Deep Structural Penetration: Catching Graph-Aware LLM Bots Using Cohesive Densities and Evolving Snapshots

Abstract

The quick evolution of LLM-based social bots has changed online manipulation in a fundamental way. Current botnet platforms, like GraphMind, carry out complex and contextually aware interactions locally and construct intricate humanlike networks (for instance, small-world connectivity, homophily, and community structure). This structural similarity fools existing detectors that use techniques based on text, metadata, or graphs, leading to poor performance of traditional Graph Neural Networks (GNNs). In order to fill the identified security hole, we propose an innovative parallel dual-pipeline hybrid detection approach, which combines fine-grained local network density with temporal changes over time: Pipeline for Density-Aware Structural Embedding: Obtains fine-grained structural patterns and structural density features from density-biased random weighted walks (RWW) based on node degree, core number, and truss number features through skip-gram encoding. Pipeline for Temporal Pattern Extraction: Divides the time-evolving network into multiple graph snapshots and uses a multi-head temporal self-attention encoder together with structural features (LCC and BLR) in order to track historical behavioral changes. Afterwards, obtained structural and temporal embeddings are concatenated and classified via Multi-Layer Perceptron (MLP). Experimental evaluation using the MGTAB dataset shows that the hybrid approach can successfully counteract sophisticated evasion techniques. While the conventional GNN detectors show a decrease in accuracy of 19-24 percentage points on human-like bot configurations, the proposed approach brings back the detector capability and reaches the accuracy of 94.3% and the F1 score of 93.9%.