple green T-shirts. Using the technology of virtual back ground and change as you like See below news. Seems to be nice! https://t.co/8lTMxtzKZb |  Irrelevant |  Not about cybersecurity

Table 10 statistically describes the user accounts with true and false claims,

as well as those in our random dataset. If a user had posted both true and
false claims, we considered them in both sets. To have a baseline for
comparing accounts’ characteristics, we collected a random set of 1.1M tweets,
using the Twitter streaming API from October 5th 2021 to October 11th 2021.

To minimize the bias towards users with higher posting rates, we randomly
sampled 20K users out of 789K unique users.

Followers and listed counts can indicate the visibility of accounts.

Twitter listed counts can indicate that the user is known for some topic or
expertise. These two variables do not follow a normal distribution, and
therefore, to compare users, we ran Mann-Whitney U tests. The results

show that accounts who post _true_ claims about phishing websites, on average
have lower number of followers ($Med=302$ vs. $Med=321$, $p<0.05$) compared to
those in the _random_ dataset. However, we could not reject the null
hypothesis that users with _false_ and _true_ claims have the same
distribution of followers counts, and that users with _false_ claims and
_random_ users have the same distribution of followers counts.

The results also show that accounts who post _false_ and _true_ claims about
phishing websites, on average have been listed more ($Med_{false}=10$ vs.
$Med_{rand}=1$, $Med_{true}=6$ vs. $Med_{rand}=1$, $p<0.001$) compared to
those in the _random_ dataset. This indicates that users with _false_ and
_true_ claims are known for more expertise compared to _random_ users. Also,
accounts who post _false_ claims about phishing websites, on average have been
listed more ($Med_{false}=10$ vs. $Med_{true}=6$, $p<0.001$) compared to those
who post _true_ claims. Interestingly this suggests that accounts with _false_
claims are more likely to be known for some expertise.

We also compared other account characteristics related to _identifiability_ of
accounts, including: _verified_ , _profile image_ , _account age_ , _length of
profile description_ , and _URL_. Depending on the type of variable, we ran
t-test or chi-square tests to compare the distributions. We found that on
average users with _true_ and _false_ claims have older accounts than random
users ($M_{true}=7$ vs $M_{rand}=4$) ($t=65.05$, $p<0.001$), and
($M_{false}=6$ vs $M_{rand}=4$) ($t=7.50$, $p<0.001$), respectively, and users
with false and true claims have a longer profile description than random users
($M_{false}=84$ vs $M_{rand}=69$) ($t=3.87$, $p<0.001$), and ($M_{true}=87$ vs
$M_{rand}=69$) ($t=29.82$, $p<0.001$), respectively.

Running chi-square tests for the binary variables, we found that users who
post _false_ and _true_ claims are more likely to have a URL compared to
_random_ users, ($M_{false}=0.42$ vs. $M_{rand}=0.29$) ($X^{2}=11.72$,
$p<0.001$) and ($M_{true}=0.46$ vs. $M_{rand}=0.29$) ($X^{2}=849.81$,
$p<0.001$), respectively. In addition, users who post _false_ and _true_
claims are more likely to have a profile image compared to _random_ users
($M_{false}=0.48$ vs. $M_{rand}=0.76$) ($X^{2}=64.80$, $p<0.001$) and
($M_{true}=0.47$ vs. $M_{rand}=0.76$) ($X^{2}=2,576.58$, $p<0.001$),
respectively. Moreover, accounts who post _true_ claims are more likely to be
verified compared to _random_ users ($M_{true}=0.02$ vs. $M_{rand}=0.008$)
($X^{2}=216.84$, $p<0.001$). However, we could not reject the null hypotheses
that users with _false_ and _true_ claims have the same distributions of the
_identifiability_ characteristics. Interestingly, this result is not
consistent with that of other works that show less identifiable accounts tend
to send malicious content and misinformation (Wulczyn et al., 2017; Shao et
al., 2017, 2018). This can be because these accounts are more likely to post
technical content, and have already established themselves as experts in some
domain.

###  A.2. Zoom Post Examples

Table 11 gives some examples of the posts that were manually labeled. The
first row talks about how Zoom is a privacy disaster and is corrupt, the tweet
provides a link that goes to the _Guardian_ website, hence we labeled it as
_Zoom’s security and privacy_. The second example is saying that “No end-to-
end encryption for call,” which is not true because Zoom addressed this issue
back in February of 2020 (check this article (zoo, 2020b)), and this post was
tweeted on April 24th. Hence, we labeled this post as _misinformation_. The
last row is discussing a Japanese fashion brand now sells T-shirts for #Zoom,
which is _irrelevant_.


# The $H(n)$-move is an unknotting operation for virtual and welded links

Danish Ali  Department of Mathematics, Dalian University of Technology, China
<EMAIL_ADDRESS>,  Zhiqing Yang  Department of Mathematics, Dalian
University of Technology, China<EMAIL_ADDRESS>and  Mohd Ibrahim Sheikh
Department of Mathematics, Graduate School of Natural Sciences, Pusan National
University, Busan 46241, Republic of Korea<EMAIL_ADDRESS>
###### Abstract.

An unknotting operation is a local move such that any knot diagram can be
transformed into a diagram of the trivial knot by a finite sequence of these
operations plus some Reidemeister moves. It is known that for all $n\geq 2$
the $H(n)$-move is an unknotting operation for classical knots and links. In
this paper, we extend the classical unknotting operation $H(n)$-move to
virtual knots and links. Virtualization and forbidden move are well-known
unknotting operations for virtual knots and links. We also show that
virtualization and forbidden move can be realized by a finite sequence of
generalized Reidemeister moves and $H(n)$-moves.

###### Key words and phrases:

unknotting operations, $H(n)$-move , virtualization , virtual knots, welded
knots

###### 2020 Mathematics Subject Classification:

57K10 , 57K12

##  1\. Introduction

Virtual knots were first introduced by Kauffman [1]. A virtual knot is a
generalization of knots in thickened surfaces. A virtual link diagram has two
types of crossings: classical crossings and virtual crossings. Classical
crossings (positive and negative) and a virtual crossing are shown in Fig.1. A
classical crossing has an over arc and an under arc. While a virtual crossing
has neither over arc nor under arc. A virtual crossing consists of two arcs,
with a small circle placed around the double point. Two classical knot
diagrams $K$ and $K^{\prime}$ are equivalent if and only if $K$ can be
transformed into $K^{\prime}$ using classical Reidemeister moves ($R1-R3$) as
shown in Fig.2. Similarly, the two virtual knot diagrams $V$ and $V^{\prime}$
are equivalent if and only if $V$ can be transformed into $V^{\prime}$ using
classical Reidemeister moves and virtual Reidemeister moves ($VR1-VR4$) as
shown in Fig.3. Classical Reidemeister moves and virtual Reidemeister moves
are known as generalized Reidemeister moves.

(a) Positive crossing

(b) Negative crossing

(c) Virtual crossing

Figure 1. Classical crossings and a virtual crossing Figure 2. Classical
Reidemeister moves Figure 3. Virtual Reidemeister moves and a mixed
Reidemeister move

A local move is a transformation of link diagrams $D$ to $D^{\prime}$ that are
identical except inside one small disk of each. An unknotting operation is a
local change on knot (link) diagrams. Any knot (link) diagram can be
transformed into a trivial unknot (unlink) diagram by a series of unknotting
operations plus some Reidemeister moves. One main focus of knot theory is how
to unknot a given knot, and how to distinguish different knots using knot
invariants. Many knot invariants are related to unknotting operations,
therefore, unknotting operations are very important in knot theory. Many local
moves are known as unknotting operations for classical knots and links. Some
well-known unknotting operations for classical knots and links are the
crossing change, $\Delta$-move [2], $\sharp$-move [3], $\Gamma$-move [4] and
$n$-gon move [5, 6].

In classical knot theory, the crossing change is a fundamental technique to
unknot any given knot. Any classical knot diagram can be converted into a
descending diagram by the following procedure. Choose a base point which is an
arbitrary point on a knot diagram, distinct from all crossing points. Now we
travel along the knot from the base point according to the orientation of the
knot. When we meet a crossing, if we first pass the crossing from the lower
arc, we apply a crossing change here; if we first pass the crossing from the
upper arc, we skip it. Finally, we get back to the initial point. After making
all of these crossing changes, the resulting diagram is called a descending
diagram. A descending classical knot diagram represents the unknot. However,
crossing change is not an unknotting operation for virtual knots because some
descending virtual knot diagrams are not the unknot. On the other hand, the
$\Delta$-move, $\sharp$-move, $\Gamma$-move, and $n$-gon move can be realized
by a finite sequence of crossing changes, therefore, none of them is an
unknotting operation for virtual knots. Crossing virtualization is a local
move on a classical crossing that change a classical crossing into a virtual
crossing as shown in Fig.4. Crossing virtualization is an unknotting move for
virtual knots and links [7, 8].

Hoste, Nakanishi and Taniyama in [9] introduced the $H(n)$-move for $n\geq 2$,
as shown in Fig.5 . They proved that the $H(n)$-move is an unknotting
operation for classical knots and links. Therefore, any two classical knot
diagrams can be transformed into each other by a finite sequence of
$H(n)$-moves plus some Reidemeister moves. An $H(n)$-move preserves the number
of link components. They defined an $H(n)$-move for non-oriented link
diagrams, and they defined an $SH(n)$-move as a special type of $H(n)$-move
preserving the orientation of arcs outside the trivial tangle. From now on,
unless otherwise stated, we use the name $H(n)$-move for both oriented and
non-oriented diagrams of virtual knots and links in this paper. We shall prove
that the $H(n)$-move is an unknotting operation for oriented diagrams of
virtual knots and links. All the results of oriented diagrams are valid for
non-oriented diagrams of virtual knots and links. We shall also prove that the
$H(n)$-move is an unknotting operation for welded knots and links.

Figure 4. Crossing virtualization Figure 5. An $H(n)-move$

##  2\. $H(n)$-move is unknotting operation for virtual links

Let $V$ be a virtual knot diagram. If $V$ has no classical crossings, then
using the virtual Reidemeister moves $(VR1-VR3)$ we can transform $V$ into the
diagram of the unknot with no crossing. If $V$ has at least one classical
crossing, we shall show that any classical crossing can be transformed into a
virtual crossing using generalized Reidemeister moves together with
$H(n)$-moves.

######  Theorem 2.1.

Given any integer $n(\geq 2)$, any virtual knot diagram can be transformed
into a trivial knot diagram by a finite sequence of $H(n)$-moves plus some
generalized Reidemeister moves.

######  Lemma 2.1.

A crossing virtualization can be realized by a finite sequence of $H(2)$-moves
plus some generalized Reidemeister moves. The $H(2)$-move is an unknotting
operation for virtual knots.

###### Proof.

Suppose $V$ is a diagram of a virtual knot with some classical crossings.
Orient the diagram and perform an $H(2)$-move at any classical crossing as
shown in Fig.6. We can replace a classical crossing by a virtual crossing
using a finite sequence of $H(2)$-moves plus some generalized Reidemeister
moves. All classical crossings of $V$ can be transformed into virtual
crossings by $H(2)$-moves. As a result, $V$ becomes a trivial knot diagram. ∎

Figure 6. A crossing virtualization can be realized by $H(2)$-moves Figure 7.
A crossing virtualization can be realized by $H(3)$-moves

######  Lemma 2.2.

A crossing virtualization can be realized by a finite sequence of $H(3)$-moves
plus some generalized Reidemeister moves.

###### Proof.

Let $V$ be a virtual knot diagram and suppose that $V$ has some classical
crossings. We can replace a classical crossing by a virtual crossing using a
finite sequence of $H(3)$-moves plus some generalized Reidemeister moves, as
shown n Fig.7. Therefore, a crossing virtualization can be realized by a
finite sequence of $H(3)$-moves plus some generalized Reidemeister moves.
Finally, if $V$ has only virtual crossings, then using the virtual
Reidemeister moves $(VR1-VR3)$ we can transform $V$ into the diagram of the
unknot with no crossing. ∎

######  Lemma 2.3.

An $H(n)$-move can be realized by an $H(n+2)$-move.

###### Proof.

In Fig.8 we illustrate that an $H(n)$-move can be realized by an
$H(n+2)$-move. ∎

Figure 8. An $H(n)$-move can be realized by an $H(n+2)$-move

Proof of Theorem 2.1.

Using Lemmas 2.1, 2.2 and 2.3, we can conclude that a crossing virtualization
can be realized by a finite sequence of $H(n)$-moves plus generalized
Reidemeister moves. Therefore, any classical crossing can be transformed into
a virtual crossing using generalized Reidemeister moves together with
$H(n)$-moves. All classical crossings of a virtual knot diagram can be
transformed into virtual crossings by $H(n)$-moves. As a result, the virtual
knot diagram become a trivial knot diagram. Therefore, the $H(n)$-move is
unknotting operation for virtual knots. Similarly, a virtual link diagram,
$V=v_{1}\cup v_{2}\cup\cdots v_{n}$ with $n$ components, can be unlinked by
generalized Reidemeister moves together with $H(n)$-moves. $\square$

In virtual knot theory, unlike generalized Reidemeister moves there are two
other moves that are not allowed. The two moves shown in Fig.9. are called
forbidden moves, they are known as the $F_{O}$ (over crossing) move and
$F_{U}$ (under crossing) move. Sam Nelson [10] and Taizo kanenobu [11] showed
that the two forbidden moves together can unknot all virtual knot diagrams.
Taizo kanenobu also showed that a $\Delta$-unknotting operation is realized by
a finite sequence of generalized Reidemeister moves and forbidden moves.

If we allow the $F_{O}$ move then virtual knot theory become welded knot
theory. If both forbidden moves are allowed then it become the trivial theory,
since any knot in this theory is equivalent to the trivial knot. Generalized
Reidemeister moves along with $F_{O}$ move are called welded Reidemeister
moves. Two welded knot diagrams $W$ and $W^{\prime}$ are equivalent if and
only if $W$ can be transformed into $W^{\prime}$ using welded Reidemeister
moves. Welded knot theory is closely related to virtual knot theory therefore
it is important to check the effect of $H(n)$-move on welded links.

(a) $F_{O}$ move

(b) $F_{U}$ move

Figure 9. The forbidden moves

Since the$H(n)$-move is an unknotting operation for virtual knots, it is also
an unknotting operation for welded knots. The $F_{U}$ move is an unknotting
operation for welded knots. We will show that the $F_{U}$ move can be realized
by a finite sequence of $H(n)$-moves plus welded Reidemeister moves.

######  Theorem 2.2.

An $F_{U}$ move can be realized by a finite sequence of $H(n)$-moves plus
welded Reidemeister moves.

###### Proof.

An $F_{U}$ move can be realized by a finite sequence of $H(n)$-moves plus
welded Reidemeister moves as shown in Fig.10. ∎

Figure 10. An $F_{U}$ move can be realized by a finite sequence of
$H(n)$-moves Figure 11. A $CF$-move Figure 12. An $CF$-move can be realized by
a finite sequence of $H(n)$-moves

The $CF$-move introduced by Oikawa in [14] is a local move on virtual link
diagrams as shown in Fig.11. It is defined as a combination of crossing
changes and a forbidden move. Two virtual links are $CF$-equivalent if their
diagrams are related by a finite sequence of generalized Reidemeister moves
and $CF$-moves. Oikawa proved that any virtual knot is $CF$-equivalent to the
trivial knot, i.e. the $CF$-move is an unknotting operation for virtual knots.

######  Theorem 2.3.

A $CF$-move can be realized by a finite sequence of $H(n)$-moves plus some
generalized Reidemeister moves.

###### Proof.

A $CF$-move move can be realized by a finite sequence of $H(n)$-moves plus
some generalized Reidemeister moves as shown in Fig.12. ∎

## References

  * [1] L.H. Kauffman, Virtual knot theory, European Journal of Combinatorics, (1999) 20 (7), pp. 663-691.
  * [2] H. Murakami and Y. Nakanishi, On a certain move generating link-homology, Math.Ann. 284 (1989) 75–89
  * [3] H. Murakami, Some metrics on classical knots, Math. Ann. 270 (1985) 35–45.
  * [4] T. Shibuya, Local moves and 4-genus of knots, Mem. Osaka Inst. Tech. Ser. A 45 (2000), 1–10.
  * [5] Y. Nakanishi, Replacements in the Conway third identity, Tokyo J. Math. 14 (1991), 197-203.
  * [6] Haruko Aida, Unknotting Operations of Polygonal Type, Tokyo J. Math. 151 (1992).
  * [7] Yoshiyuki Ohyama and Migiwa Sakurai, Virtualization and $n$-writhes for virtual knots, Journal of Knot Theory and Its Ramifications 28(12) (2019) 1950074.
  * [8] Haruko A. Miyazawa, Kodai Wada and Akira Yasuhara, Generalized virtualization on welded links, J. Math. Soc. Japan 27(3) (2020) 923–944.
  * [9] J. Hoste, Y. Nakanishi and K. Taniyama, Unknotting operations involving trivial tangles, Osaka J. Math. 27(3) (1990) 555–566.
  * [10] S. Nelson, Unknotting virtual knots with Gauss diagram forbidden move Journal of Knot Theory and Its Ramifications 10(6) (2001) 931-935.
  * [11] Taizo Kanenobu, Forbidden moves unknot a virtual knot, Journal of Knot Theory and Its Ramifications 10(1) (2001) 86-96.
  * [12] Shin Satoh, Crossing changes, Delta moves and sharp moves on welded knots, Rocky Mountain J. Math. 48(3) (2018) 967-879.
  * [13] Takuji Nakamura, Yasutaka Nakanishi, Shin Satoh, Akira Yasuhara, The pass move is an unknotting operation for welded knots, Topology and its Applications, 247 (2018) 9-19,
  * [14] T. Oikawa, On a local move for virtual knots and links, Journal of Knot Theory and Its Ramifications 18(11) (2009) 1577–1596.