  The proliferation of misinformation and disinformation on social media
networks has become increasingly concerning. With a significant portion of the
population using social media on a regular basis, there are growing efforts by
malicious organizations to manipulate public opinion through coordinated
campaigns. Current methods for identifying coordinated user accounts typically
rely on either similarities in user behaviour, latent coordination in activity
traces, or classification techniques. In our study, we propose a framework
based on the hypothesis that coordinated users will demonstrate abnormal growth
in their behavioural patterns over time relative to the wider population.
Specifically, we utilize the EPClose algorithm to extract contrasting patterns
of user behaviour during a time window of malicious activity, which we then
compare to a historical time window. We evaluated the effectiveness of our
approach using real-world data, and our results show a minimum increase of 10%
in the F1 score compared to existing approaches.
