Detecting information operations campaigns in social media with machine learning
A processor-implemented method for detecting an information operations campaign includes retrieving a first neural network language model including a natural language model trained on a first dataset. The first neural network language model is modified, via transfer learning and based on a second dataset, to produce a second neural network language model. Social media post data associated with a social media post is received, and features are extracted from the social media post data. The features are tokenized to produce at least one token including a value. A prediction score for the at least one token is generated using the trained neural network language model. If the prediction score exceeds a threshold value, a threat warning including a representation associated with at least one of the social media post or an account associated with the social media post is generated.
1. A method for detecting an information operations campaign, the method comprising:
retrieving, via a processor, a first neural network language model including a natural language model trained on a first dataset;
modifying the first neural network language model, via transfer learning and based on a second dataset, to produce a second neural network language model;
receiving, via the processor, social media post data associated with a social media post;
extracting, via the processor, a plurality of features from the social media post data;
tokenizing, via the processor, the plurality of features to produce at least one token including a value;
generating, using the second neural network language model, a prediction score for the at least one token;
when the prediction score exceeds a first threshold value, generating, via the processor, a threat warning including a representation associated with at least one of the social media post or an account associated with the social media post; and
when the prediction score does not exceed the first threshold value and does exceed a second threshold value, generating the threat report and issuing the threat warning to an analyst.
2. The method of claim 1 , wherein the first dataset is a general dataset and the second dataset is a target-specific dataset.
3. The method of claim 1 , wherein the value includes at least one of: an integer, a non-integer, a binary value, a hexadecimal value, or an alphanumeric character.
4. The method of claim 1 , wherein the generating the prediction score for the at least one token is based on at least one of: contextual information associated with the social media post, or extrinsic intelligence associated with the social media post.
5. The method of claim 1 , further comprising generating, via the processor, a threat report for presentation to a data analyst, the threat report including the representation associated with the at least one of: the social media post, or the account associated with the social media post.
6. The method of claim 1 , further comprising generating, via the processor, a threat report for presentation to a data analyst, the threat report including a representation of at least one of: contextual information associated with the social media post, or extrinsic intelligence associated with the social media post.
7. The method of claim 1 , further comprising:
assigning, via the processor, a classification to the social media post using the trained neural network language model, the classification having a value within a range of 0 to 1; and
including, via the processor, a representation of the classification in the threat report.
8. The method of claim 1 , further comprising:
assigning, via the processor, a classification to the social media post using the trained neural network language model, the classification being based on a multidimensional representation including a value of a maliciousness metric and a value of an authenticity metric; and
including, via the processor, a representation of the classification in the threat report.
9. The method of claim 1 , wherein the plurality of features includes at least one string, and the tokenizing includes mapping the at least one string to the value.
10. The method of claim 1 , further comprising:
accessing the trained neural network language model from a model store.
11. The method of claim 1 , further comprising:
determining a ground truth associated with the social media post; and
retraining the trained neural network language model based on the ground truth.
12. The method of claim 1 , further comprising:
generating, using a plurality of neural network language models including the trained neural network language model, a plurality of prediction scores for the at least one token, the plurality of prediction scores including the prediction score; and
identifying, based on the plurality of prediction scores, an information operations campaign associated with the social media post.
13. The method of claim 1 , further comprising identifying a group of social media accounts associated with a social media post signature, the social media post signature based on the at least one token.
14. The method of claim 1
when the social media post is determined, based at least in part on extrinsic intelligence associated with meta-information of the social media post, to be associated with an information operations campaign, generating the threat report and issuing the threat warning to an analyst.
15. A non-transitory processor-readable storage medium storing processor-executable instructions to:
retrieve, via a processor, a first neural network language model including a natural language model trained on a first dataset;
modify the first neural network language model, via transfer learning and based on a second dataset, to produce a second neural network language model;
receive, via the processor, social media post data associated with a social media post;
extract, via the processor, a plurality of features from the social media post data;
tokenize, via the processor, the plurality of features to produce at least one token including a value;
generate, using the second neural network language model, a prediction score for the at least one token;
when the prediction score exceeds a first threshold value, generate, via the processor, a threat warning including a representation associated with at least one of the social media post or an account associated with the social media post; and
when the prediction score does not exceed the first threshold value and does exceed a second threshold value, generate the threat report and issuing the threat warning to an analyst.
16. The non-transitory processor-readable storage medium of claim 15 , wherein the first dataset is a general dataset and the second dataset is a target-specific dataset.
17. The non-transitory processor-readable storage medium of claim 15 , wherein the value includes at least one of: an integer, a non-integer, a binary value, a hexadecimal value, or an alphanumeric character.
18. The non-transitory processor-readable storage medium of claim 15 , wherein the instructions to generate includes instructions to generate the prediction score for the at least one token based on at least one of: contextual information associated with the social media post, or extrinsic intelligence associated with the social media post.
19. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
generate, via the processor, a threat report for presentation to a data analyst, the threat report including the representation associated with the at least one of: the social media post, or the account associated with the social media post.
20. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
generate, via the processor, a threat report for presentation to a data analyst, the threat report including a representation of at least one of: contextual information associated with the social media post, or extrinsic intelligence associated with the social media post.
21. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
assign, via the processor, a classification to the social media post using the trained neural network language model, the classification having a value within a range of 0 to 1; and
include, via the processor, a representation of the classification in the threat report.
22. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
assign, via the processor, a classification to the social media post using the trained neural network language model, the classification being based on a multidimensional representation including a value of a maliciousness metric and a value of an authenticity metric; and
include, via the processor, a representation of the classification in the threat report.
23. The non-transitory processor-readable storage medium of claim 15 , wherein the plurality of features includes at least one string, and the instructions to tokenize includes instructions to map the at least one string to the value.
24. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
access the trained neural network language model from a model store.
25. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
determine a ground truth associated with the social media post; and
retrain the trained neural network language model based on the ground truth.
26. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
generate, using a plurality of neural network language models including the trained neural network language model, a plurality of prediction scores for the at least one token, the plurality of prediction scores including the prediction score; and
identify, based on the plurality of prediction scores, an information operations campaign associated with the social media post.
27. The non-transitory processor-readable storage medium of claim 15 , further storing processor-executable instructions to:
identify a group of social media accounts associated with a social media post signature, the social media post signature based on the at least one token.
28. The non-transitory processor-readable storage medium of claim 15 , the non-transitory processor-readable storage medium further storing processor-executable instructions to:
when the social media post is determined, based at least in part on extrinsic intelligence associated with meta-information of the social media post, to be associated with an information operations campaign, generate the threat report and issuing the threat warning to an analyst.
29. A system, comprising:
a processor; and
a memory operably coupled to the processor, the memory storing instructions that, when executed by the processor, cause the processor to:
retrieve, via a processor, a first neural network language model including a natural language model trained on a first dataset;
modify the first neural network language model, via transfer learning and based on a second dataset, to produce a second neural network language model;
receive, via the processor, social media post data associated with a social media post;
extract, via the processor, a plurality of features from the social media post data;
tokenize, via the processor, the plurality of features to produce at least one token including a value;
generate, using the second neural network language model, a prediction score for the at least one token;
when the prediction score exceeds a first threshold value, generate, via the processor, a threat warning including a representation associated with at least one of the social media post or an account associated with the social media post; and
when the prediction score does not exceed the first threshold value and does exceed a second threshold value, generate the threat report and issuing the threat warning to an analyst.
30. The system of claim 29 , wherein the first dataset is a general dataset and the second dataset is a target-specific dataset.