TrollSleuth: Behavioral and Linguistic Fingerprinting of State-Sponsored Trolls

State-sponsored troll accounts run coordinated influence campaigns on social media, but attributing a given account to its sponsoring state remains difficult. TrollSleuth is a framework for troll attribution that integrates four analytical modules — social engagement, word analysis, emotion and sentiment analysis, and temporal activity and client utilization — to extract distinctive behavioral and linguistic fingerprints from real-world Twitter data spanning four state-sponsored campaigns. The resulting model achieves an F1-score of 95.48% in state-sponsor identification and incorporates feature-based explanations to make its attributions interpretable, extending principles from cyber threat attribution to the problem of identifying which state sponsors are behind coordinated troll campaigns.