Methodology

METHODOLOGY|DETECTION PIPELINE & ALGORITHMS

DETECTION PIPELINE

Our detection pipeline monitors state media, partisan outlets, social media accounts, and Telegram channels in real-time. Content is classified through a multi-stage analysis process:

RSS Ingestion (567 sources)->

567 sources monitored in real-time via RSS, API and scraping - state media, partisan outlets, amplification channels.

Propaganda Scoring & AI Classification->

NLP-based scoring of propaganda techniques, framing analysis and source credibility weighting.

Threat Assessment (1-5)->

Multi-factor severity scoring: T1 (baseline) to T5 (coordinated cross-network operation).

Cross-Network Coordination Detection->

Temporal and semantic analysis to detect synchronized pushes across state media networks.

Fact-Check Cross-Referencing

Automated cross-referencing with verified fact-check databases and debunk repositories.

DETECTION ALGORITHMS

D3LTASIMILARITY

Jaccard similarity > 0.5 across different sources flags potential coordinated content. Cross-network coordination (Russia + China pushing the same narrative) triggers critical alerts.

BIGRAMVELOCITY

Keyword bigram analysis across 567 sources detects abnormal spikes. Suspicious when first published by state media and amplified by propaganda networks simultaneously.

GRAPHNETWORK

Source-to-source amplification graph analysis. Identifies relay chains (e.g. CGTN -> RT amplification) and quantifies propagation scores from 1 to 10.

SYNCTEMPORAL

Temporal synchronization detection: articles published within tight time windows across unrelated networks, suggesting coordinated editorial calendars.

NETWORKS AND OPERATIONS

Two distinct levels

DisInfo Monitor classifies each monitored source by an attribution network, a stable category describing the ecosystem the source belongs to: Russian state media, Russian proxies in Africa, Chinese media, American MAGA, European radical populists, etc.

A source belongs to one and only one network. This classification is fixed over time, unless explicitly changed by editorial decision.

An influence operation is different. Doppelganger, Storm-1516, Spamouflage, Pravda Network, Africa Corps are specific operations, meaning documented coordinated amplification devices at a given point in time. These operations use channels that are part of broader networks. Doppelganger amplifies via the fimi_ru_proxy network but the fimi_ru_proxy network is not limited to Doppelganger.

An operation can be attributed to multiple networks when it involves multiple actors. A source can serve different operations over the course of its existence.

DisInfo Monitor therefore uses:

▸the attribution network as the base category, stable and mandatory

▸the attributed operation as an additional label, optional and evolving

This distinction maintains a clear analytical framework in the face of rapidly evolving amplification devices.

THREAT LEVELS

T1BASELINEStandard coverage, no manipulation detected.

T2LOWMinor framing bias or unverified claims.

T3ELEVATEDClear propaganda techniques, single-network.

T4HIGHCoordinated messaging, multi-source amplification.

T5CRITICALCross-network coordinated operation, active disinfo campaign.

METHODOLOGICAL LIMITS

▸A signal indicates a propagation pattern - it does not constitute proof of state coordination.

▸Scoring is algorithm-based, not editorial. Thresholds are documented but produce false positives.

▸Coverage is limited to sources integrated into the pipeline. Absence does not guarantee reliability.

▸Automated analyses are an investigative aid, not a conclusion.

▸DisInfo Monitor detects propagation patterns, not factual accuracy of content.

▸Ingestion delays (polling every 15-60 min) may miss ephemeral campaigns.

← BACK TO ABOUT|GLOSSARY→|FOR JOURNALISTS→|CONTACT →