Paper deep dive
IMMENSE: Inductive Multi-perspective User Classification in Social Networks
Francesco Benedetti, Antonio Pellicani, Gianvito Pio, Michelangelo Ceci
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 89%
Last extracted: 8/8/2026, 2:49:01 AM
Summary
The paper introduces IMMENSE, an inductive multi-perspective machine learning method for detecting malicious users in social networks. It integrates content semantics, social relationships, and spatial information to classify users as safe or risky, addressing the limitations of transductive models by enabling generalization to unseen users without retraining.
Entities (6)
Relation Signals (7)
IMMENSE β uses β Inductive Learning
confidence 95% Β· IMMENSE employs an inductive learning approach, enabling it to classify previously unseen users
IMMENSE β evaluatedon β Twitter/X
confidence 92% Β· Experiments carried out on a real-world Twitter/X dataset
IMMENSE β integrates β Social Relationships
confidence 90% Β· integrates three perspectives: ... their social relationships
IMMENSE β integrates β Spatial Information
confidence 90% Β· integrates three perspectives: ... and their spatial information.
IMMENSE β integrates β Content Semantics
confidence 90% Β· integrates three perspectives: the semantics of the users' published content
SAIRUS β uses β Transductive Learning
confidence 88% Β· it operates under a transductive [15] setting.
IMMENSE β outperforms β SAIRUS
confidence 85% Β· showed the superiority of IMMENSE against five state of the art competitors
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Online social networks increasingly expose people to users who propagate discriminatory, hateful, and violent content. Young users, in particular, are vulnerable to exposure to such content, which can have harmful psychological and social repercussions. Given the massive scale of today's social networks, in terms of both published content and number of users, there is an urgent need for effective systems to aid Law Enforcement Agencies (LEAs) in identifying and addressing users that disseminate malicious content. In this work we introduce IMMENSE, a machine learning-based method for detecting malicious social network users. Our approach adopts a hybrid classification strategy that integrates three perspectives: the semantics of the users' published content, their social relationships and their spatial information. Such contextual perspectives potentially enhance classification performance beyond text-only analysis. Importantly, IMMENSE employs an inductive learning approach, enabling it to classify previously unseen users or entire new networks without the need for costly and time-consuming model retraining procedures. Experiments carried out on a real-world Twitter/X dataset showed the superiority of IMMENSE against five state of the art competitors, confirming the benefits of its hybrid approach for effective deployment in social network monitoring systems.
Tags
Links
- Source: https://arxiv.org/abs/2608.05259v1
- Canonical: https://arxiv.org/abs/2608.05259v1
Trouble viewing inline? Open PDF directly β
Full Text
78,397 characters extracted from source content.
Expand or collapse full text
Contents lists available at ScienceDirect Online Social Networks and Media journal homepage: w.elsevier.com/locate/osnem IMMENSE: Inductive Multi-perspective User Classification in Social Networks I Francesco Benedetti a,b,c , Antonio Pellicani a,c, β , Gianvito Pio a,c , Michelangelo Ceci a,c,d a Department of Computer Science, University of Bari, Via Orabona 4, Bari, 70125, Italy b Department of Computer Science, University of Pisa, Largo Bruno Pontecorvo 3, Pisa, 56127, Italy c Data Science Laboratory, National Interuniversity Consortium for Informatics (CINI), Via Volturno 58, Roma, 00185, Italy d Department of Knowledge Technologies, JoΕΎef Stefan Institute, Jamova 39, Ljubljana, 1000, Slovenia A R T I C L E I N F O Keywords: Risky user identification Social network analysis Inductive learning Network topology A B S T R A C T Online social networks increasingly expose people to users who propagate discriminatory, hateful, and violent content. Young users, in particular, are vulnerable to exposure to such content, which can have harmful psychological and social repercussions. Given the massive scale of todayβs social networks, in terms of both published content and number of users, there is an urgent need for effective systems to aid Law Enforcement Agencies (LEAs) in identifying and addressing users that disseminate malicious content. In this work we introduce IMMENSE, a machine learning-based method for detecting malicious social network users. Our approach adopts a hybrid classification strategy that integrates three perspectives: the semantics of the usersβ published content, their social relationships and their spatial information. Such contextual perspectives potentially enhance classification performance beyond text-only analysis. Importantly, IMMENSE employs an inductive learning approach, enabling it to classify previously unseen users or entire new networks without the need for costly and time-consuming model retraining procedures. Experiments carried out on a real-world Twitter/X dataset showed the superiority of IMMENSE against five state of the art competitors, confirming the benefits of its hybrid approach for effective deployment in social network monitoring systems. 1. Introduction The significance of social networks in modern society is widely recognized as they enable various activities such as communication, networking, collaboration, and the sharing of news or interests. In addition, they also enable to perform several kinds of analysis and solve multiple tasks, such as user classification [1,2], profiling [3,4], and recommendation [5β8]. Over time, social media platforms have undergone substantial evo- lution, allowing users to form multiple types of relationships, for in- stance, by liking posts, sharing othersβ opinions, engaging in real-time conversations, and joining groups or communities. Nevertheless, these platforms can also be misused for malicious purposes, including (i) dis- seminating fake news, promoting hate against minorities, and spread- ing radical ideologies, (i) assembling like-minded individuals into extremist communities, and (i) recruiting vulnerable individuals into terrorist or criminal organizations. In this regard, several reports have highlighted how radicals exploit social media platforms [9,10]. I This article is part of a Special issue entitled: βdisinformation-toxicity-harmsβ published in Online Social Networks and Media. β Corresponding author at: Department of Computer Science, University of Bari, Via Orabona 4, Bari, 70125, Italy. E-mail addresses: francesco.benedetti@uniba.it (F. Benedetti), antonio.pellicani@uniba.it (A. Pellicani), gianvito.pio@uniba.it (G. Pio), michelangelo.ceci@uniba.it (M. Ceci). To counter this phenomenon, Law Enforcement Agencies (LEAs) established dedicated divisions whose job is to detect and take action against users who engage in illegal activities. However, social networks are dynamic systems in continuous evolution, generating a massive amount of data that humans cannot monitor in real time. In this scenario, it has become essential to assist LEAs with automated tools ca- pable of detecting inappropriate content and reporting suspicious users. Specifically, for this task, three main dimensions should be taken into account: (i) the content generated by users, since it can reveal beliefs and intentions; (i) the social relationships established with other users and content thereof (i.e., follows, retweets, likes), to identify silent users who do not post inappropriate content but are in touch with other users appearing as suspicious; (i) the spatial relationships, possibly established by geographical closeness among users, since dangerous nearby users are more willing to join local communities. These three dimensions, also referred to as modalities, are usually treated by existing approaches for user classification in a separate manner. In particular, https://doi.org/10.1016/j.osnem.2025.100335 Received 15 April 2025; Received in revised form 18 July 2025; Accepted 3 September 2025 Online Social Networks and Media 50 (2025) 100335 2468-6964/Β© 2025 The Authors. Published by Elsevier B.V. This is an open access article under the C BY-NC-ND license ( http://creativecommons.org/licenses/by- nc-nd/4.0/ ). F. Benedetti et al. most of the existing systems perform the classification based on the content published by users [11,12], or solely based on the topology of the network established based on social or spatial relationships [13,14]. However, online radicalization is a complex phenomenon that involves several aspects. Considering only one of them and disregarding the others can result in not detecting users who are dangerous under a different, unconsidered perspective. For this reason, hybrid strategies that incorporate a combination of different modalities for analyzing social networks have been pro- posed. These strategies have been successfully used in various user classification tasks in social networks, showing improved performance compared with tools that use a single modality/perspective. Among them, focusing on methods aiming to identify suspicious users, that is the goal of the method proposed in the present paper, the method proposed in [1], called SAIRUS, can be considered the first approach that simultaneously leverages the three aspects mentioned above in a multimodal fashion. However, SAIRUS is limited in the approach adopted to represent nodes, as it operates under a transductive [15] setting. In this setting, a classification model is learned from a network containing both labeled and unlabeled nodes, and is then exploited to assign labels to the unlabeled nodes (see Fig. 1(a)). Thus, when training models in such a setting, nodes that need to be labeled have to be already available at training time. As a consequence, it is impossible to classify any node that has not been observed during the training phase. It is therefore noteworthy that a transductive approach cannot be easily adopted in a real-world scenario, since LEAs would need to retrain the model every time a new user needs to be assessed. To overcome this limitation, in this paper we propose IMMENSE (Inductive Multi-perspective Model for usEr classificatioN in Social nEtworks), a new multimodal approach that works in the inductive setting. In particular, IMMENSE learns a model from a labeled network of users provided at training time, that is able to generalize to new, unseen nodes by leveraging the different modalities considered (see Fig. 1(b)). To the best of our knowledge, no existing technique is able to solve the suspicious user identification task in such a setting, si- multaneously leveraging the above-mentioned modalities/perspectives (content, social relationships, and spatial relationships). Therefore, the main contributions of this paper can be summarized as follows: β’we propose the novel method IMMENSE that can be considered among the first approaches that consider multiple perspectives, i.e., the posted content, the social relationships, and the spa- tial relationships, for the identification of risky users in social networks; β’methodologically, IMMENSE is able to work in the inductive setting, enabling the learned model to be directly adopted for making predictions on new users who have not been observed during the training; β’as a consequence, IMMENSE promotes model reusability and, therefore, the sustainability of AI systems, since, in real-world environments, making predictions for a batch of new users does not require to re-train a model from scratch. The remaining of the paper is organized as follows: in Section 2 we briefly discuss some related work; in Section 3 we describe the details of the proposed approach; in Section 4 we describe the results of our experimental evaluation; finally, in Section 5 we draw some conclusions and outline possible future works. 2. Related work Since this work has its roots in the node classification task for network data, in the following subsection we briefly describe some of the existing transductive and inductive techniques for solving such a task. Then, we provide an overview of existing approaches for user classification in social networks. Fig. 1. A graphical representation of the transductive (on the top) and inductive (on the bottom) learning settings. White nodes represent unlabeled nodes. 2.1. Transductive and inductive learning for network data Early techniques for solving machine learning tasks from network data rely on identifying a numerical representation of nodes (node em- beddings) in a transductive setting [16β20], and learning a predictive model on top of such representations. These techniques are well-suited for scenarios where the network is only partially labeled and the con- sidered task consists of labeling observed nodes only. In this context, pioneering methods for learning node embeddings are DeepWalk [21] and Node2Vec [22], both based on random walks. Nevertheless, we can also find methods working in the transductive setting that directly classify unlabeled nodes without performing a preliminary embedding phase. An example is GNetMine [13], which works with heterogeneous networks, performing label propagation across nodes of different types. On the other hand, techniques able to identify node embeddings in an inductive setting aim to learn a decision function across the entire data space, thus enabling the generalization to unseen nodes that possess similar types of features. One of the most popular approaches is GraphSAGE [23], which operates in an iterative fashion. In particular, it aggregates the features of the nodes in the immediate neighborhood of the node being represented: At each iteration, the representation of a given node at the previous iteration is concatenated with that obtained through the aggregation of the representations of its neighboring nodes, and processed by a nonlinear activation function to compute the new representation. In the inference phase, the learned model is applied to represent a new (unseen) node, also aggregating information from its local neighborhood. More recently, the method Heterogeneous Graph Transformer [24] (HGT) has been specifically proposed for the analysis of heterogeneous graphs. To model heterogeneity, HGT employs multiple parameters that are node-type and edge-type dependent to characterize the heteroge- neous attention over each edge, empowering it to maintain dedicated representations for different types of nodes and edges. Online Social Networks and Media 50 (2025) 100335 2 F. Benedetti et al. Another method that works in the inductive learning setting is AGAIN [25]. It combines a sampling approach with an attention-based strategy. During the sampling phase, a fixed number of neighbors are selected, with the size varying according to the search depth. Then, during the aggregation, an attention mechanism assigns different learnable weights to the neighbors, indicating their relative importance for the embedding of a given node. Finally, it is worth mentioning RIO-GNN [26], an inductive node embedding framework for multi-relational graphs. Its architecture con- sists of three modules: the first measures the similarity among training instances sharing the same label; the second uses these similarity values to sample, for each instance, a set of closest neighbors under each relationship; the third aggregates neighbor information across relations to obtain a comprehensive embedding. In the literature, we can also find approaches capable of operating in both inductive and transductive settings. An example is represented by the popular Graph Attention Networks (GATs) [27], which calculate node representations using multi-head attention [28]. In the transduc- tive setting, GATs process the entire network simultaneously, learning attention weights that model the relative importance of node relation- ships in the existing graph structure. However, GATs do not require that all nodes are available during training, as their shared attention mechanisms can generalize to unseen nodes. When new nodes become available, the learned attention functions are applied inductively to process their neighborhood structures and properties. Another approach capable of operating in both settings is Graph Extrapolation Network [29], having the goal to perform Out Of Graph (OOG) link prediction. The representation for a new node is computed by exploiting the features of its neighboring nodes and edges. At training time, in order to incorporate knowledge about the relationships between unseen nodes, a transductive component is employed. This involves aggregating the representations of neighboring nodes, also considering unseen nodes, which are generated/simulated at training time via a meta-learning framework. 2.2. User classification in social networks The user classification task aims at predicting a label for unlabeled users in a network, based on their properties. The labels may vary depending on the specific considered problem. Existing user classi- fication techniques fall into three categories, namely: content-based, topology-based, and hybrid. Content-based approaches classify users by relying exclusively on their published content. For example, in [2] the authors aim at detecting bot accounts. Users are represented as a document obtained by concatenating their published posts. Documents are divided into a fixed set of chunks and, for each term in the vocabulary, its occurrences in every chunk are counted, obtaining a matrix for each document, where the rows represent chunks and columns represent the number of occurrences in a chunk. A weighting scheme is then used to adjust the term signals to better capture differences between human and bot-generated texts. The signals are decomposed via wavelet transform functions and, lastly, a set of features is extracted from the transformed matrix and fed to a classifier (authors experimented with MLPs and random forests) for learning a binary classification model. A content-based user classification approach was also used for predicting the political affiliation of Twitter users [30]. The authors adopted a two-step approach: first, they use a model based on Bi-LSTM and attention, trained on a corpus of tweets wrote by members of the U.S. Congress, for computing the probability of a single tweet to be associated with the democratic or the republican party. Then, for each user, they average the probabilities computed for their tweets and compute additional statistics, such as standard deviation, minimum, maximum, median, first quartile, third quartile, proportion of tweets with a high probability (>0.6) of being Republican/Democratic. A Support Vector Machine is then used to predict the userβs political affiliation based on these features. Shifting to focus on topology-based classification approaches, it is worth noting that they aim to solve the learning task by performing exclusively the analysis of the topology of the network of relationships. State-of-the-art approaches are mainly based on graph neural networks (GNN) [31], which leverage the properties of the graph to create meaningful representations of nodes (users, in this case), edges (rela- tionships among users), and even the whole graph (the whole social network). In [32] the authors purposely ignored node features to rely solely on the network topology, aiming to show the importance of node connections for user classification. They compared the performance of a model based on harmonic functions [33] with two GNN variants, namely, Graph Convolutional Networks (GCNs) [34] and Graph At- tention Networks (GATs) [27], where the value of node features is purposely set to zero. All three classifiers achieved good results in terms of accuracy, with the harmonic classifier slightly outperforming the two competitors, possibly because natively based on network connections instead of node features. Topology-based approaches have also been investigated for the ex- ploitation of the spatial information. An example is [35], where the goal is to detect areas at higher risk for dengue. The authors analyzed tweets published by users who mentioned having personal experience with the disease. Clustering was performed using the geolocations associated with the tweets, followed by the application of two probabilistic models to identify spatial regions with a higher risk of infection. Finally, hybrid approaches aim to combine the contribution pro- vided by the content posted by users with that of the network topology. An example of hybrid approach is Gitsec [36], a classification system for Github users, aimed at detecting malicious accounts on the platform. The framework solves classification tasks by taking into account the descriptive features about the accounts, their activity, and two networks: a user-repository graph, that tracks the way each user interacts with repositories, and a user-user graph, that describes the interactions among users. Methodologically, Gitsec uses two separate PLSTM networks connected with the attention mechanism to analyze data about the user activity. A GNN model based on GraphSAGE produces a prediction for the users based on the user-repo graph. The user-user graph is also analyzed and five structural features are obtained for each user. The outputs of these modules, together with the descriptive features of a user, are then fed to a decision maker, such as XGboost, to provide the final prediction for the users. In [37], the authors propose a hybrid user classification framework that considers profile features, user generated content, social relation- ships and social interactions. The proposed system is made of a static module, that extracts statistical features from user profiles and user generated content. A second parallel module based on LSTM extracts dynamic features from user interactions. The two features sets are fed to an XGBoost based classifier to provide the final prediction. Hybrid approaches can also be in the form of general-purpose methods able to solve classification tasks in the relational setting, where each perspective is modeled through one or more tables of a relational database. A relevant example is the system Re3py [38], a classification system based on ensembles of relational decision trees. The method first generates complex aggregate features by navigating foreign key paths involving multiple database tables. Then, a predictive model is learned via top-down induction of decision tree ensembles, that exploit both the original features and the generated ones. In the same category, we can also find the system Mr-SBC [39], a probabilistic approach that extends the naΓ―ve Bayes classifier to handle multirelational settings represented as database tables connected by foreign key constraints. The posterior probabilities are computed using first-order classification rules that are learned during the training phase. It is noteworthy that most of the existing works primarily consider the content posted by users. While some approaches consider the rela- tionships, they often create artificial links based on similarity measures Online Social Networks and Media 50 (2025) 100335 3 F. Benedetti et al. Fig. 2. Schema of the IMMENSE framework. or the co-occurrence of words, rather than explicitly modeling real rela- tionships among users. Moreover, possible spatial relationships among users are almost always ignored. Finally, general-purpose relational methods, like those mentioned before [38,39], do not explicitly capture the semantics of the posted content, but represent it only through a simple document-word table of a relational database. To the best of our knowledge, only one existing method [1] fully integrates the three aspects considered in this paper, also providing the right importance to the semantic of the content posted by users. However, as introduced in Section 1, it exhibits the limitation of transductive approaches, i.e., it cannot perform predictions for new users that have not been observed during the training phase, without re-training the whole model from scratch. On the contrary, the method IMMENSE proposed in this paper fully exploits these three perspective in an inductive learning setting. 3. The proposed method IMMENSE Before describing the proposed method, we formalize some key aspects of the task we intend to solve. Specifically, we define a social network as β¨ν, νΆ, νΈ νΆ , νΈ ν β©, where: β’ν is the set of nodes, each representing a user. Users can be labeled as safe (ν) or risky (ν ). We refer to the former as ν (ν) and to the latter as ν (ν ) . Some users may not be labeled (i.e., their label is unknown), meaning that ν (ν) βͺν (ν ) β ν. β’νΆ is the set of textual contents posted by users. The geographical position from which the content was posted may be available. β’νΈ νΆ β νΓνΆ is the set of relationships that link the users to the textual content they posted. β’νΈ ν β νΓν is the set of topological social connections among users. These relationships are represented by directed links, since are not necessarily symmetric (e.g., if user ν΄ follows user ν΅, it does not imply that user ν΅ follows user ν΄). Since we work in a supervised inductive setting, the training phase exclusively involves labeled users. By leveraging their content, their social relationships and their geographical proximity, we train a model to accurately map users to their respective labels, ensuring it can generalize to new, unseen users. The general architecture of the proposed method IMMENSE is de- picted in Fig. 2, which shows its three main components, specialized for the analysis of the three considered perspectives. A final model fusion step is then performed to combine the contribution of such components. In the following subsections we describe and discuss each phase in detail. 3.1. Semantic content analysis of the textual content This phase analyzes the textual content to generate a user profile and to assign a label according to such a perspective. Specifically, we process the textual content produced by users on the social network, applying a preprocessing pipeline that includes tokenization, stopword removal, and stemming. The resulting posts are then concatenated into a single document for each user, following their chronological ordering. In this way, IMMENSE can also indirectly take into account the way in which the content posted by the user evolved over time. This is possible through the adoption of a Word2Vec model [40], which is trained to map each word, considering its context in the text, into a ν ν -dimensional semantic space. By leveraging the additive compositionality property of word embeddings [41], we compute an embedding vector for each available user. This property allows the userβs embedding to be represented as the sum of the embeddings of the words in their posted contents. Note that to perform this step, also more recent approaches based on BERT or large language models (LLMs) could be used, but we stick with Word2Vec as it demonstrated superior accuracy in previous studies [42,43]. Moreover, learning a Word2Vec embedding is considerably less computationally intensive than training models like BERT or LLMs. Subsequently, we use the obtained embeddings to train two distinct one-class classifiers (one for each class), which are based on stacked autoencoders [44]. An autoencoder is a model that compresses the input into a lower-dimensional representation through an encoder and then reconstructs the original input using a decoder. Formally, given an input ν, an autoencoder learns an encoding function ννβΆνβν β² and a decoding function νννβΆν β² βν such that: (νν, ννν) =νννννν (νν,ννν) βνβννν(νν(ν))β 2 In other words, the goal is to minimize the reconstruction error, which indicates how much the actual input differs from the reconstruc- tion. In our model, the encoder is made of the input layer followed by two linear layers whose dimension is respectively one half and one fourth of the input. The decoderβs layers mirror the structure of the encoder, so that the output has the same dimension as the input. Each layer adopts the ReLU as non linear activation function. We employ one autoencoder trained on the embeddings of users labeled as risky and one autoencoder trained on those labeled as safe. Each userβs representation is fed into both autoencoders, and their respective reconstruction errors, denoted as ν ν and ν ν , are computed as the mean squared error between the input and the output vectors. The semantic content analysis module outputs these two reconstruction error values, along with a label νΏ (ννν) . The label is assigned a value Online Social Networks and Media 50 (2025) 100335 4 F. Benedetti et al. of 0 (safe) if ν ν < ν ν ; otherwise, it is set to 1 (risky). The adoption of two separate autoencoders, rather than a single binary classifier, is motivated by the fact that they tend to provide a higher accuracy in presence of class imbalance [45], which is the situation we face in our scenario. 3.2. Network topology analysis of user social relationships This component analyzes the relationships between users in the social network. Specifically, the user relationships can be represented by an adjacency matrix ν΄β 0,1 |ν|Γ|ν| , where ν΄ νν = 1 if user ν ν follows 1 user ν ν , 0 otherwise. However, this matrix would have an extremely high dimensionality with significant sparsity, making it impractical to process. This occurs because, in most social networks, each user is connected with only a small fraction of the total users in the network, resulting in many entries of the adjacency matrix being zero. To address this issue, before learning a predictive model, we aim to identify a lower-dimensional, denser, feature space, of dimension ν ν , representing the network of relationships of each user. For this purpose, we adopt GraphSAGE [23], that generates embeddings for nodes in a network in an iterative fashion, also exploiting the features of the nodes coming from the local neighborhood. Formally, at the νth iteration and for each user ν£βν, its embedding β ν ν£ is computed also considering its neighborhood ν(ν£). In particu- lar, we first produce an aggregated vector representation β ν ξΊ(ν£) of its neighborhood at the νth iteration as: β ν ξΊ(ν£) = β ν’βξΊ(ν£) β ν’ νβ1 |ξΊ(ν£)| (1) Then, the current step user representation β ν ν£ is obtained by concate- nating its previous representation β νβ1 ν£ to the aggregated neighborhood information β ν ξΊ(ν£) and by feeding the obtained vector through a fully connected layer, whose weights are updated in the training phase, with nonlinear activation function ν (in our case, the ReLU function): β ν ν£ =ν ( ν ν β νΆνννΆν΄ν ( β ν£ νβ1 , β ν ξΊ(ν£) )) (2) where ν ν is a learnable weights matrix. The obtained user represen- tation serves as input for subsequent iterations in the algorithm, each of which is performed by a GraphSAGE layer. Therefore, the number of iterations corresponds with the number of GraphSAGE layers used to generate the final node embedding, as well as to the depth in the network reached when representing each node: each additional GraphSAGE layer expands the nodeβs informational reach by one hop, effectively broadening the considered neighborhood. This layered ap- proach allows the algorithm to capture increasingly complex structural information from the graph, enhancing the richness of the resulting embeddings. In IMMENSE we construct a graph where users are connected based on their relationships in the analyzed social network. Each node (user) in the graph is associated with features corresponding to the userβs semantic representation obtained in the previous phase of the method. It is noteworthy that this choice may appear to possibly introduce some redundancies with respect to the semantic analysis module. However, it is noteworthy that users tend to connect with others who share similar views and beliefs, which are primarily expressed through contents posted on social media platforms. By integrating the features extracted from the content, we not only capture the structure of connections, but also the underlying reasons for these connections. This approach enables a more comprehensive understanding of the network, where topology and content mutually inform one another. Essentially, we 1 In this formalization, we use the follows relationship as an illustrative example. More generally, any asymmetric or symmetric relationship (the latter achieved by duplicating links) can be modeled in a similar way. argue that these features do not introduce substantial redundancy in the representation; instead, they enhance the topological analysis by incorporating semantic information that captures the real-world factors driving network formation. In IMMENSE we train GraphSAGE in a supervised manner to in- corporate user labels from this early stage of the embedding. This approach helps the model to build a representation that facilitates reliable classification in the subsequent steps. To this end, our training architecture consists of three layers, where the first two layers are devoted to capturing the features of neighboring nodes of up to hops in the network, while the final is a linear layer with log-softmax activation function to output the predicted log-probabilities of the node to belong to the safe and risky class. The prediction is used to compute the loss, which is then backpropagated during training. Another important aspect to consider, already mentioned before, is that the task being tackled is inherently imbalanced. While it is diffi- cult to quantify precisely how much content on social media reflects extremist or discriminatory ideologies, it is reasonable to assume that such content represents only a small minority of the overall material available online. Hence, during the learning phase, users cannot be treated equally, as the safe class significantly outnumbers the risky class. This imbalance could lead the model to develop a bias towards the majority class [46]. As a consequence, errors made during the predictions cannot be treated equally, because misclassifying a risky user as safe is much more dangerous than mistakenly predicting that a safe user is risky. To address class imbalance, we consider two alternative strategies: β Class Weighting. This strategy consists in using a weighting schema based on inverse class frequency. In particular, it assigns a weight to each instance, which is inversely proportional to the number of instances belonging to the same class in the training set. More formally: ν€νννβν‘ ννν νν¦ = |ν| |ν (ν ) | ν€νννβν‘ ν νν ν = |ν| |ν (ν) | (3) As training loss function we employ the negative log likelihood. The weights are incorporated into the training loss to give a higher penalty to the model when, during training, it misclassifies instances belonging to the minority class. Formally, let ν ν,ν¦ ν be the predicted probability that the model assigns to the νth instance ν₯ ν of belonging to the true class ν¦ ν , the loss is defined as: ξΈ(ν₯ ν ) = βν€νννβν‘ ν¦ ν β ννν(ν ν,ν¦ ν )(4) where ν€νννβν‘ ν¦ ν =ν€νννβν‘ ννν νν¦ if ν¦ ν = 0, otherwise ν€νννβν‘ ν¦ ν =ν€νννβν‘ ν νν ν . β Focal loss. This strategy employs the focal loss [47], that is a training loss function that directly accounts for the imbalance. It is a variant of the standard cross entropy function, defined as: ξΈ(ν₯ ν , ννν νν¦) = βνΌ ννν νν¦ (1 βΜν ν ) νΎ β ννν(Μν ν )(5) where νΌ ννν νν¦ is a balancing weight, νΎβ₯0 is the focusing tunable parameter, and Μν ν is computed as: Μν ν = ν ν if ν¦=ννν νν¦ 1 βν ν otherwise (6) In practice, the focal loss penalizes wrong false negatives on which the model has high confidence. Once trained, the node classifier is used to compute, for each user ν’ in the training set, two probability values, respectively ν ννν ν (ν’) and ν ννν ν (ν’), which are the predicted probabilities that the user ν’ has of being safe or risky, based only on its social connections in the graph. Such probability values are the output of the relational analysis module, and will be subsequently used in the model fusion phase. Online Social Networks and Media 50 (2025) 100335 5 F. Benedetti et al. 3.3. Analysis of the user spatial closeness This module is devoted to the analysis of the spatial closeness among users in the social network. While we again use an adjacency matrix to represent spatial relationships, the approach slightly differs from that adopted in the previous module. In particular, we construct a matrix νβ [0,1] |ν|Γ|ν| , where, unlike the matrix ν΄ containing binary values used for the analysis of user relationships, each cell ν νν contains a continuous closeness score in [0,1]. This score quantifies the spatial proximity between users ν and ν, providing a granular representation of their spatial relationships. To compute the closeness score, we approximate the position of each user by identifying the most frequent location associated with his/her posted contents. We opt for the most frequent location rather than other possible aggregations of locations, such as the average latitude/longitude, as the latter could potentially generate coordinates corresponding to a place where the user has never actually been. Using these locations, we then compute the geodetic distance be- tween the users of the social network. Specifically, given two users ν’ 1 , ν’ 2 with their latitudes ν 1 , ν 2 and their longitudes ν 1 , ν 2 , the distance ν(ν’ 1 , ν’ 2 ) is given by: ν(ν’ 1 , ν’ 2 ) = 2νβ arctan β β β β β ν(ν’ 1 , ν’ 2 ) 1 βν(ν’ 1 , ν’ 2 ) β β β β (7) where ν is the Earth radius (β6371 km) and ν(ν’ 1 , ν’ 2 ) = sin 2 ( ν 1 βν 2 2 ) + cos(ν 1 )β cos(ν 2 )β sin 2 ( ν 1 βν 2 2 ) . To obtain a closeness score from such dis- tance values, we need to compute the z-normalized distances ν§(ν’ 1 , ν’ 2 ). First we define the mean ν ν and the standard deviation ν ν of the distances as: ν ν = 1 |ν| β β ν,νβν,νβ ν ν(ν, ν)ν ν = β β ν,νβν,νβ ν (ν(ν, ν) βν ν ) 2 |ν| (8) Then, the z-score normalized distance among users (ν’ 1 , ν’ 2 ) is computed as: ν§(ν’ 1 , ν’ 2 ) = ν(ν’ 1 , ν’ 2 ) βν ν ν ν (9) This allows us to distinguish between users who are closer than the average and those who are farther than the average. More formally, since two users ν’ 1 , ν’ 2 are closer than the average if ν§(ν’ 1 , ν’ 2 )<0, we compute the closeness score in [0,1] as follows: νννν νννν (ν’ 1 , ν’ 2 ) = ν§(ν’ 1 ,ν’ 2 ) ννν ν§ if ν§(ν’ 1 , ν’ 2 )<0 0otherwise (10) where ννν ν§ represents the minimum (most negative) z-normalized dis- tance observed across all user pairs in the network. This normalization ensures that the user pair with the smallest z-score (i.e., the geograph- ically closest pair) receives a closeness score of 1, while pairs with positive z-scores (farther than average) receive a closeness score of 0. The obtained spatial adjacency matrix is used to build a graph, where two users ν’1, ν’2 are connected when νννν νννν (ν’ 1 , ν’ 2 )>0, with a weight equal to νννν νννν (ν’ 1 , ν’ 2 ). We employ GraphSAGE also in this case, to extract ν ν dimensional embeddings of nodes. Note that a given user who never shares his/her geographical information in any of his/her posted content will appear as isolated, namely, spatially distant from all the other users. In this case, the embedding identified through GraphSAGE for the spatial dimension will solely rely on his/her initial features, that, as detailed in Section 3.2, are based on the embedding of the posted content. To account for the class imbalance, we adopt the same strategies as we defined for the network topology analysis (see Section 3.2). This module outputs, for a given user ν’, the probabilities ν ν ν ν (ν’) and ν ν ν ν (ν’), that are the predicted probabilities that the user is safe or risky, respectively, based on spatial relationships. Table 1 Quantitative information about the considered dataset. Users37945 Risky users2807 Safe users35138 Users with spatial information1043 Avg document length136 Avg social following per user16 Avg followers per user2 3.4. Model fusion The final module of our method IMMENSE combines the outputs of the three previous modules, to assign a definitive label to each user. Specifically, in this phase, we train a Multi-Layer Perceptron (MLP) that acts as a meta-model, considering the following input features: the risky and safe autoencoders reconstruction errors ν ν , ν ν , along with the label νΏ (ννν) from the semantic content analysis; the predicted label probabilities of the user being risky or safe, respectively ν ννν ν (ν’) and ν ννν ν (ν’), from the analysis of social relationships; the predicted probabilities ν ν ν ν (ν’) and ν ν ν ν (ν’), of the user being risky or safe, based on the analysis of the user spatial closeness. The MLP has one hidden layer with the sigmoid activation function, which allows it to capture possible nonlinear dependencies between input and output variables. Since we are dealing with a classification task, the final layer adopts the softmax activation function, which outputs the predicted probabilities of each user to belong to one class or the other. Given that the outputs are probabilistic, we train the MLP using the negative log likelihood as loss function. We remind that our task is strongly imbalanced. Therefore, also the MLP adopted for the model fusion is trained using one of the strategies outlined in Section 3.2. 4. Experiments In order to evaluate the effectiveness of the proposed method IM- MENSE, we performed an extensive set of experiments. In the following subsections, we first provide some details about the considered dataset, then we describe the considered competitor systems and the exper- imental setting. Finally, we report and discuss the obtained results. 4.1. The considered dataset The dataset for our experimental evaluation was built on the basis of a list of keywords related to radicalism and on a set of known radical/risky posts ν· ν , provided in the context of the Horizon 2020 project CounteR 2 by various Law Enforcement Agencies (LEAs). Using the Twitter API, we retrieved up to 1500 tweets for each keyword, covering the period from February 6th, 2022 to February 6th, 2023. For each author of the downloaded tweets, we then retrieved a list of their followers, limited to a maximum of 1000 due to API usage restrictions. This process allowed us to create a network of social relationships. We finally kept only users who follow more than 5 other users in the obtained list of users, and retrieved up to 20 of the most recent tweets for each user in the network. To define the ground truth, we adopted the following procedure. We employed a pre-trained Word2Vec model 3 to process the dataset ν· ν , extracting |ν· ν | risky embeddings. We then aggregated these em- beddings to obtain a global risky vector ν£ ν , by summation. In the same way, we obtained an embedding for each user, based on his/her posts. We then measured the similarity between ν£ ν and the embedding of 2 https://counter-project.eu/. 3 https://code.google.com/archive/p/word2vec/. Online Social Networks and Media 50 (2025) 100335 6 F. Benedetti et al. Table 2 Results obtained by IMMENSE (with class weighting). The best result in terms of F1 is shown in bold. IMMENSE: ν ν =ν ν =ν ν = 128 ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.7650.9600.8290.9401.0000.9400.9700.5300.9800.688 β a 0.7750.9500.8340.9401.0000.9400.9690.5500.9600.699 β0.7200.9400.7790.9101.0000.9100.9530.4400.9700.605 β a 0.7000.9350.7500.9001.0000.8900.9400.4000.9800.560 β0.7750.9550.8360.9401.0000.9400.9690.5500.9700.702 β a 0.7950.9400.8500.7500.9900.9500.9700.6000.9300.730 β0.8750.9750.9180.9801.0000.9800.9900.7500.9700.846 β0.8400.9750.8910.9701.0000.9700.9800.6800.9800.803 β0.7150.9400.7730.9101.0000.9000.9470.4300.9800.598 β0.8750.9750.9180.9801.0000.9800.9900.7500.9700.846 IMMENSE: ν ν =ν ν =ν ν = 256 ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.8200.9750.8790.9601.0000.9600.9800.6400.9900.777 β a 0.9400.9000.9190.9800.9900.9900.9900.8900.8100.848 β0.7450.9400.8020.9301.0000.9300.9640.4900.9500.640 β a 0.7450.9400.8050.9301.0000.9300.9640.4900.9500.647 β0.7300.9450.7910.9201.0000.9100.9530.4600.9800.630 β a 0.7350.9500.7970.9201.0000.9200.9580.4700.9800.635 β0.8750.9750.9180.9801.0000.9800.9900.7500.9700.846 β0.8500.9800.9020.9701.0000.9700.9850.7000.9900.820 β0.7450.9500.8050.9301.0000.9300.9600.4900.9700.650 β0.8800.9750.9210.9801.0000.9800.9900.7600.9700.852 IMMENSE: ν ν =ν ν =ν ν = 512 ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.8500.9750.9010.9701.0000.9700.9850.7000.9800.817 β a 0.8500.9750.9010.9701.0000.9700.9850.7000.9800.817 β0.7100.9400.7690.9101.0000.9000.9500.4200.9800.588 β a 0.7050.9350.7600.9001.0000.8900.9420.4100.9800.578 β0.7100.9400.7690.9001.0000.9000.9470.4200.9800.590 β a 0.6900.9350.7450.8901.0000.8800.9400.3800.9900.549 β0.8800.9750.9210.9801.0000.9800.9900.7600.9700.852 β0.8800.9750.9180.9801.0000.9800.9900.7500.9700.846 β0.7250.9450.7850.9101.0000.9100.9530.4500.9800.617 β0.8900.9800.9300.9801.0000.9800.9900.7800.9800.870 a For IMMENSE configurations represents the adoption of its C, R, and S modules without the fusion module. each user using cosine similarity. If this similarity exceeded a specified threshold νΏ, the user was labeled as risky in the ground truth, otherwise it was labeled as safe. In this way, we quantify how much the userβs posts are close to actual risky posts. More formally, for each user ν’, we assigned a label as: ννννν(ν’) = ννν νν¦if ννν ννν_ν νννννννν‘ν¦(ν£ ν’ , ν£ ν )β₯νΏ ν νν νotherwise (11) where ν£ ν’ is the embedding of the content posted by the user ν’. After analyzing the distribution of similarity values, we set the threshold νΏ to 0.88, which results in approximately 7% of users being labeled as risky, which can be considered a reasonable proportion in this context according to the LEAs (consider that the corpus is retrieved starting from an expert-defined set of keywords). Finally, we incorporated an additional step that considers the social relationships of users alongside their content. After the initial labeling based on the similarity with the ν£ ν semantic vector, we examined the network of relationships of users labeled as safe. Any of these users having more than 10% of their relationships with risky users were relabeled as risky. In Table 1, we show some quantitative information about the dataset. From the table, we can observe that the information about the geographical position is available only for a small subset of users. 4.2. Experimental setting and competitors Our experiments were carried out by splitting the dataset into training (80% of the users) and testing (20% of the users) sets. The split was made so that the two sets have no common user. In this way, we properly evaluate the inductive capabilities of the system, namely, its ability to effectively generalize to new users, who were not observed during the training phase. We experimented with three different values of the embedding di- mensionality for the textual content ν ν , for the network of relationships ν ν , and for the spatial dimension ν ν . Specifically, we evaluated the following settings: ν ν =ν ν =ν ν = 128, ν ν =ν ν =ν ν = 256, and ν ν =ν ν = ν ν = 512. We choose these values for embedding dimensions based on their widespread use in related work [23,48β51]. We did not consider configurations with different sizes for different perspectives in order to always provide the same a-priori importance to all perspectives and leave the fusion module to properly assess and combine their contribution. We report the results achieved using both the proposed strategies to handle class imbalance (see Section 3.2), namely, class weighting and focal loss. For the latter, we used the values suggested in the original paper [47] for its hyperparameters, i.e., νΎ= 2.0 and νΌ= 0.25. To specifically evaluate the contribution provided by each perspec- tive (content - C, relationships - R, and spatial information - S), we also measured the performance considering different combinations thereof. Online Social Networks and Media 50 (2025) 100335 7 F. Benedetti et al. Table 3 Results obtained by IMMENSE (with focal loss). The best result in terms of F1 is shown in bold. IMMENSE: ν ν =ν ν =ν ν = 128 ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.9650.9250.9440.9900.9901.0000.9950.9400.8500.893 β a 0.7750.9500.8340.9401.0000.9400.9690.5500.9600.699 β0.8350.9300.8750.9600.9900.9700.9800.6800.8900.771 β a 0.8200.9450.8700.9600.9900.9600.9750.6500.9300.765 β0.8950.9200.9070.9800.9900.9800.9850.8000.8600.829 β a 0.8950.9200.9070.9800.9900.9800.9850.8000.8600.829 β0.9650.9500.9550.9900.9901.0000.9900.9400.9000.920 β0.9600.9400.9470.9900.9901.0000.9900.9300.8800.904 β0.9100.9300.9200.9800.9900.9900.9900.8300.8700.850 β0.9800.8500.9000.9800.9801.0000.9900.9800.7000.810 IMMENSE: ν ν =ν ν =ν ν = 256 ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.9650.9400.9520.9900.9901.0000.9950.9400.8800.909 β a 0.9400.9000.9190.9800.9900.9900.9900.8900.8100.848 β0.8200.9050.8560.9600.9900.9700.9800.6500.8400.733 β a 0.8150.9100.8550.9600.9900.9700.9800.6400.8500.730 β0.8700.8950.8820.9700.9900.9800.9850.7500.8100.779 β a 0.8700.8800.8750.9700.9800.9800.9800.7600.7800.770 β0.9600.9550.9570.9900.9901.0000.9950.9300.9100.920 β0.8750.9650.9140.9701.0000.9800.9900.7500.9500.838 β0.8650.9150.8880.9700.9900.9800.9850.7400.8500.791 β0.9650.9550.9600.9900.9901.0000.9950.9400.9100.925 IMMENSE: ν ν =ν ν =ν ν = 512 ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.9700.9450.9570.9900.9901.0000.9950.9500.8900.919 β a 0.8500.9750.9010.9701.0000.9700.9850.7000.9800.817 β0.7800.9350.8370.9500.9900.9500.9700.5700.9200.704 β a 0.7550.9400.8120.9301.0000.9300.9640.5100.9500.660 β0.8450.9050.8700.9600.9900.9700.9800.7000.8400.760 β a 0.8100.9300.8570.9600.9900.9600.9750.6300.9000.740 β0.9050.9600.9300.9801.0000.9800.9900.8100.9400.870 β0.9700.9550.9620.9900.9901.0000.9950.9500.9100.930 β0.8350.9250.8750.9600.9900.9700.9800.6800.8800.770 β0.9700.9650.9670.9900.9901.0000.9950.9500.9300.940 a For IMMENSE configurations represents the adoption of its C, R, and S modules without the fusion module. We also performed comparative experiments considering each single module implemented in IMMENSE. The results obtained by IMMENSE were compared with those achieved by the following state-of-the-art systems, namely: β’Mr-SBC [39], that represents the dataset as database tables and adopts a probabilistic approach for the node classification task. β’Re3py [38], an approach based on ensembles of relational deci- sion trees. Its peculiarity is the ability to construct new features dynamically by navigating foreign key paths and employing an iterative feature aggregation strategy. β’Heterogeneous Graph Transformer (HGT) [24], where, as suggested by the authors, node features are extracted from the content us- ing the pre-trained XLNet language model [52], which identifies embeddings of dimension 768. β’Rio-GNN [26], adopting the same procedure followed by the authors: Rio-GNN is used for computing node embeddings and the classification is done by an MLP. We set the features initially associated with nodes to the same features used for IMMENSE, and its parameter ν_ννν (dimension of the node embeddings to learn) to the same value as the initial feature vector. β’SAIRUS [1], a transductive framework for user classification in social networks, able to consider the posted textual content, user relationships, and usersβ spatial closeness. It is worth noting that both Mr-SBC and Re3py represent user content through a bag-of-words approach, but represent relationships differ- ently: Mr-SBC uses foreign key constraints, while Re3py relies on first-order predicates. Unlike our method, these two approaches do not exploit embeddings to capture the semantics of the content. HGT and Rio-GNN, on the other hand, adopt an embedding-based approach for representing the nodes in the network. For both HGT and Rio-GNN, we applied the same weighting schema used by IMMENSE (see Eq. (3)) to their respective loss functions, to account for class imbalance. It is important to note that SAIRUS, being transductive, requires access to the complete network of relationships and geographical infor- mation during training, and cannot provide predictions for new users, who have not been observed in those networks, without an additional training phase on the network of relationships and on that representing the geographical information. IMMENSE, on the other hand, enables generalization to completely new networks in the prediction phase. This aspect makes the comparison inherently unfair in favor of SAIRUS, since it is aware of the users in the testing set during the training, while IMMENSE is purposely made unaware of them. However, such a comparison allows us to assess the performance of IMMENSE in such a more challenging scenario, compared with its closest transductive competitor. All the experiments were performed on a workstation equipped with a NVIDIA GeForce Titan X GPU, an Intel Xeon E5-1650-v3 CPU, and 64 GB of RAM. As evaluation measures, we consider precision, recall, accuracy, and F1-score, computed both on the entire set of users and for each class separately. Online Social Networks and Media 50 (2025) 100335 8 F. Benedetti et al. Table 4 Results obtained by inductive competitors. The best result in terms of F1 is shown in bold. MrSBC ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 Re3py ConfigurationAll usersSafeRisky CRSPrecRecF1AccPrecRecF1PrecRecF1 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 β0.4650.5000.4820.9300.9301.0000.9640.0000.0000.000 HGT ConfigurationAll usersSafeRisky PrecRecF1AccPrecRecF1PrecRecF1 β0.6800.5800.6100.9300.9400.9800.9600.4200.1800.252 RIO-GNN ConfigurationAll usersSafeRisky PrecRecF1AccPrecRecF1PrecRecF1 ν_ννν= 1280.5350.5150.4470.5100.5000.8600.6320.5700.1700.262 ν_ννν= 2560.7900.7750.7730.7800.7200.8800.7920.8600.6700.753 ν_ννν= 5120.6300.6050.5940.6100.6700.4100.5090.5900.8000.679 4.3. Results and discussion In Tables 2and3, we show the results obtained by IMMENSE with the class weighting and the focal loss strategies, respectively, while in Table 4 we show the results of all its inductive competitors. The results refer to multiple configurations, considering the content (C), the social relationships (R), the spatial closeness (S), and combinations thereof, when made possible by each considered approach. The symbol a for IMMENSE configurations represents the adoption of its C, R, and S modules without the final fusion module. Looking at the results, it is immediately noticeable that competitors fail to achieve satisfactory re- sults across all evaluated configurations. Specifically, MrSBC and Re3py exhibit a strong bias towards the safe class, classifying all users as safe in all the considered configurations (see the recall equal to 0 for the risky class). Both competitors clearly suffer from data unbalancing issues, being not able to provide a good trade-off in the predictive performance over both classes. A further motivation behind poor performances of these competitors may be their bag-of-words representation for the content, that can be considered suboptimal as it fails to capture the semantics. On the other hand, HGT manages to correctly identify some risky users (recall on the risky class equal to 0.18), but it still tends to classify most of users as safe. Therefore, its performance still appears affected by class imbalance, despite the adoption of a weighted loss function during the training. Rio-GNN provides more useful predictions. The best results are achieved with ν_ννν= 256 (average F1 equal to 0.773), but they still remain below those obtained by our method IMMENSE. We believe that such performances exhibited by Rio-GNN depend on the fact that the content is taken into account exclusively through the initial features associated with the nodes in the network, without a dedicated module for the analysis of the semantics of the content. On the contrary, IM- MENSE has a dedicated component for each perspective (i.e., content, relations and spatial closeness). Focusing on IMMENSE (see Tables 2and3), it is clear that the ob- tained results are far better than those achieved by all the competitors. In general, IMMENSE achieves the best results when all the three per- spectives are considered, although in a few cases, some configurations considering two perspectives yield the same macro results. However, the results obtained for the ννν νν¦ class (that is the most interesting class for our task) reveal that taking all perspectives into account leads to the best performance with all the configurations, when class weighting is adopted, and with an embedding dimensionality of 256 or 512, when focal loss is adopted. We can also notice that considering one single perspective, either directly (see the configuration with the a or going through the final fusion step, generally provides suboptimal performances. Moreover, considering the content always appears to be fundamental for accurate predictions, even if clearly complemented by the perspectives modeling social relationships and spatial proximity among users. Notably, the F1 performances increase in 5 out of 6 cases when complementing the information provided by the posted content with that of the spatial dimension. This is particularly interesting, considering that the spatial information is available for a very limited number of users (see Table 1). This result also outlines the ability of IMMENSE of properly managing possible sparsity issues in the available data. It can also be noticed that IMMENSE provides balanced perfor- mances over the risky and safe classes. These results highlight the capability of IMMENSE of properly exploiting multiple, complemen- tary, perspectives as well as handling class imbalance, which is typical in the considered context. As expected, increasing the embedding dimensionality tends to improve performance. However, the results obtained with embedding sizes of 128 and 256 are still highly competitive, significantly outper- forming all baselines across all configurations. In Table 5, we separately show the results obtained by SAIRUS, which can be considered the closest competitor to IMMENSE. We remind that such results are achieved in a transductive setting, and are, in principle, not comparable with those achieved by IMMENSE in the inductive setting, since SAIRUS is made aware of users for which it will need to provide a label during the prediction phase. Despite this inherent advantage provided to SAIRUS, in Table 6 we can see that IMMENSE outperforms SAIRUS in almost all the cases. In particular, it reaches an improvement of 9.41% in terms of F1 on all users and of 20.83% on risky users, with a dimensionality of 512, when class weighting is adopted, and an improvement of 14.12% in terms of F1 Online Social Networks and Media 50 (2025) 100335 9 F. Benedetti et al. Fig. 3. Graphical representation through t-SNE of the IMMENSE (with focal loss) embeddings for each perspective and for the input of the fusion module (MLP). Orange data points correspond to risky users, while blue data points correspond to safe users. (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.) Table 5 Results obtained by the transductive competitor SAIRUS. SAIRUS ConfigurationAll usersSafeRisky PrecRecF1AccPrecRecF1PrecRecF1 ν ν =ν ν =ν ν = 1280.8500.9600.9000.9701.0000.9700.9800.7100.9400.810 ν ν =ν ν =ν ν = 2560.8700.9100.8900.9700.9900.9800.9800.7500.8500.800 ν ν =ν ν =ν ν = 5120.9700.7800.8500.9700.9701.0000.9800.9700.5700.720 on all users and of 30.54% on risky users, with a dimensionality of 512, when focal loss is adopted. This gain comes with no additional computational costs for IMMENSE. Actually, it exhibits up to 76.93% improvement in terms of running times during the prediction phase (see the last column of Table 6) since it does not need to re-train the node embedding models on the graph used for the inference phase. Table 7 provides additional details on both training and inference running times. As it can be noticed, IMMENSE is more efficient then SAIRUS for both phases, and exhibits very low running times for the inference phase (at most 12.4 s for a testing network of βΌ7500 users), making it practically adoptable in real-world scenarios. All these results prove the capability of IMMENSE in providing accurate predictions for this specific task in social networks, properly exploiting the complementary information conveyed by three different perspectives. The specific comparison with SAIRUS also emphasized its ability not only to outperform it from a mere viewpoint of the accuracy of the predictions, but also in terms of sustainability, due to the significant reduction of the inference time achieved through the proposed inductive approach. We finally performed a specific analysis to assess the contribution of each perspective in discriminating between risky and safe users. Specifically, in Fig. 3 we report several t-SNE plots [53] depicting the 2D projection of the embeddings identified by the modules devoted to the analysis of the posted content (C), of social relationships (R), and of spatial information (S). We also report the 2D projection of the 7- dimensional feature space that represents the input of the final fusion Online Social Networks and Media 50 (2025) 100335 10 F. Benedetti et al. Fig. 4. Graphical representation through LIME of the importance of each input feature of the fusion module (MLP) of IMMENSE (with focal loss), for 2 selected safe users. User #0 is correctly classified by IMMENSE as safe, while user #1325 is wrongly classified by IMMENSE as risky. (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.) Table 6 Improvements of IMMENSE over SAIRUS. The improvement in terms of running times (running time reduction) refers to the inference phase. IMMENSE (with class weighting) vs. SAIRUS ConfigurationAll usersSafeRisky PrecRecF1AccPrecRecF1PrecRecF1Time ν ν =ν ν =ν ν = 1282.94%1.56%1.99%1.03%0.00%1.03%1.01%5.63%3.19%4.44%75.66% ν ν =ν ν =ν ν = 2561.15%7.14%3.49%1.03%1.01%0.00%1.01%1.33%14.12%6.53%73.43% ν ν =ν ν =ν ν = 512β8.25%25.64%9.41%1.03%3.09%β2.00%1.01%β19.59%71.93%20.83%75.93% IMMENSE (with focal loss) vs. SAIRUS ConfigurationAll usersSafeRisky PrecRecF1AccPrecRecF1PrecRecF1Time ν ν =ν ν =ν ν = 12815.29%β11.46%0.00%1.03%β2.00%3.09%1.02%38.03%β25.53%0.00%71.36% ν ν =ν ν =ν ν = 25611.49%4.40%7.87%2.06%0.00%2.04%1.53%25.33%7.06%15.59%76.70% ν ν =ν ν =ν ν = 5120.00%23.08%14.12%2.06%2.06%0.00%1.53%β2.06%63.16%30.54%76.93% Table 7 Training and inference times of IMMENSE and SAIRUS for the whole set of users in the training and testing sets, respectively. Note that SAIRUS requires to partially re-train the model during the inference because of its transductive nature. ConfigurationTraining time (s)Inference time (s) SAIRUSIMMENSEIMMENSESAIRUSIMMENSEIMMENSE (class weighting)(focal loss)(class weighting)(focal loss) ν ν =ν ν =ν ν = 128486.3357.2416.346.410.411.2 ν ν =ν ν =ν ν = 256612.5395.8454.846.411.212.4 ν ν =ν ν =ν ν = 512874.0536.4597.351.311.312.4 module based on the MLP. For the sake of compactness, we only report the plots obtained when the focal loss is adopted. From the Figure, we can observe that each perspective alone already provides some useful information for separating risky and safe users. However, the MLP input exhibits a very neat separation between the two classes, with only 7 features. These visual results confirm that the three perspectives, subsequently properly combined by the MLP, provide complementary information to the fusion module to better discriminate between risky and safe users, thus confirming our initial intuition behind IMMENSE. Furthermore, we also selected two safe users and two risky users, and plotted their corresponding LIME importance scores [54] in Figs. 4and5. In particular, Fig. 4 shows the LIME plots for one safe user (User #0) correctly classified by IMMENSE and one of the few safe users (User #1325) wrongly classified by IMMENSE as risky. As we can see, for User #0, especially with embedding size 512, the consistency (with the true class) of the meta-features (input features of the MLP) denoted by the green bar counterbalances the mistakes of other meta- features, with the reconstruction error of the safe autoencoder being the most contributing feature for a correct classification. For User #1325, we see that the error in the classification is mainly due to all perspectives. A clear imperfect classification based on the content is not counterbalanced by the other perspectives, which, instead, reinforce the error. We note that this example was selected on purpose, and this behavior is not commonly observed in other examples, as F1 and accuracy scores confirm. Fig. 5 highlights additional noteworthy cases involving risky users. Notably, for User #24, the correct classification into the risky class is strongly supported by almost all meta-features. Only two of them show Online Social Networks and Media 50 (2025) 100335 11 F. Benedetti et al. Fig. 5. Graphical representation through LIME of the importance of each input feature of the fusion module (MLP) of IMMENSE (with focal loss), for 2 selected risky users. User #24 is correctly classified by IMMENSE as risky, while user #689 is wrongly classified by IMMENSE as safe. a very weak inclination towards classifying the user as safe. Instead, for User #689 a strong mistake due to the reconstruction error of the safe autoencoder, which appears lower than that of the risky autoencoder, is not counterbalanced by other meta-features, leading to a wrong classification. Again, this example was deliberately selected to illustrate such behavior, which is not commonly observed across the dataset. 5. Conclusions In this paper we presented IMMENSE, an inductive learning method for the identification of risky users in social networks. IMMENSE can effectively classify unseen nodes by leveraging three perspectives: the semantics of the content posted by users, their social relationships, and their spatial closeness. Our evaluation on a real-world dataset demonstrated that IMMENSE is able to outperform four state-of-the-art inductive competitors, which struggle with network sparsity and data imbalance. IMMENSE also proved to outperform its closest competitor SAIRUS, even if the latter was run in a more advantageous setting (i.e., transductive), where nodes in the testing set are known in advance during the training phase. Such improvements were clear both in terms of predictive accuracy and in terms of prediction time. These results suggest that IMMENSE can effectively be used in real-world environments by Law Enforcement Agencies to counter negative phenomena in social networks. For future work, we plan to enhance IMMENSE by incorporating temporal analysis, which would allow tracking changes in user behav- iors over time. This aspect could support the detection of users with a safe history who suddenly begin posting negative content or joining risky communities. CRediT authorship contribution statement Francesco Benedetti: Writing β original draft, Validation, Soft- ware, Methodology, Investigation, Formal analysis, Data curation, Con- ceptualization. Antonio Pellicani: Writing β review & editing, Val- idation, Methodology, Investigation, Formal analysis, Data curation, Conceptualization. Gianvito Pio: Writing β review & editing, Valida- tion, Methodology, Formal analysis, Data curation, Conceptualization. Michelangelo Ceci: Writing β review & editing, Validation, Supervi- sion, Funding acquisition, Formal analysis, Conceptualization. Code availability The proposed method IMMENSE is open source and publicly avail- able on Github: https://github.com/itsfrank98/immense. Declaration of competing interest The authors have declared no conflict of interest Acknowledgments The authors acknowledge the support of the European Commission through the H2020 Project βCounteR - Privacy-First Situational Aware- ness Platform for Violent Terrorism and Crime Prediction, Counter Radicalization and Citizen Protectionβ (Grant N. 101021607). This work was partially supported by the project FAIR - Future AI Research (PE00000013), spoke 6 - Symbiotic AI, under the NRRP MUR program funded by the NextGenerationEU. Data availability The data used in this paper will be made available upon request. References [1]A. Pellicani, G. Pio, D. Redavid, M. Ceci, SAIRUS: Spatially-aware identification of risky users in social networks, Inf. Fusion 92 (2023) 435β449, http://dx.doi. org/10.1016/J.INFFUS.2022.11.029. [2]R.A. Igawa, S. Barbon Jr., K.C.S. Paulo, G.S. Kido, R.C. Guido, M.L.P. JΓΊnior, I.N. da Silva, Account classification in online social networks with lbca and wavelets, Inform. Sci. 332 (2016) 72β83. [3]W. Wu, M. Ghazali, S. Hazlin Huspi, A review of user profiling based on social networks, IEEE Access 12 (2024) 122642β122670, http://dx.doi.org/10.1109/ ACCESS.2024.3430987. [4]K. Balasubramaniam, S. Vidhya, N. Jayapandian, K. Ramya, M. Poongodi, M. Hamdi, G.B. Tunze, et al., Social network user profiling with multilayer semantic modeling using ego network, Int. J. Inf. Technol. Web Eng. (IJITWE) 17 (1) (2022) 1β14. [5]H. Ko, S. Lee, Y. Park, A. Choi, A survey of recommendation systems: recom- mendation models, techniques, and application fields, Electronics 11 (1) (2022) 141. [6]D. Li, H. Liu, Z. Zhang, K. Lin, S. Fang, Z. Li, N.N. Xiong, CARM: Confidence- aware recommender model via review representation learning and historical rating behavior in the online platforms, Neurocomputing 455 (2021) 283β296. [7]H. Liu, C. Zheng, D. Li, Z. Zhang, K. Lin, X. Shen, N.N. Xiong, J. Wang, Multi- perspective social recommendation method with graph representation learning, Neurocomputing 468 (2022) 469β481. [8]H. Liu, C. Zheng, D. Li, X. Shen, K. Lin, J. Wang, Z. Zhang, Z. Zhang, N.N. Xiong, EDMF: Efficient deep matrix factorization with review feature learning for industrial recommender system, IEEE Trans. Ind. Inform. 18 (7) (2022) 4361β4371. Online Social Networks and Media 50 (2025) 100335 12 F. Benedetti et al. [9]U.N.I. Crime, J.R.I. (UNICRI), Stop the virus of disinformation: The malicious use of social media by terrorist, violent extremist and criminal groups during the covid-19 pandemic - november 2020, 2020. [10]R. Thompson, Radicalization and the use of social media, J. Strat. Secur. 4 (4) (2011) 167β190. [11]B. Evkoski, A. Pelicon, I. Mozetic, N. Ljubesic, P.K. Novak, Retweet communities reveal the main sources of hate speech, 2021, CoRR abs/2105.14898. arXiv: 2105.14898. [12]H.S. Alatawi, A.M. Alhothali, K.M. Moria, Detecting white supremacist hate speech using domain specific word embedding with deep learning and BERT, IEEE Access 9 (2021) 106363β106374, http://dx.doi.org/10.1109/ACCESS.2021. 3100435. [13]M. Ji, Y. Sun, M. Danilevsky, J. Han, J. Gao, Graph regularized transductive classification on heterogeneous information networks, in: J.L. BalcΓ‘zar, F. Bonchi, A. Gionis, M. Sebag (Eds.), Machine Learning and Knowledge Discovery in Databases, European Conference, ECML PKDD 2010, Barcelona, Spain, September 20-24, 2010, Proceedings, Part I, in: Lecture Notes in Computer Science, vol. 6321, Springer, 2010, p. 570β586, http://dx.doi.org/10.1007/978-3-642-15880- 3_42. [14]L. Berkani, S. Belkacem, M. Ouafi, A. Guessoum, Recommendation of users in social networks: A semantic and social based classification approach, Expert. Syst. J. Knowl. Eng. 38 (2) (2021) http://dx.doi.org/10.1111/EXSY.12634. [15]C. Desrosiers, G. Karypis, Within-network classification using local structure similarity, in: W. Buntine, M. Grobelnik, D. MladeniΔ, J. Shawe-Taylor (Eds.), Machine Learning and Knowledge Discovery in Databases, Springer Berlin Heidelberg, Berlin, Heidelberg, 2009, p. 260β275. [16]O. Chapelle, V. Vapnik, J. Weston, Transductive inference for estimating values of functions, in: S.A. Solla, T.K. Leen, K. MΓΌller (Eds.), Advances in Neural Information Processing Systems 12, [NIPS Conference, Denver, Colorado, USA, November 29 - December 4 1999], The MIT Press, 1999, p. 421β427. [17]Z. Xue, Z. Zhang, H. Liu, S. Yang, S. Han, Learning knowledge graph embedding with multi-granularity relational augmentation network, Expert Syst. Appl. 233 (2023) 120953. [18]Z. Zhang, Z. Li, H. Liu, N.N. Xiong, Multi-scale dynamic convolutional network for knowledge graph embedding, IEEE Trans. Knowl. Data Eng. 34 (5) (2022) 2335β2347. [19]Z. Li, H. Liu, Z. Zhang, T. Liu, N.N. Xiong, Learning knowledge graph embedding with heterogeneous relation attention networks, IEEE Trans. Neural Netw. Learn. Syst. 33 (8) (2022) 3961β3973. [20]Z. Xue, Z. Zhang, H. Liu, Z. Li, S. Han, E. Zhang, Mhrn: A multi-perspective hierarchical relation network for knowledge graph embedding, Knowl.-Based Syst. 313 (2025) 113040. [21]B. Perozzi, R. Al-Rfou, S. Skiena, Deepwalk: Online learning of social represen- tations, in: Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2014, p. 701β710. [22]A. Grover, J. Leskovec, Node2vec: Scalable feature learning for networks, in: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016, p. 855β864. [23]W.L. Hamilton, Z. Ying, J. Leskovec, Inductive representation learning on large graphs, in: I. Guyon, U. von Luxburg, S. Bengio, H.M. Wallach, R. Fergus, S.V.N. Vishwanathan, R. Garnett (Eds.), Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9 2017, Long Beach, CA, USA, 2017, p. 1024β1034. [24]Z. Hu, Y. Dong, K. Wang, Y. Sun, Heterogeneous graph transformer, in: Proceedings of the Web Conference 2020, 2020, p. 2704β2710. [25]J. Xiao, Q. Dai, X. Xie, J. Lam, K. Kwok, Adversarially regularized graph attention networks for inductive learning on partially labeled graphs, Knowl.-Based Syst. 268 (2023) 110456, http://dx.doi.org/10.1016/J.KNOSYS.2023.110456. [26]H. Peng, R. Zhang, Y. Dou, R. Yang, J. Zhang, P.S. Yu, Reinforced neighborhood selection guided multi-relational graph neural networks, ACM Trans. Inf. Syst. (TOIS) 40 (4) (2021) 1β46. [27]P. Velickovic, G. Cucurull, A. Casanova, A. Romero, P. LiΓ², Y. Bengio, Graph attention networks, in: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3 2018, Conference Track Proceedings, OpenReview.net, 2018. [28]A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A.N. Gomez, L. Kaiser, I. Polosukhin, Attention is all you need, in: I. Guyon, U. von Luxburg, S. Bengio, H.M. Wallach, R. Fergus, S.V.N. Vishwanathan, R. Garnett (Eds.), Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9 2017, Long Beach, CA, USA, 2017, p. 5998β6008. [29]J. Baek, D.B. Lee, S.J. Hwang, Learning to extrapolate knowledge: Transductive few-shot out-of-graph link prediction, in: H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, H. Lin (Eds.), Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12 2020, virtual, 2020. [30]L. Hu, A two-step method for classifying political partisanship using deep learning models, Soc. Sci. Comput. Rev. 42 (4) (2024) 961β976. [31]Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, P.S. Yu, A comprehensive survey on graph neural networks, IEEE Trans. Neural Netw. Learn. Syst. 32 (1) (2021) 4β24, http://dx.doi.org/10.1109/TNNLS.2020.2978386. [32]H.I. Aslan, C. Choi, H. Ko, Classification of vertices on social networks by mul- tiple approaches, 2023, http://dx.doi.org/10.48550/ARXIV.2301.11288, CoRR abs/2301.11288. arXiv:2301.11288. [33]L. He, C. Lu, J. Ma, J. Cao, L. Shen, P.S. Yu, Joint community and structural hole spanner detection via harmonic modularity, in: B. Krishnapuram, M. Shah, A.J. Smola, C.C. Aggarwal, D. Shen, R. Rastogi (Eds.), Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA, August 13-17, 2016, ACM, 2016, p. 875β884, http://dx.doi.org/10.1145/2939672.2939807. [34]J. Zhou, G. Cui, S. Hu, Z. Zhang, C. Yang, Z. Liu, L. Wang, C. Li, M. Sun, Graph neural networks: A review of methods and applications, AI Open 1 (2020) 57β81, http://dx.doi.org/10.1016/J.AIOPEN.2021.01.001. [35]R.C. Souza, R.M. Assunção, D.M. Oliveira, D.B. Neill, W. Meira Jr., Where did i get dengue? detecting spatial clusters of infection risk with social network data, Spat. Spatio-Temporal Epidemiology 29 (2019) 163β175. [36]Q. Gong, Y. Liu, J. Zhang, Y. Chen, Q. Li, Y. Xiao, X. Wang, P. Hui, Detecting malicious accounts in online developer communities using deep learning, IEEE Trans. Knowl. Data Eng. 35 (10) (2023) 10633β10649, http://dx.doi.org/10. 1109/TKDE.2023.3237838. [37]J. Wang, X. He, Q. Gong, Y. Chen, T. Wang, X. Wang, Deep learning based mali- cious account detection in the momo social network, in: 2018 27th International Conference on Computer Communication and Networks, ICCCN, IEEE, 2018, p. 1β2. [38]M. Petkovic, M. Ceci, G. Pio, B. Skrlj, K. Kersting, S. Dzeroski, Relational tree ensembles and feature rankings, Knowl.-Based Syst. 251 (2022) 109254, http://dx.doi.org/10.1016/J.KNOSYS.2022.109254. [39]M. Ceci, A. Appice, D. Malerba, Mr-sbc: A multi-relational naΓ―ve bayes classifier, in: N. Lavrac, D. Gamberger, H. Blockeel, L. Todorovski (Eds.), Knowledge Discovery in Databases: PKDD 2003 7th European Conference on Principles and Practice of Knowledge Discovery in Databases, Cavtat-Dubrovnik, Croatia, September 22-26 2003, Proceedings, in: Lecture Notes in Computer Science, vol. 2838, Springer, 2003, p. 95β106. [40]T. Mikolov, K. Chen, G. Corrado, J. Dean, Efficient estimation of word representa- tions in vector space, in: Y. Bengio, Y. LeCun (Eds.), 1st International Conference on Learning Representations, ICLR 2013, Scottsdale, Arizona, USA, May (2013) 2-4, Workshop Track Proceedings, 2013. [41]T. Mikolov, I. Sutskever, K. Chen, G.S. Corrado, J. Dean, Distributed representa- tions of words and phrases and their compositionality, Adv. Neural Inf. Process. Syst. 26 (2013). [42]G.D. Martino, G. Pio, M. Ceci, PRILJ: An efficient two-step method based on embedding and clustering for the identification of regularities in legal case judgments, Artif. Intell. Law 30 (3) (2022) 359β390, http://dx.doi.org/10.1007/ S10506-021-09297-1. [43]G. De Martino, G. Pio, M. Ceci, Multi-view overlapping clustering for the identification of the subject matter of legal judgments, Inform. Sci. 638 (2023) 118956. [44]D.E. Rumelhart, J.L. McClelland, P.R. Group, et al., Parallel Distributed Processing, Foundations 1, 1988. [45]C. Bellinger, S. Sharma, N. Japkowicz, One-class versus binary classification: Which and when? in: 2012 11th International Conference on Machine Learning and Applications, vol. 2, 2012, p. 102β106, http://dx.doi.org/10.1109/ICMLA. 2012.212. [46]B. Krawczyk, Learning from imbalanced data: open challenges and future directions, Prog. Artif. Intell. 5 (4) (2016) 221β232. [47]T.-Y. Lin, P. Goyal, R. Girshick, K. He, P. DollΓ‘r, Focal loss for dense object detection, in: Proceedings of the IEEE International Conference on Computer Vision, 2017, p. 2980β2988. [48]S. Nazir, M. Asif, S.A. Sahi, S. Ahmad, Y.Y. Ghadi, M.H. Aziz, Toward the development of large-scale word embedding for low-resourced language, IEEE Access 10 (2022) 54091β54097. [49]M. McVicar, B. Di Giorgi, B. Dundar, M. Mauch, Lyric document embeddings for music tagging, 2021, arXiv preprint arXiv:2112.11436. [50]L. Dong, N. Yang, W. Wang, F. Wei, X. Liu, Y. Wang, J. Gao, M. Zhou, H.-W. Hon, Unified language model pre-training for natural language understanding and generation, Adv. Neural Inf. Process. Syst. 32 (2019). [51]Z. Chen, H. Mao, H. Li, W. Jin, H. Wen, X. Wei, S. Wang, D. Yin, W. Fan, H. Liu, et al., Exploring the potential of large language models (llms) in learning on graphs, ACM SIGKDD Explor. Newsl. 25 (2) (2024) 42β61. [52]Z. Yang, Z. Dai, Y. Yang, J. Carbonell, R.R. Salakhutdinov, Q.V. Le, Xlnet: Generalized autoregressive pretraining for language understanding, Adv. Neural Inf. Process. Syst. 32 (2019). [53]L.v.d. Maaten, G. Hinton, Visualizing data using t-sne, J. Mach. Learn. Res. 9 (2008) 2579β2605. [54]M.T. Ribeiro, S. Singh, C. Guestrin, Why should i trust you? explaining the pre- dictions of any classifier, in: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016, p. 1135β1144. Online Social Networks and Media 50 (2025) 100335 13