A Lightweight, Explainable Spam Detection System with Rüppell’s Fox Optimizer for the Social Network X

1. Introduction

In the modern era of humanity, Online Social Networks (ONSs) have emerged as the main information source X, previously referred to “Twitter”, is currently one of the favorite prominent and extensively utilized OSNs platforms. Consequently, it contributes significantly to online discussions and links millions of users .Nonetheless, their significant impact rendered it as appealing target for nefarious individuals aiming to control and sway public perspectives and decision processes [1,2]. X was frequently the main goal because of its free structure as well as growing users demographic. X platform, considers spam an essential issue and employs multiple filters for spam to safeguard users. [3,4,5,6,7,8]. X spam accounts created a new techniques and behaviors. Consequently, the utilization of new adaptive and robust technologies for detecting spam X accounts has become imperative. The use of artificial intelligence (AI) with machine learning (ML) present a viable solution. Models using ML can acquire learn from real world datasets by employing algorithms such as Ensemble Learning, DT, KNN and LR to differentiate successfully among spam and non-spam account. Such techniques provide a more powerful and dynamic methods by being able to adjust to modern spamming strategies [9,10].

A major challenge in implementing ML models refers to the "black box" , ML are black-box models and comprehending how they predict is a challenging endeavor, especially in cybersecurity activities such as spam detection, where the predictions from these models are intricate to interpret cybersecurity specialists to comprehend. Consequently, architecture must be developed to clarify the predictions of ML spam detection systems. The resolution for some such problems has manifested as the XAI approach [11]. This approach seeks to address this gap of elucidating predictions generated by ML models within the realm of cybersecurity applications [12] . XAI clarifies the black box system through Interpreting its operations and predictions.

This study highlights the outlined needs through offering an innovative approach, for develop an ML- driven spam detection system that is light-weight, where the trained model using the optimal subset of features. This facilitates a reduction in computation resources for spam detection .This work provides for feature selection method which utilized a swarm-based nature-inspired meta-heuristic method RFO [13] . Moreover, the proposed system is both learned and evaluated via ML methods. The predicted outcome generated via a learned ML-driven spam detection model is elucidated through employing the SHapley Additive exPlanations' (SHAP) Shapley values [14] .

This study primary contributions are delineated as follows:

• An innovative XAI-powered Ensemble learning model significantly improving classification accuracy X spam account detection.
• A swarm-based, nature-inspired meta-heuristic method, called Ruppell's Fox Optimizer (RFO) algorithm for feature selection which for the first time applied to cybersecurity and light weighted system load.
• The proposed solution is experimentally evaluated using the real world X dataset. Developed model significantly improving performance metrics such as confusion matrix precision, recall, accuracy, F1-score and (AUC) value of area under the curve.
• The prediction made by ML- driven spam detection model is interpreted via computing the Shapley values through the SHAP methodology.

The remainder of this work is structured as follows: In the second section, Background about ensemble Model (AdaBoost), XAI and ML algorithms. The third section presents a summary of experiments employing artificial intelligence methodologies, including ML, DL, and FL, for X social network spam detection, along with their outcomes. The fourth section clarifies the methods and materials are employed for X social network spam identification, as well as the performance metrics utilized to assess the efficacy of the applied methodologies. The fifth section presents the outcomes of the experiments for all models and discusses their findings. The final section presents overarching assessments on the outcomes.

2. Background

The next section provides a detailed overview of the key concepts and classification algorithms underlying of proposed spam detection system. Furthermore, the explainable artificial intelligence (XAI) , SHAPE methods which employed to interpret the model's decision-making processes.

2.1. Ensemble Model

Ensemble learning in the ML field seeks to improve overall performance and generalizability by integrating the predictions of various classifiers or regression models. In this approach, aggregates various weak learners to counterbalance their individual faults, resulting in a more solid composite model. Three principal ensemble learning strategies are defined as bagging, boosting and stacking; model and error diversity play a key role in these strategies. Thus, ensemble approaches alleviate overfitting inclinations and the accuracy deficiencies seen in individual models, attaining enhanced performance in tasks necessitating high precision, such as social networks spam identification [15,16] .

This study employs the boosting algorithm AdaBoost. AdaBoost is an iterative improvement technique wherein weak learners are taught consecutively, with increased focus on previously misclassified instances at each stage. AdaBoost constructs its final decision through weighted voting for each weak learners, utilizing decision stumps as base learners. This system allows basic classifiers to collaboratively attain elevated accuracy. Moreover, AdaBoost's nonparametric characteristics and its inherent technique for mitigating overfitting enable its application across multiple challenge areas. [17,18] .

2.2. Explainable Artificial Intelligence

The imperative for understanding the procedures for making decisions of AI models has led to the emergence of XAI. The principal aim of this approach is to transparently, transparently reveal what, why and how a model predicts, the rationale behind those predictions[19], and the methodology employed in reaching its conclusions as in Figure 1.

Making the internal mechanisms of black-box models understandable is critical in terms of reliability, ethical compliance and debugging. Especially in highly interactive applications such as social networks platforms spam detection, the explainability of the decisions taken as in Figure 2. is vital for both user satisfaction and compliance with legal regulations [20] .

SHAP (SHapley Additive Explanations) produces model explanations at both global (entire dataset) and local (individual instance) levels using Shapley values ​​derived from cooperative game theory. as in Figure 3. The contribution of each feature to the decision process is calculated by averaging the marginal effects over all feature combinations [21,22]

2.3. Machine Learning Algorithms

The comparison analysis part is a crucial element of this research, providing an overall structure for evaluating the effectiveness of the proposed AdaBoost Classifier. To this end, various established techniques were chosen for comparison, including DT, KNN and LR.

2.3.1. Decision Tree

A decision tree is a supervised machine-learning algorithm widely used in classification and regression problems. The model divides the data into subsets in successive internal nodes starting from the root node and the final class or numerical output is produced in the leaf nodes [23] . Data splitting decisions are usually based on measures such as Entropy Information Gain or Gini Index. The aim is to reduce the irregularity of the target variable as much as possible in each split [23]. Decision trees provide understandable models on their own thanks to their interpretable structures; they also play a critical role as the base learner in ensemble techniques such as AdaBoost. These ensemble models increase accuracy by balancing the high variance of individual trees. In text classification applications such as spam detection in social networks, decision trees are preferred due to both their fast prediction time and explainability advantages; they provide high accuracy alone or in the ensemble [24] .

2.3.2. K-Nearest Neighbors (KNN)

K-Nearest Neighbors know as (KNN) represents a non-parametric, lazy learning technique utilized for regression and classification tasks. Instead of developing a definitive model, all calculations take place during the prediction phase [25] . The core idea entails designating a query instance with the label (or value) that is most prevalent over its k nearest neighbors within the learning dataset [26]. KNN’s straightforward implementation and its independence from any assumptions about the underlying data distribution have rendered it a widely adopted method in numerous domains, including spam social network detection [27].

2.3.3. Logistic Regression (LR)

Logistic Regression represents a fundamental ML technique employed in classification applications. It creates a model of the probability that an input falls into a specific class. The objective of logistic regression is to develop a model capable of making a classification decision using sigmoid function [28]. The high interpretability and computationally efficient nature of Logistic regression make it stand out in both explanatory analysis and practical applications like spam detection [29]. For example, models that predict social media interactions based on graph and content features can clearly reveal the effects of variables thanks to the understandable structure of linear regression [30].

3. Literature Review

The expanding problem of spammer identification in online social networks has attracted considerable focus in both academic and industrial domains. Although conventional ML methods have proven essential in addressing this difficulty, they tend to show an imbalance among evaluation metrics and explainability [31,32,33] . The present overview of literature seeks for a thorough review of the latest approaches and technology for spam identification. includes an especially emphasis on the ensemble learning models and explanation AI methodologies in spam identification. Regarding ML for spamming detection, in [34] proposed an approach that used trained XGBoost model with Random Forest classifier as feature selection and explain the results using XAI methods on OSN datasets, producing outstanding outcomes. Furthermore, [35] fuzzy-inference-systems (FLSs) employing Interval-Type-2 and Type-1 was employed deploying SVM, BPM, Avr Prc and LR algorithms to demonstrate their effectiveness in detecting spamming accounts.Type-2 Mamdani FLSs showed excellent results, of 0.955,0.957, 0.967 and 0.962 as accuracy, precision, recall, F-score respectively. [36] contended that BERT and CNN as a classifier exceed of SVM, RF, and NB , While the impact of such techniques depends on the characteristics set used in identifying spamming. [37] formulated a framework using a probabilistic clustering technique for tackling classification challenges caused by hostile discourse within the X network. They categorized the acquired X posts via crowdsourced specialists into two classifications, those containing hostile discourse or not included, using the samples retrieved over the Bayesian classifier, they produced the attribute they represented using the (TF-IDF). Researchers subsequently employed FL method to classify hostile discourse based on this data. they attained outcomes of 0.9453, 0.9254 , 0.9174 ,0.9256 as accuracy, precision, recall and F-score respectively. [38] utilized random under-sampling (RUS) and random over-sampling (ROS) techniques for non-spam and spam classification. Authors conducted a comparative analysis of their generated models by implementing the ensemble learning, RUBoost, K-nearest neighbors (KNN),Bayesian classifier (NB),C4.5 decision tree models using Weka. The best precision average of ensemble learning among 82% and 90% While the true positive (TPR)rate about75%. [39] suggested a Hierarchical Meta Path Score (HMPS) approach for spamming identification utilizing their contact numbers on X for promote campaigns. with suggested model campaigns data on 3,370 was obtained from the of 670,251 X users .The findings of the study were acquired using social networks and diverse features, that were created utilizing this approach. For assessing the ability in the developed approach , KNN, SVM , (DT), LR and RF, performance metrics obtained of precision (0.95), recall (0.90), F1-score (0.93), and (AUC) area under the ROC curve (0.92).

4. Methodology

This section delineates the comprehensive approach Figure 4. applied for solve the complex problem for X spam accounts identification. This section starts with dataset's characteristics and training, testing subsets. The latter succeeded with a discussion of data preprocessing strategies to guarantee framework stability. Thereafter, attention is directed towards the RFO for feature selection and then classification phases with Ensemble model.

The section concludes includes a thorough assessment for model efficiency, utilizing various measures for deep evaluate the model's value completely. Ensemble learning integrates several models to provide an enhanced classifier with robust accurate results [40] .The choice for adopting the Ensemble method AdaBoost model is based on upon its shown efficacy in managing data with complex environments deemed crucial in detection X spam. The AdaBoost ensemble seems particularly for this research given the ability it has for handling the complexities of social media patterns, which is a crucial element in this detection model. The ensemble Boosted Trees method with AdaBoost, that integrates with decision trees Learner type for boost classification precision, has a unique benefit in identifying Nuanced characteristics which separate spam and authentic accounts [41,42] .

Furthermore, this work provide comparison methods that give a wider framework to assess efficacy of the model. The approach has been improved by recent strategies of model explainable that providing understanding of models make predictions mechanism.

4.1. Dataset Description

The dataset used to conduct this research was compiled by [35] . This dataset consists of 1225 each representing a X account encompasses 11 unique features, including categorical and numerical attributes, as detailed in Table 1. These attributes encapsulate account characteristics, user behavior and X metadata. This set contains 718 classified as spam accounts, while the remaining 507 are legitimate users labelled as non-spam. This establishes a dependable benchmark for the classification of spam versus non-spam. The dataset encompasses a combination of user profile attributes and X posts -level metrics that are effective in differentiating spammers from authentic users.

Furthermore, features category criteria of the utilized dataset as detailed below:

• User profile features: Several attributes measure activity of account with its reach. User-Statuses-Count (USC) represents the user's latest Tweets or retweets. This indicates the account's productive nature on the platform. Moreover, User-Followers-Count (UFLC) is the total quantity of Tweets this user has endorsed over the account's existence. Whereas User-Friends-Count (UFRC) is users number following this account Also known as their "followings". User-Favourites-Count (UFC) perspectival denotes if the verifying user has liked (favorited) this Tweet. Additionally, User-Listed-Count (ULC) this indicates of public lists number of which the user is a member, its measure prominence of account among different users. These number indicators essentially encapsulate engagement of accounts and footprint in social platform. including these properties enables the analysis of such patterns within the dataset.
• Tweet and profile indicators: Dataset additionally includes a number binary (yes/no) attributes that represent tweet characteristics and profile configurations. Sensitive-Content-Alert (SCA) represents a Boolean value It denotes sensitive items contained in Tweet content or within the textual properties for the user's property. This may indicate spam, as spammer tweets often contain this type of material. Source-in-X (SITW) displays the utility employed to publish the Tweet, formatted as an HTML string. denotes whether the tweet was disseminated using an official X platform (YES) or a third-party source (NO).For instance, Tweets originating from the X website possess a source designation of web. Conversely, spammers may utilize specific applications. User-Location (UL) constitutes a category domain indicates the user provided location for the account profile (YES) or unfilled (NO). the location actual text is not employs due to its random nature and difficulty in parsing. This binary characteristic just indicates the existence of a profile location. commonly possessed by legal users. User-Geo-Enabled (UGE) if the user has activated geotagging on tweets is TRUE (indicating that the account permits the attachment of geographical coordinates to tweets). User-Default-Profile-Image (UDPI) is a boolean variable, signifies that the user using default X profile picture(When true, indicates the used not uploaded image for profile). Significantly, suspicious accounts typically use the default image profile and possess minimal private information [42] .So this trait may indicate a potential threat. Finally, ReTweet (RTWT) Boolean value, this indicates if the validating user has retweeted this Tweet.
• Class attribute: this attribute in the dataset signifies that an account is categorized as spam account if true, while false represents an account that is legal.

Overall, this dataset offers a comprehensive overview of X account attributes, integrating user profile metrics with content indicators. The fundamental reason for providing an extensive overview of the data is the essential requirement for a deep comprehension of the dataset's intricacies prior to initiating ML models. There is essential for constructing a robust spam identification system.

4.2. Data Preprocessing and Balancing

This section discusses the preprocessing conducted on the X spam dataset for preparing to proposed model. The objective consists of cleanse data, address any anomalies, and convert it into a structure that fits ML techniques. The procedure started with the verification of duplicate records. that could occur as a result of challenges faced via collection data. Subsequent to this step, every single row constitutes a distinct data element. Subsequently, missing or null values are addressed. Although such elements are infrequent, they are excluded to prevent bias during the subsequent scaling process. Following stage data digitalization and multiplication. In this stage process of encode all binary features values with “Yes-No” or Boolean “True-False” into numerical values "1-0". additionally, given data that is labelled by the interval criteria, for each data generated five different random real values in the confidence interval for the pertinent criterion. Here, feature with binary values in corresponding data to the confidence interval criterion also multiplication by five like identical value. Data comprising 1,225 parts was transformed into 6,125 parts of data upon completion of this process. The final result from these preprocessing techniques is a refined dataset suitable for ML models. It maintains with identical of rows quantity (excluding duplicates that were eliminated) with same features set, but use a uniform numeric format.

Every row represents the 11 input unique features, five normalized continuous elements(indicating the user's status count, follower count, etc.) and six binary indicators (for indicators such as sensitive content, default picture, etc) and finaly binary class label. The clean dataset split into two subsets with 80:20 ratio for model training and testing set. This partition is essential during training and validation stages of models. The training subset is applied to construct the model. Whereas, the testing subset is designated for assessing the model's performance on previously unobserved data. The test ratio is determined based on research results that indicates this percentage offers an optimal equilibrium throughout training and testing [43]. The selection is further affected with the requirement of an adequately sized testing subset for validate assess the model's performance. Through the execution of these preprocessing activities ensure that detection model are able to make efficient use of the information without being hindered during the process. This careful preprocessing steps provide a solid foundation for building an accurate spam detection model.

The complete dataset of 6125 samples was divided by a 80% for training and 20% testing stratified split, producing a training set of 4900 samples (2872 spam and 2028 non-spam) and a test set of 1225 samples (718 spam and 507 non-spam). In ML, class imbalance can make predictive models favor the majority class. consequently, compromising performance on underrepresented outcomes. To tackle this challenge, the current study employs the Synthetic Minority Over-sampling Technique (SMOTE) to achieving a more equitable class distribution while the development of models. SMOTE was employed for the training set to expand the non-spam category samples from 2028 to 2872. Creating a meticulously balanced training set of 5744 samples (2872 spam and 2872 non-spam) ensures balanced class distribution for the model training as shown in Figure 5.

4.4. Feature Selection Approach

Feature selection is an essential process within ML which significantly impacts model efficacy. Not every feature within dataset inherently aids the model's training procedure. Extraneous features might diminish the ability to classification thus impede the learning phase. Selecting best feature subset that beneficially impact the model streamlines it, facilitating the achievement of more precise and expedited outcomes.

4.4.1. Rüppell Fox Optimization

In ML domains, traditional optimization techniques frequently prove difficulties due to the expansive and intricate solution spaces encountered. Meta-heuristic methods provide efficient solutions to address this constraint. These algorithms apply random search techniques to locate solutions near the global optimum. Meta-heuristic techniques, sometimes inspired from natural events, are especially beneficial for selection feature tasks because of their low computing expense with excellent precision. This work leverages RFO, swarm-based inspired by the hunting and survival behaviors of Rüppell's foxes, for feature selection. The RFO systematically balances between local exploitation with global exploration to ascertain optimal solutions. Its start with initial with randomness-based steps to investigate various areas and amplifies its search near the most promising answers to expedite convergence. RFO creates random initial positions in each dimension after establishing the upper and lower boundaries of the solution space, as shown by the following equation(1-3), the population size, maximum iterations, and algorithm-specific parameters are established at this stage. In each iteration, a P value randomly is initially established within the interval (0, 1).

$$y_j^i=l_j+r\times \left(u_j-l_j\right)$$

(1)

$$\begin{gathered} y_j^i :The jth dimensional coordinate of the ith member within population \\ {u}_j :The upper limit of the j-th dimension \\ {l}_j :The lower limit of the j-th dimension. \\ r :A random number generated within the interval \left[\mathrm{0,1}\right]. \end{gathered}$$

The daytime mode is activities if p is greater than or equal to 0.5; otherwise, the nighttime mode is activities. The Rüppell's fox's senses and the update techniques the algorithm uses throughout each iteration are determined by the daylight and night modes. The following equations are used to calculate the senses of eyesight, hearing, and smell:

$$s={\displaystyle \frac{1}{1+e^{\left(K/2-k\right)/100}}}$$

(2)

$$h={\displaystyle \frac{1}{1+e^{\left(k-K/2\right)/100}}}$$

(3)

$$smell={\displaystyle \frac{0.1}{\left|acos\left(\frac{2}{1+e^{\left(K/2-k\right)/100}}\right)\right|}}$$

(3)

where K is the maximum iteration and k is the present iteration. The population size, maximum numbers of iterations, and parameters of algorithm are initialized during this phase. In each iteration, a random value p is evenly selected from the interval [0,1]. If p < 0.5, the algorithm functions in night mode; otherwise, it transitions to daytime.

4.1.2. Daylight and Night Behavioral Update Strategies

At each iteration, a random limit variable rand is sampled uniformly from (0,1) to select between daylight mode (p≥0.5) and night mode (p<0.5). These modes determine which sensory-driven update rule the Rüppell’s fox employs:

• Daylight mode (p≥0.5)

1.1. If s≥h and rand≥0.25, update position using eyesight; otherwise (rand<0.25), update via eye movement.

1.2. If s<h and rand≥ 0.75, update position using hearing; otherwise (rand<0.75), update via ear movement.

2.

Night mode (p<0.5)

2.1. If s<h and rand≥0.25, update position using hearing; otherwise (rand<0.25), update via ear movement.

2.2. If s≥h and rand≥0.75, update position using eyesight; otherwise (rand<0.75), update via eye movement.

In both modes, the foxes also employ their olfactory sense. As a fox approaches its prey, its olfactory acuity increases exponentially; conversely, as it moves away, olfactory sensitivity decreases exponentially.

In the optimization process, KNN algorithm was employed to evaluate classification accuracy. A neighborhood coefficient of k=5 was chosen for both the KNN classifier and the cross-validation procedure. The RFO algorithm was initialized with a population of 100 individuals and executed for 200 iterations. From the original set of 11 features in the dataset, a subset comprising nine features was obtained. The nine features ultimately selected by the RFO algorithm are presented in Table 2.

The features listed in Table 2 were identified by the RFO algorithm as the most influential in maximizing classification performance.

4.5. Model Training

For this stage The Ensemble approach Specifically AdaBoost was chosen, due to its reliability and capability. In Boosting approach, combining a group of weak models to create a single strong model. This procedure in ML is referred as boosting. Adaptive Boosting classification technique also known as AdaBoost [44] . Every weak learners generates a Logical expression and executes a learning process. Decision trees, a type of machine supervised learning, enable the continuous partitioning of data based on a specified parameter to aid in the creation of predictive models using training data, decision nodes and leaves are crucial elements for clarifying the tree's structure. Upon the completion of the process, when all classifiers produced over the iterations are ultimately solicited to cast their votes regarding the preferred result for Innovative inquiry, some trees are likely to receive a greater vote over alternatives. This is the primary distinction between AdaBoost and bagging methodologies. AdaBoost has been employed via numerous researchers in investigations on spam and fraud detection [45,46]. For evaluation step applied collection of reliable metrics to assess the model's efficacy. Incorporating Accuracy, F1-score, Recall, Precision, the Receiver Operator Characteristic (ROC) with the Area under the Curve (AUC). These performance measures were selected based of its comprehensive capacity to elucidate the model's strengths and Constraints. Hence, the structure of the training model then evaluation process was thorough and precise, integrating RFO for feature selection optimization. This multifaceted strategy guarantees an in-depth assessment, therefore enhancing the dependability and integrity of the work outcome.

4.6. Model Evaluating

Machine learning model performance evaluation is an essential part inside the comprehensive model workflow. The evaluating stage includes various types of key metrics, crafted to provide an advanced overview about a model strengths and constraints, so directing future endeavors to enhance accuracy of the prediction. Regarding our study, researchers chose to apply a set of primary metrics. In order to evaluate entire model efficiency with classification techniques employed in spam detection: Accuracy, F1-score, Recall, Precision the ROC and AUC as Table 3.

4.7. Implementation Environment

For this work, the computing resources was carefully prepared to satisfy powerful requirements. The hardware resources configuration was based on a personal computer equipped using CPU Intel (R) Core (TM) i7-14700HX-2.10 GHz with RAM memory 32 GB. For Operating System Windows 11 Pro (64-bit) guaranteeing a reliable and effective computational performance. The research employs the Python 3.11.7 programming language, augmented by numerous libraries like Pandas, NumPy for manipulation the data and efficient numerical operations. Anaconda was utilized as platform for manage environment. MATLAB academic version R2024b was selected as implementation and deployment environment. Since its offers built-in interpretative interface for mathematical and graphical functions together with many specialized toolkits and application for advanced modeling like Statistics and Machine Learning Toolbox, classification learner app with global and local interpretation plots.

5. Results and Discussion

Our findings indicate the efficacy of explainable ML models in identifying spam accounts on online social networking like X. This section will clarify the conclusions obtained through the performed experiments within methodology for study. As illustrated in Table 4, The suggested design exhibits excellent results , achieving a final accuracy rate about of 99.35%.

The precision rates for Non-Spam (0) and Spam (1) classifications are 98.61% and 99.03%, respectively. The model produces relatively low false positive, as evidenced by these extremely accurate values. This is essential in spam identification help prevent the erroneous classification of real accounts as spam. The ratio of accurate predictions to the total correct predictions is termed precision. regards to spam detection, a precision score of 99.03% within Spam label indicates the system infrequently labels a Non-Spam account as spam. Equally, precision score for Non-Spam label demonstrates that the model is exceptionally dependable in accurately detecting real accounts. The system has remarkable recall scores of 98.62% for Non-Spam and 99.86% for spam. Recall evaluates capacity of the model for recognize all pertinent cases within each category. A strong recall score of 98.62% in Non-Spam instances guarantees the accurate identification of nearly all Non-Spam accounts. In contrast, recall score of 99.86% in Spam category proves the approach effectively identifies all spam accounts, establishing a formidable initial barrier towards unsolicited accounts. The F1-Score It also referred as F-measure is a harmonious metric combining Precision and Recall. taking into account False-Positives and False-Negative. For Non-Spam, the model has an F1-Score of 98.61%, while for spam, it's 99.44%. This model's results show that it does a great job at balancing Precision and Recall, this considered a highly discerning in classification problems. Support values are 507 with Non-Spam when 718 for spam. Give the count for true instances for each category within the dataset. This values have weight since they provide information for the remaining performance metrics, including F1-Score, precision, and recall. With numerous instances for each classes, the model's powerful performance metrics are even more dependable. Overall, with higher scores of every performance indicators indicate the system's efficacy, dependability, and resilience in categorizing accounts as Spam or Non-Spam. The indicators together demonstrate the system's superior performance. rendering it an exceptionally dependable instrument for X spam accounts identification.

5.1. Evaluation of Performance with the ROC Curve

A receiver operating characteristics (ROC) graph computed to evaluation model performance solidity. The calculated area under the curve (AUC) is a crucial metric that reflects the discrimination ability of each model. AUC for spam accounts demonstrated superior performance of 0.9992, 0.9920, 0.9935, ,0.9901 and for AB, DT, KNN and LR , respectively. These results indicate strong discrimination abilities. Moreover, the AUC result of RFO -AdaBoost around 0.9992 as shown in Figure 6. is nearly ideal and signifies as a system demonstrates exceptional separation. This indicated system's capability to accurately categorize hence validating the system's solidity. A strong AUC score indicates a reduced likelihood of mistakes in classification with the system. This suggests a minimal false positive rate, it's essential with accounts spam detection. A small false positive rate indicates non-spam accounts have a lower probability of erroneously categorized as spam accounts, guaranteeing the preservation non-spam accounts.

Under perfect case, area under the ROC curve will flow with graph upper left region, indicating a false positive rate with 0 while positive rate of 1. A nearer curves adheres upper left region, the test accuracy greater. The suggested design, having a value for the AUC of 0.99, very closely matches the perfect case. Briefly, the ROC curve with associated AUC at 0.99 offer solid proof to support the system's proficiency in categorizing X accounts as non-spam or spam.

5.2. Performance Evaluation Using Confusion Matrix

The confusion matrix is conducted as part of the experimental assessment. The model accurately in properly classifying non-spam account and detecting spam account, as well as the associated error rates, are shown in Figure 7. A comprehensive examination reveals that the non-spam accounts identification rate is roughly 99% and 96% across all detection models. Furthermore, The detection models have exhibited exceptional efficacy in precisely recognizing particular spam accounts, achieving an accuracy near or exceeding 99%.

5.3. Explain Global Model Predictions Using Shapley Importance Plot

The SHAP analysis depicted in Figure 8. (a) functions to be a crucial technique for clarifying the intricate procedures for making decisions within the XAI-ROF- AdaBoost method employed for this research. Shapley Importance chart offers a model-agnostic based game theoretical assessment of feature impact. Such score becomes crucial towards comprehending the impact of each feature over the predictions result.

Shapley values of predictors for a collection of query points to ascertain which predictors exert the most important (or least important) average influence on the size of model output. These values elucidate the divergence of the forecast for the query point from the mean prediction, attributable to the predictor. The sign of the Shapley value denotes the direction of the deviation, while the absolute value signifies its size. This high interpretability degree is essential with models necessitating significant responsibility and transparency.

Additionally, specific features strongly influence the predicted effectiveness based on the ensemble model. Shapley Importance analysis showed SCA is the main feature affecting both spam and non-spam predictions scores. Particularly, the mean absolute Shapley values demonstrate that altering SCA modifies the expected classification score. Secondary features USC, UFC and UFRC showed a moderate impact. where each predictor spam portion partially surpasses its non-spam portion. This disparity signifies a minimally more significant influence on increasing the spam score compared to the non-spam score. UFLC, RTWT, UL, and UDPI exerted diminishing effects in succession. while ULC had the minimal influence

In conclusion, Shapley Importance highlights that content-based indicators (SCA) and high-level indicators of engagement (USC, UFC) stimulate/ reinforce spam identification. These findings underscore potential for focused feature engineering specifically enhancing indicators for "sensitive content" and stress the significance of XAI approaches for transparent and responsible cybersecurity frameworks.

5.4. Explain Global Model Predictions Using Shapley Summary Plot

On the other hand, Shapley swarm chart Figure 8. (b) employed to comprehend the complex makes predictions processes of ML model used in this study.

Shapley swarm charts interpret the influence of individual indications on model classification. The Positive SHAP values suggest that these features predominantly influence model classification in direction spam account. Conversely, negative values move the model towards the non-spam account. This deep grasping is essential for situations where explainability and transparency are critical.

The features of "SCA", "USC" and "UFC" exhibit the greatest positive SHAP values. This indicates that these features are robust markers for categorizing an account as spam. These elevated SHAP values indicate significant influence in the model making predictions.

Low "SCA" feature in X accounts generated substantial positive SHAP values, thus elevating spam account probability. Conversely, high "SCA" was associated with negative SHAP values, significantly steering the model away from classifying as non-spam. The second most impactful feature was "USC". Accounts with a minimal number of total tweets (low USC) exhibited positive SHAP values, suggesting an increased probability of spam, while elevated "USC" yielded negative SHAP scores indicative of non-spam behavior. The "UFC" is ranked third, accounts with few favorites showed positive values, while active "favoriters" yielded negative SHAP values. Features with moderate influence included "UFRC" and "UFLC". Reduced "UFRC" or "UFLC" with positive SHAP value elevates the possibility of spam, when elevated counts inhibited it. Retweet feature "RTWT" showed a comparable trend, minimal retweet rate moderately inclined closer to spam, In contrast, elevated retweet activity significantly favored non-spam content. Both "UL" and "UDPI" showed lower effects, nonetheless, their patterns remained stable. The lack of a specified location and the utilization of a default user profile image marginally increased the possibility of spam, whereas, the valid location and customized avatar have marginally reduced it. Finally "ULC" demonstrated minimal impact since its SHAP values were concentrated around zero.

Optimizing computational efficiency is essential for the real-time deployment and scalability of X spam detection models. Figure 9. comparing training times with RFO vs absence of RFO shows a significant enhancement in the effectiveness of training time for all assessed modeling with adaptation of RFO.

Figure 10. depicts the influence of RFO on the prediction speed of the AdaBoost method that achieved Highest accuracy, quantified in observations per second. The chart displays two bars: performance AdaBoost baseline without RFO, the RFO improved performance. Results indicate a significant enhancement, with prediction speed rising from around 66,587 observations per second to 104,551 observations per second—a gain of over 38,000 observations per second. This boost in performance underscores the efficacy of RFO in expediting inference time, which is especially advantageous in X platform. The graphic clearly conveys the comparative efficiency and supports the incorporation of optimization strategies in ensemble models for detection spam system. Furthermore, Table 5 offers a comparative the suggested model in relation to models for conventional ML, comprising DT, KNN and LR. The comparative metrics employed are Recall, Precision, F1-Score and Accuracy. The suggested model exhibits outstanding results over every metrics attaining Recall, Precision, F1-Score and Accuracy with 99%.

This is especially significant considering that the subsequent highest scoring classifier DT attains 98.69% and 98.81% with Accuracy and F1-score, respectively. While shows good Recall of 98.47% and Precision of 99.16%, prove its capacity for accurately detect spam accounts with reducing the incidence both false negatives plus false positives. Model with excellent Precision guarantees that authentic accounts are not classified as spam accounts, whereas model with excellent Recall guarantees detects a significant percentage of spam accounts. Simply F1-Score constitutes the Harmonious mean between Precision with Recall, functioning to be an equitable metric to evaluate the performance of a model. The suggested model's excellent F1-Score of 99.44% signifies a successful equilibrium among Recall and Precision, this is essential with social platforms When either false negatives plus false positives carry substantial consequences.

The design suggested surpasses KNN even LR, that display results of accuracy above 98.45% and 97.14%, accordingly. Although these models provide commendable Recall or Precision results but lack performance balanced. where evidenced with the diminished F1-Scores of 98.67% and 97.47% respectively. In DT 98.47% Recall is exceptionally good. However, it has deficiencies in Precision, leading to a diminished F1-Score of 98.81%. The LR works adequately but is inferior to the suggested model, with Accuracy 97.14 and F1-Score of 97.47%.

Overall, the comparison examination highlights the effectiveness for the proposed methodology for spam accounts identification. This outstanding score over various criteria designates it to be a formidable and dependable method, particularly in contrast to conventional ML techniques. Moreover, the effectiveness and dependability of the suggested model in accounts categorization are amply supported by the comparison study in Table 5.

The elevated AUC score shown in (Figure 6.) demonstrates this outstanding results metrics, strongly advocating its implementation in social media platforms detection spam systems. Moreover, the effectiveness and dependability of the suggested model in accounts categorization are amply supported by the comparison study in Table 5.

Table 6 presents analytical comparison of related studies which employed the identical dataset, establishing a definitive standard for our method efficacy in comparison to other prominent techniques in the field of X spam accounts detection. That contrastive is essential for situating our method efficiency, specifically emphasizing improvements attained within our amalgamation of XAI methods along with Ensemble model, a technique rarely used with the research we compared.

This study attains an accuracy of 99.35%, exceeding the results documented in comparable works. Significantly, this boost in efficiency can be ascribed to our holistic methodological framework. This encompasses the execution of a preprocessing method, Adapt RFO nature-inspired algorithm for feature selection which for the first time applied to cybersecurity.

Additionally, implementation of XAI strategy to enhance interpretability of the model. Compared to the related studies which neither utilized advantage of optimization features selection algorithms or harnessed the capabilities of XAI or both. Our methodology illustrates the substantial influence for such techniques on the effectiveness of spam identification. Employment of the meta-learning along with nature-inspired optimizer feature selection method provides a strong framework adept at managing the intricacies involved for spam classification problem. Furthermore, applying XAI approaches facilitates a more profound comprehension for how the model makes decisions, which increases model predictions understand and validation. This represents an important difference with previous methodologies mentioned, especially those which depend on conventional "black box" ML methods that lack providing clarity about their working mechanisms. Moreover, integration of XAI enhances the performance of our detection method and establishes a foundation to develop interpreted cybersecurity-based AI solutions. Consequently, this research not only enhances performance score within the discipline yet propels the discussion around the impact of nature-inspired meta-heuristic method with interpreted artificial intelligence models, establishing an additional benchmark for subsequent investigations in spam identification and related fields.

6. Conclusions

This research introduced a lightweight robust XAI-powered AdaBoost ensemble learning for X.com spam account detection. The proposed architecture consists of four components: preprocessing the data, feature selection, spam classification, and explanation of model prediction. Firstly, the preprocessing data. Following that, the dataset is handled by RFO which selects a subset of nine features of spam accounts dataset. Machine learning algorithms are trained and evaluated using the subset feature. The model's prediction is ultimately interpreted by the application of Shapley values. The abilities and shortcomings of the proposed model are put into perspective by comparing the AdaBoost ensemble learning , which was selected for its adaptive learning capability and explainability, to well-known machine learning algorithms, such as DT, KNN and LR. Importantly, the proposed system outstanding results with an accuracy of roughly 99.35 %, and leverages Swarm and summary Shapley to clarify its process for making decisions, hence improving model interpretability. The research results providing a clear technique that improves interpret among complex environments such as cybersecurity.

These results stress the pivotal importance of optimal feature subset selection and explainability AI, necessitating additional investigation into nature-inspired optimization algorithms and XAI methodologies.

Moreover, the proposed approach has limitations. The efficacy of the proposed system is intricately linked to the spam accounts dataset characteristics, that might not accurately represent the discrepancies found in alternative datasets. in conjunction with the intrinsic constraints of the AdaBoost and optimization algorithm. The estimations employed by SHAP, underscores the intricate equilibrium among performance, explainability and generalizability. The forthcoming work motivated by our results seems motivated and essential. We intend to evaluate the versatility of the proposed approach across other OSN platforms. Furthermore, rectifying the approach constraints found in this study, future study will explore different feature selection methodologies and the efficacy of ensemble learning approaches to improve efficiency and explainability.