Social Network, Diffusion and Community Analytics

Introduction

Social media platforms are not merely collections of posts. They are socio-technical systems in which users, organizations, devices, messages and institutions are connected through observable relationships. A user may follow another account, reply to a post, share a video, mention a brand, join a group or participate in a coordinated campaign. These relationships form networks, and network analytics provides the concepts and methods required to study their structure, influence and evolution.

For business analysts, network analysis supports questions such as: Which customers connect otherwise separate market segments? Which employees accelerate the circulation of knowledge? Which accounts spread a product claim? Are communities genuine interest groups or coordinated networks? Does a message diffuse through credible experts, highly engaged citizens, automated accounts or malicious actors?

The central analytical challenge is that visibility is not equivalent to influence. A highly visible account may have many followers but little persuasive effect. A small account may occupy a strategically important position in a conversation. Similarly, a dense community may represent genuine affinity, or it may be artificially constructed through automation and coordination. Sound analysis therefore combines graph theory, statistical measurement, temporal diffusion analysis, content analysis and contextual investigation.

Learning Objectives

By the end of this chapter, students should be able to:

1. Represent social relationships using nodes, edges, directed and weighted graphs.
2. Calculate and interpret degree, betweenness, closeness and eigenvector centrality.
3. Assess cohesion using density, reciprocity, clustering and k-core structure.
4. Detect and evaluate communities using modularity-based and other approaches.
5. Model information diffusion and distinguish reach, cascade size and influence.
6. Identify signals of bots, coordinated behavior and misinformation without treating any single signal as proof.
7. Design a responsible network-analytics workflow for managerial and research applications.

1. Representing Social Structures as Graphs

A graph is written as G = (V,E), where V is a set of vertices or nodes and E is a set of edges or ties. In social media, nodes may represent users, pages, hashtags, posts, domains or organizations. Edges represent relationships or interactions.

A graph can be:

• Undirected: an edge indicates a symmetric relationship, such as friendship.
• Directed: an edge has a source and target, such as a follow, mention or retweet.
• Unweighted: each tie is treated equally.
• Weighted: a tie carries a value, such as interaction count, sentiment-adjusted strength or transaction volume.
• Static: relationships are observed over one period.
• Temporal: edges have timestamps and may appear, disappear or change strength.
• Bipartite: edges connect two different node types, such as users and hashtags.

An adjacency matrix A records ties between nodes. For a directed network, A_ij=1 means that node i has a relationship directed toward node j. In a weighted network, A_ij=w_ij, where w_ij is the edge weight. Self-loops and multiple edges should be handled explicitly because they can distort measures.

The choice of edge is a modelling decision, not a technical detail. A retweet network represents information redistribution; a reply network represents conversational interaction; a co-following network represents similarity in audience attention. Results cannot be interpreted independently of this choice.

Important network terminology

2. Centrality: Position, Access and Brokerage

Centrality measures describe different meanings of structural importance. They are not interchangeable rankings of “importance.”

Degree centrality

For a directed network, in-degree counts incoming ties and out-degree counts outgoing ties. For node i in a network of n nodes, normalized in-degree is:

Here, dⁱⁿ(i) is the number of incoming ties. The denominator assumes that self-ties are excluded and that every other node could potentially connect to i. In-degree may indicate attention or popularity; out-degree may indicate activity or broadcasting. In a weighted network, degree can be replaced by strength:

where w_ij is the weight of the tie from i to j. Strength is meaningful only when edge weights are comparable and their interpretation is clear.

Betweenness centrality

Betweenness captures brokerage: the extent to which a node lies on shortest paths between other nodes.

σ_st is the number of shortest paths from node s to node t, and σ_st(i) is the number of those paths passing through i. Normalized versions divide by the maximum possible value, which depends on whether the graph is directed or undirected. In weighted graphs, weights must be converted appropriately: if a larger weight means a stronger connection, it cannot automatically be treated as a larger distance. A cost or inverse-strength transformation may be required.

High betweenness can indicate access to information flows, but it does not prove that a node controls or persuades others. Shortest paths are a theoretical approximation; users may not follow them in real life.

Closeness centrality

Closeness measures how near a node is to all others:

where d(i,j) is the shortest-path distance. The formula is most appropriate for connected networks. For disconnected graphs, harmonic closeness is often preferable because it handles unreachable nodes:

with the contribution defined as zero when j is unreachable. Closeness suggests potential speed of access, not actual communication frequency or influence.

Eigenvector and PageRank-style centrality

Eigenvector centrality assigns greater value to connections with already important nodes. In matrix form:

where A is the adjacency matrix, x is the centrality vector and λ is an eigenvalue. The principal eigenvector is normally used for a non-negative adjacency matrix. A node connected to many peripheral nodes may have high degree but modest eigenvector centrality, whereas a node connected to a few highly central nodes may score highly.

PageRank-style measures add damping and can reduce problems caused by sinks or disconnected structures. A simplified form is:

Here, α is a damping parameter between 0 and 1, n is the number of nodes, and In(i) is the set of nodes linking to i. The measure is recursive and is not identical to audience size.

Worked example: centrality interpretation

Consider four accounts: A, B, C and D. The directed ties are A→B, A→C, B→C, C→D and D→C. The in-degrees are: A = 0, B = 1, C = 3, and D = 1. Since n=4, normalized in-degree for C is 3/(4−1)=1. C receives ties from A, B and D and is structurally prominent by this measure.

However, C may not be a broker. A→B→C and A→C create alternative routes, while C and D form a reciprocal pair. A node’s measure depends on the question: in-degree supports an attention question; betweenness supports a brokerage question; eigenvector centrality supports a prestige-through-prestige question.

3. Cohesion and Network Structure

Centrality focuses on nodes; cohesion focuses on relationships among nodes.

Density

For a simple undirected graph with n nodes and m edges, density is:

For a directed graph without self-loops, the denominator is n(n−1). Density ranges from 0 to 1. A high density suggests many possible ties are present, but comparisons should consider network size, platform mechanics and sampling procedures. Large networks often have lower density even when participants interact actively.

Reciprocity

For directed ties, reciprocity measures the prevalence of mutual relationships. A simple dyadic form is:

where L↔ is the number of reciprocated directed ties counted as dyads and L is the number of directed ties, provided the counting convention is stated. Reply networks may have higher reciprocity than broadcast retweet networks because replies are inherently conversational.

Clustering coefficient

For node i, the local clustering coefficient is:

where k_i is the degree of i and e_i is the number of edges among its neighbors. It is defined as zero when k_i<2. The average clustering coefficient summarizes local closure, while transitivity uses a global triangle-to-triple ratio. These measures should not be confused.

Components, bridges and k-cores

A connected component contains nodes linked by paths. A bridge is an edge whose removal increases the number of components. Nodes acting as bridges can connect communities and facilitate cross-group communication, but they may also be vulnerable points for intervention or failure.

A k-core is a maximal subgraph in which every node has at least k neighbors within the subgraph. Core decomposition identifies structurally persistent groups and is useful when raw degree is inflated by many weak or peripheral ties.

4. Community Detection

A community is commonly understood as a set of nodes with more internal connectivity than expected relative to external connectivity. This is a structural definition, not necessarily a social or psychological one. Communities may represent interests, geography, language, organizational units, coordinated campaigns or algorithmic artifacts.

Modularity

A widely used objective is modularity:

For an undirected network, m is the number of edges, k_i and k_j are node degrees, A_ij indicates an observed edge, c_i is the community assigned to node i, and δ(c_i,c_j) equals 1 when two nodes are in the same community and 0 otherwise. The term k_i k_j/(2m) is the expected edge count under a degree-preserving null model.

A high positive Q indicates more within-community edges than expected under that model. Modularity optimization is not a proof that communities are real. It can suffer from a resolution limit, may produce different results under different algorithms or random seeds, and is sensitive to the null model.

Common methods include Louvain and Leiden modularity optimization, label propagation, spectral clustering and stochastic block models. Leiden often improves the connectivity of detected communities, while block models offer a generative statistical perspective. Overlapping communities may be more realistic than disjoint partitions, especially when users participate in multiple interests.

Validating communities

A useful workflow is:

1. Construct the network using a substantively justified edge definition.
2. Remove obvious artefacts, such as duplicate records and impossible timestamps.
3. Detect communities using at least one suitable method.
4. Test stability across time windows, samples, algorithms and parameter settings.
5. Characterize each community using content, language, geography, domains and account types.
6. Compare against a meaningful null model.
7. Avoid naming a community from structure alone; use evidence from behavior and content.

A group of accounts that retweet one another may be a political community, a news audience, a fan group or a coordinated amplification cluster. Network structure narrows the explanation; it does not settle it.

5. Information Diffusion and Influence

Diffusion describes how information, behavior or emotion spreads across a network. A cascade can be represented as a rooted temporal tree or directed acyclic structure, although real platforms may contain repeated exposures and cross-platform paths.

Useful diffusion measures include:

• Reach: number of distinct accounts potentially exposed.
• Cascade size: number of transmission events or nodes in a cascade.
• Depth: longest number of sequential transmission steps.
• Breadth: number of immediate descendants or parallel resharers.
• Lifetime: time from initial post to the last observed event.
• Structural virality: a measure distinguishing broadcast-like from multi-generational diffusion.

Reach is often estimated rather than observed. Follower counts do not equal impressions, and impressions do not equal attention or persuasion. Exposure, engagement, belief change and behavior change are separate outcomes.

Threshold and contagion models

In a simple independent-cascade model, an activated node gets one or more opportunities to activate a neighbor with probability p. If the network is locally tree-like and each active node has an expected branching factor z, a rough early-stage reproduction number is:

When R₀>1, expansion may occur in the early stage; when R₀<1, cascades tend to die out. This approximation assumes homogeneous transmission probability, independent attempts and limited overlap. Social networks violate these assumptions through homophily, repeated exposure, algorithmic ranking and correlated behavior.

In a linear threshold model, node i activates when the weighted influence of active neighbors reaches its threshold θ_i:

where y_j is 1 if neighbor j is active and 0 otherwise. Weights should be normalized or otherwise defined so that the left-hand side and threshold are comparable. Threshold models are useful for adoption and collective action, but they do not imply that all online behavior is contagious.

Estimating influence responsibly

Influence is causal: it asks what would have happened without a particular exposure or actor. Correlation between a user’s post and later reshares is not sufficient. Better designs include randomized experiments, staggered interventions, matched comparisons, instrumental-variable strategies where defensible, and carefully specified temporal models. Observational network data are affected by selection bias, confounding, bots, recommendation systems and unobserved offline communication.

A practical influence score may combine centrality, exposure and observed downstream action, but such a score is predictive rather than causal unless validated through an appropriate design.

6. Credible Influence, Bots and Coordinated Behavior

Credibility is multidimensional

Credibility may involve expertise, accuracy, transparency, independence, consistency and accountability. A high-centrality account may be credible, non-credible or mixed. Credibility assessment should evaluate the source, the claim, the evidence and the context.

Useful signals include:

• identity and organizational transparency;
• history of corrections and sourcing;
• consistency between claims and reliable evidence;
• independent corroboration;
• disclosure of commercial or political interests;
• meaningful dialogue rather than only amplification;
• stable, human-plausible activity patterns.

No single signal establishes credibility.

Bot detection

Bots are automated or partially automated accounts. Indicators may include unusually regular posting intervals, high activity at all hours, repeated text, improbable growth, low conversational diversity, synchronized actions and client metadata where available. These are indicators, not proof: scheduled brand accounts, emergency communication systems and highly active humans can look automated.

A robust classifier should combine behavioral, temporal, network and content features, report uncertainty and be evaluated for false positives across languages and communities. Bot labels should be treated as probabilistic classifications rather than moral judgments.

Coordinated inauthentic behavior

Coordination concerns relationships among accounts, not merely automation. Possible evidence includes highly synchronized posting, repeated unusual phrases, shared URLs in narrow time windows, reciprocal amplification, common creation patterns and centralized operational control. Analysts should distinguish:

• Coordination: accounts act in a planned or synchronized manner.
• Inauthenticity: identities or behavior misrepresent the source or nature of participation.
• Organic collective action: people coordinate openly for a legitimate purpose.

Coordination alone is not evidence of wrongdoing. Campaign teams, newsrooms and activist groups may coordinate transparently.

Misinformation and disinformation

Misinformation is false or misleading information shared without established intent to deceive; disinformation involves deceptive intent. Malinformation uses genuine information in harmful or misleading contexts. Classification requires claim verification and, for intent, evidence about the producer’s purpose. Analysts should avoid calling disputed opinions “false” without a verifiable proposition.

A sound assessment separates:

1. Claim identification: What exactly is asserted?
2. Evidence assessment: What reliable sources support or contradict it?
3. Context: Is the content edited, outdated, satirical or miscaptioned?
4. Propagation analysis: How did it spread and through which communities?
5. Harm assessment: What potential consequences are involved?
6. Uncertainty: What remains unknown?

7. An Integrated Professional Workflow

A defensible project typically follows these stages:

Define the decision problem

Specify whether the goal is campaign planning, crisis response, fraud detection, public-health communication, customer insight or research. Define the unit of analysis and the outcome.

Design the network

Choose node types, edge types, direction, weight, time window and inclusion rules. Document whether missing data represent absence or non-observation.

Collect and prepare data

Use lawful APIs, platform exports, public records or consented datasets. Deduplicate records, standardize timestamps, preserve provenance and separate deleted or unavailable data from true non-events.

Analyze structure

Calculate centrality and cohesion measures appropriate to the network. Compare observed values with null models and examine sensitivity to sampling and edge definitions.

Analyze communities and diffusion

Detect communities, validate their stability and trace cascades over time. Combine network features with text, URLs, multimedia and account metadata.

Investigate credibility and coordination

Use triangulation, manual review, source verification and uncertainty estimates. Escalate high-risk findings for expert assessment rather than relying on automated labels.

Communicate findings

Report methods, denominators, missingness, confidence, limitations and potential harms. A dashboard should allow users to inspect evidence rather than display a single unexplained influence score.

8. Illustrative Case: A Product-Safety Rumor

Background

A fictional consumer-electronics company, Northstar Devices, observes a rapid increase in social posts claiming that one of its chargers causes household fires. The company must determine whether the discussion is an organic customer-safety concern, a coordinated attack, or a mixture of genuine incidents and inaccurate claims.

Problem

A simple count of mentions shows rapid growth but cannot answer whether the claim is true, who is spreading it, or which communities require communication.

Analysis

The analytics team constructs three networks over a fourteen-day period:

1. a reply network to identify conversation and support-seeking;
2. a reshare network to trace amplification;
3. a URL-sharing network to identify common evidence sources.

They remove duplicate records, retain timestamps in coordinated universal time, and distinguish original posts from reshares. Centrality analysis identifies a consumer-safety journalist with moderate follower count but high betweenness because the journalist connects technical experts, customers and mainstream media. A much larger entertainment account has high in-degree but contributes little to cross-community diffusion.

Community detection reveals four stable groups: affected customers, electrical-safety professionals, general technology audiences and promotional accounts. The rumor cascade begins with a genuine customer video, is reframed by several accounts using an old product photograph, and then spreads through a set of highly synchronized promotional accounts. However, synchronization alone does not establish that the accounts are centrally controlled.

The team verifies the claim against product batch records, independent laboratory tests and regulatory notices. It finds two confirmed overheating incidents involving a specific counterfeit component, but no evidence that all Northstar chargers are unsafe.

Approach and solution

Northstar publishes a narrowly worded safety notice, identifies the affected batch and explains how to recognize counterfeit components. It provides evidence links, a reporting form and a correction process. The company asks the journalist and safety professionals to review the technical explanation but does not attempt to manufacture endorsements. It also preserves relevant data and refers suspected coordinated manipulation to the platform under its established reporting process.

Outcome

Overall mention volume remains elevated for several days, but the inaccurate claim becomes less dominant in the verified-customer and professional communities. The company measures success through accurate information uptake, support resolution and reduction in unsafe-product reports—not merely through lower post volume.

Learning points

The case illustrates that network position and credibility are different constructs; community structure must be interpreted with content and evidence; a cascade can contain both authentic and coordinated components; and responsible crisis analytics focuses on verifiable claims and user safety rather than suppressing criticism.

9. Ethics, Governance and Contemporary Developments

Network data can expose relationships, political affiliations, health interests and vulnerable groups. Ethical practice requires purpose limitation, data minimization, secure storage, access controls and retention limits. Analysts should consider whether users reasonably expected the interaction to be analyzed, even when data are technically public.

Important governance principles include:

• document collection and transformation decisions;
• obtain consent when required and seek institutional review for research involving people;
• assess re-identification risk before publishing network visualizations;
• avoid deanonymizing ordinary users;
• audit models for language, demographic and geographic bias;
• provide appeal or review mechanisms for consequential classifications;
• distinguish platform policy violations from legal violations;
• preserve an evidential chain for high-impact claims.

Network visualizations are particularly risky because anonymized nodes can sometimes be re-identified from structural patterns. Aggregation, privacy-preserving releases and suppression of small cells may be necessary.

Recent developments include temporal and multilayer networks, graph neural networks, cross-platform diffusion analysis, multimodal disinformation detection and causal network inference. Graph neural networks can learn representations from node attributes and neighborhood structure, but they inherit data bias, may be difficult to interpret and can leak sensitive relationships. Large language models can assist with claim extraction, clustering and qualitative coding, but generated summaries require source verification. AI should support, not replace, expert judgment in credibility and harm-sensitive decisions.

Best Practices

1. Define the social or managerial question before selecting a metric.
2. Treat edge construction as a substantive modelling choice.
3. Report multiple centrality measures and explain their meanings.
4. Use null models and sensitivity tests for community claims.
5. Separate exposure, engagement, persuasion and behavioral influence.
6. Combine network, temporal, content and source evidence.
7. Treat bot and coordination detection as probabilistic.
8. Validate important automated classifications through expert review.
9. Protect privacy and avoid unnecessary individual-level disclosure.
10. Report uncertainty, missing data and plausible alternative explanations.

Chapter Summary

Social network analytics represents users, content and organizations as nodes connected by directed, undirected, weighted or temporal ties. Degree centrality captures local connectivity, betweenness captures brokerage, closeness captures structural proximity, and eigenvector-style measures capture connection to influential nodes. Density, reciprocity, clustering, components, bridges and k-cores describe cohesion and structural organization.

Community detection identifies groups with unusually strong internal connectivity, but communities require validation through content, temporal stability and suitable null models. Diffusion analysis studies cascades, reach, depth, breadth and lifetime. Contagion and threshold models provide useful abstractions, but real platforms contain homophily, algorithmic ranking, repeated exposure and correlated behavior. Influence is a causal concept and should not be inferred from centrality alone.

Credible influence must be assessed through evidence, expertise, transparency and accountability. Bots, coordinated behavior and misinformation require triangulation, uncertainty reporting and careful distinction between automation, coordination, inauthenticity and false claims. Ethical practice protects privacy, documents methods, audits bias and reserves consequential judgments for accountable human review.

Key Terms

Graph: A mathematical representation of nodes and edges.

Node: An entity represented in a network.

Edge: A relationship or interaction between nodes.

Directed network: A network in which ties have a source and target.

Weighted network: A network in which ties carry numerical values.

Centrality: A family of measures describing structural prominence.

Betweenness centrality: The extent to which a node lies on shortest paths.

Closeness centrality: A measure based on distances to other nodes.

Eigenvector centrality: Centrality based on connections to important nodes.

Density: The proportion of possible ties that are observed.

Reciprocity: The prevalence of mutual directed relationships.

Clustering coefficient: The degree to which a node’s neighbors are connected.

Community: A group with relatively dense internal connectivity.

Modularity: A measure comparing within-community edges with a null expectation.

Cascade: A temporally ordered sequence of information transmissions.

Reach: The number of distinct accounts potentially exposed.

Bot: An automated or partly automated account.

Coordinated behavior: Planned or synchronized activity among accounts.

Misinformation: False or misleading information shared without established deceptive intent.

Disinformation: False or misleading information shared with deceptive intent.

Review Questions

Short Answer Questions

1. What is the difference between a directed and an undirected social network?
2. Why does high degree centrality not necessarily imply causal influence?
3. What does betweenness centrality measure?
4. Why should a detected community be validated with content and temporal evidence?
5. Distinguish misinformation from disinformation.

Long Answer Questions

1. Explain degree, betweenness, closeness and eigenvector centrality, including the managerial question each measure can support.
2. Discuss density, reciprocity, clustering and k-core structure as measures of network cohesion.
3. Explain modularity-based community detection and its principal limitations.
4. Compare independent-cascade and linear-threshold models of diffusion.
5. Develop an ethical workflow for detecting bots and coordinated behavior in a public-health conversation.

Analytical / Application Questions

1. A directed network contains five accounts and eight ties. Explain which centrality measures you would use to identify popularity, brokerage and access, and justify your choices.
2. A rumor spreads rapidly through three densely connected groups but is repeatedly introduced by a small number of bridge accounts. Design an analysis to determine whether the bridge accounts are credible influencers or coordinated amplifiers.
3. Construct a measurement plan for evaluating a crisis-communication campaign. Distinguish exposure, engagement, accurate belief change and behavioral outcomes, and identify threats to causal interpretation.

Multiple Choice Questions with Answers

Question 1

Which centrality measure is most directly associated with brokerage between otherwise separated groups?

A. Degree centrality

B. Betweenness centrality

C. Clustering coefficient

D. Network density

Correct Answer: B. Betweenness centrality

Question 2

For an undirected simple graph with n nodes and m edges, which expression gives density?

A. m/n

B. 2m/[n(n−1)]

C. n(n−1)/(2m)

D. m/[n(n+1)]

Correct Answer: B. 2m/[n(n−1)]

Question 3

In a directed network, a high in-degree most directly indicates that an account:

A. Receives many incoming ties

B. Connects every community

C. Has the shortest average path

D. Has no reciprocal relationships

Correct Answer: A. Receives many incoming ties

Question 4

What does modularity compare when evaluating a proposed community partition?

A. Observed within-community connectivity with connectivity expected under a null model

B. Follower counts with advertising expenditure

C. Positive sentiment with negative sentiment

D. Posting frequency with account age

Correct Answer: A. Observed within-community connectivity with connectivity expected under a null model

Question 5

In the approximation R₀ ≈ pz, what do p and z represent?

A. Precision and sample size

B. Transmission probability and expected branching factor

C. PageRank and network density

D. Posting rate and time zone

Correct Answer: B. Transmission probability and expected branching factor

Question 6

Which statement about bot detection is most appropriate?

A. One unusually regular posting interval proves an account is a bot

B. Follower count alone reliably identifies bots

C. Multiple behavioral and network signals should be combined with uncertainty reporting

D. Bots always have low centrality

Correct Answer: C. Multiple behavioral and network signals should be combined with uncertainty reporting

Question 7

A tie that, when removed, increases the number of connected components is called a:

A. Self-loop

B. Bridge

C. Clique

D. Core node

Correct Answer: B. Bridge

Question 8

Which statement best distinguishes reach from influence?

A. Reach is potential exposure, whereas influence concerns an effect attributable to an actor or message

B. Reach and influence are always identical

C. Influence is only the number of followers

D. Reach can be measured only in undirected graphs

Correct Answer: A. Reach is potential exposure, whereas influence concerns an effect attributable to an actor or message

Question 9

Why can a high modularity score fail to prove that a socially meaningful community exists?

A. Modularity is never calculable for networks

B. The result depends on the null model, resolution and algorithmic settings

C. Modularity measures only sentiment

D. Communities cannot contain more than two nodes

Correct Answer: B. The result depends on the null model, resolution and algorithmic settings

Question 10

Which evidence is most appropriate for classifying a claim as disinformation?

A. The claim received many shares

B. The claim was posted by a low-degree account

C. The claim is false or misleading and evidence supports deceptive intent

D. The claim crossed two communities

Correct Answer: C. The claim is false or misleading and evidence supports deceptive intent