Systems and methods for social network analysis on dark web forums to predict enterprise cyber incidents

1. A method of threat prediction based on social network features computed on a streaming basis, comprising:

generating, by a processor, a plurality of evolving networks including a historical network defining a first temporal graph corresponding to a first set of forum posts aggregated within a predetermined time period, and a daily network defining a second temporal graph corresponding to a second set of forum posts for a current day;

generating, by the processor, an auxiliary graph that incorporates historical information from the plurality of evolving networks by merging the first temporal graph with the second temporal graph; and

computing by the processor a set of features for the current day from the auxiliary graph based on community information about known expert users associated with the first temporal graph.

2. The method of claim 1 , further comprising computing the set of features, by:

inputting a set of predetermined experts and a set of tuples associated with the set of predetermined experts;

outputting a number of non-experts at a certain time that share communities with the set of predetermined experts;

extracting a plurality of communities from the plurality of evolving networks;

defining a community associated with the set of predetermined experts;

computing, for each of the set of experts, all associated communities;

defining a set of individuals who have posted in a timeframe based on the auxiliary network;

defining a set of tuples associated with the timeframe;

iterating through each of the set of individuals who posted during the time frame to assess a measure of common communities.

3. The method of claim 2 , wherein each of the set of individuals are connected using heuristics through one of either a temporal constraint or a spatial constraint.

4. The method of claim 2 , wherein the set of predetermined experts is extracted from the historical network while excluding the daily network.

5. The method of claim 2 , wherein the set of predetermined experts is extracted from the historical network following constraints comprising:

extracting each of the set of predetermined users who have mentioned a common vulnerability and exposure in a post in a time spanned by the historical network;

extracting each of the set of predetermined users who have mentioned a common vulnerability and exposure in a post belonging to a number of top common platform enumerations for a time spanned by the historical network; and

extracting each of the set of predetermined users who have an indegree in the historical network greater than a predetermined threshold.

6. The method of claim 1 , wherein the evolving networks include a reply network corresponding to a thread within a forum.

7. The method of claim 1 , wherein the set of features comprise a measure of graph conductance, a measure of shortest path, a set of expert replies, and the measure of common communities.

8. The method of claim 1 , further comprising employing, by the processor, an unsupervised machine learning model configured to:

aggregate a time series associated with the historical network;

separate a set of daily feature vectors into normal and anomalous components;

compute a squared prediction error from the anomalous components; and

flag points within the set of daily feature vectors as anomalous using a threshold based measure, the threshold based measure denoting a limit for anomaly among a set of values chosen for flagging a point for the set of daily feature vectors.

9. The method of claim 1 , wherein the historical network is constant for all days in a particular month.

10. The method of claim 1 , wherein the daily network is recreated on a daily basis.