Information Integrity

BLOODHOUND

Coordinated Inauthentic Behavior Detection

The tools to detect coordinated manipulation are locked inside the platforms running it.

Coordinated inauthentic behavior campaigns manipulate public discourse at scale — and the tools to detect them are locked inside platforms that have no incentive to share what they find. Independent researchers, journalists, and analysts are left building cases with incomplete signals and borrowed intuition.

A multi-layer behavioral detection pipeline that identifies CIB through temporal entropy, network coordination, and content propagation analysis — detecting how accounts behave, not what they say.

Four layers. Each detects what the others can't.

Every layer operates on a different behavioral signal. An account can be flagged by one layer and cleared by another — the synthesis resolves these into a unified assessment.

IN
Platform Data
L1
Entropy
L2
Coordination
L3
Content
L4
Semantic
S
Synthesis
D
Dashboard
Layer 1 — Temporal Entropy

Individual Posting Regularity

Measures how predictable each account's posting schedule is using Sample Entropy (SampEn). Automated accounts tend to post with mechanical regularity that humans rarely sustain. Low entropy signals behavioral rigidity.

Layer 2 — Network Coordination

Community Detection

Builds a similarity graph where edges connect accounts with Jensen-Shannon Divergence below threshold. The Leiden algorithm partitions this into communities of behaviorally similar accounts — coordination detected through collective pattern, not individual signals.

Layer 3 — Content Propagation

Shared Content Networks

Identifies accounts sharing identical or near-identical content — URLs, hashtags, and text hashes. Cross-references with L2 communities to distinguish organic viral sharing from coordinated content amplification.

Layer 4 — Semantic Analysis

Narrative Pattern Recognition

Applies large language model analysis to detect narrative coordination — thematic alignment, messaging discipline, and rhetorical patterns that suggest centralized direction rather than organic discourse.

Tested against a known state-sponsored campaign.

Validated on the Internet Research Agency dataset released by Twitter — 9 million events from 3,836 accounts involved in a confirmed influence operation.

9.0M
Events analyzed
3,836
Accounts in dataset
29
Minutes to process
4
Detection layers
42
Communities detected
5
Behavioral tiers

Built for anyone who needs to see the coordination others miss.

Researchers & Academics

Influence Operation Analysis

Study coordinated campaigns with a structured, reproducible pipeline that generates behavioral evidence — not just keyword matches or follower counts. Exportable artifacts for peer review and publication.

Journalists & Investigators

Source Verification at Scale

When a narrative goes viral, determine whether the amplification is organic or manufactured. BLOODHOUND surfaces the behavioral fingerprint behind coordinated campaigns before the story solidifies.

Platform Trust & Safety

Behavioral Triage

Supplement existing content-based moderation with behavioral signals. Detect coordination patterns that content analysis alone can't see — accounts that never post the same text but move in lockstep.

Under the hood.

Processing

ArchitectureTwo-pass in-memory
Pass 1Timestamps + actions (L1, L2)
Pass 2Content hashes (L3)
Throughput~310K events/min
MemoryStreaming, not batch

Detection Parameters

Min events per account50
JSD similarity threshold< 0.15
Min community size5 members
Tier systemT1–T5 + EX
Community algorithmLeiden

Outputs

Behavioral synthesisPer-account report
Content synthesisCommunity-level
Interactive dashboardD3.js visualization
Export formatsJSON, CSV, HTML
Audit trailFull pipeline log

Deployment

RuntimePython 3.10+
APIFastAPI + Uvicorn
Cloud targetAWS ECS / Fargate
StorageS3 (production)
AuthCognito + CloudFront

Adapter-based architecture. One pipeline, multiple sources.

BLOODHOUND's detection engine is platform-agnostic. Adapters normalize platform-specific data formats into a common behavioral schema.

Twitter / X
Active — TMRC format
Bluesky
Planned
Telegram
Planned
Reddit
Planned
Mastodon
Planned

Ready to learn more?

Request a demo or discuss how BLOODHOUND fits your workflow.

Get in Touch

We'll respond within two business days.

Message sent.

We'll be in touch shortly.

Download Document

Please provide the following to access the document.

Starting download…

If the download does not begin automatically, click here.