  Within OSNs, many of our supposedly online friends may instead be fake
accounts called social bots, part of large groups that purposely re-share
targeted content. Here, we study retweeting behaviors on Twitter, with the
ultimate goal of detecting retweeting social bots. We collect a dataset of 10M
retweets. We design a novel visualization that we leverage to highlight benign
and malicious patterns of retweeting activity. In this way, we uncover a
'normal' retweeting pattern that is peculiar of human-operated accounts, and 3
suspicious patterns related to bot activities. Then, we propose a bot detection
technique that stems from the previous exploration of retweeting behaviors. Our
technique, called Retweet-Buster (RTbust), leverages unsupervised feature
extraction and clustering. An LSTM autoencoder converts the retweet time series
into compact and informative latent feature vectors, which are then clustered
with a hierarchical density-based algorithm. Accounts belonging to large
clusters characterized by malicious retweeting patterns are labeled as bots.
RTbust obtains excellent detection results, with F1 = 0.87, whereas competitors
achieve F1 < 0.76. Finally, we apply RTbust to a large dataset of retweets,
uncovering 2 previously unknown active botnets with hundreds of accounts.
