Establish whether recurring scripts represent one operation or multiple operators

Establish whether identical or near-identical calling scripts that span both detector-labeled synthetic and human calls are operated by a single organization using both automated and live callers or instead reflect detector misclassification or unrelated operations.

Background

The paper clusters calls primarily by opening script and explicitly treats the resulting groups as script families rather than organizations. At least one script appears in calls on both sides of the detector’s synthetic-versus-human boundary.

That observation has two competing interpretations: the detector may have mislabeled some calls, or one operation may deploy both automated and human instances of the same script. Resolving the distinction is important for interpreting campaign structure and for determining whether script-level clustering can identify operators rather than merely recurring content.