Combining advanced computational social science and graph theoretic techniques to reveal adversarial information operations

Abstract Social media has influenced socio-political aspects of many societies around the world. It is an effortless way for people to enhance their communication, connect with like-minded people, and share ideas. Online social networks (OSNs) can be used for noble causes by bringing together communities with common shared interests and to promote awareness of various causes. However, there is a dark side to the use of OSNs. OSNs can also be used as a coordination and amplification platform for attacks. For instance, adversaries can increase the impact of an attack by causing panic in an area by promoting attacks using OSNs. Public data can help adversaries to determine the best timing for attacks, scheduling attacks, and then using OSNs to coordinate attacks on networks or physical locations. This convergence of the cyber and physical worlds is known as cybernetics. In this paper, we introduce an integrated method to identify malicious behavior and the actors responsible for propagating this behavior via online social networks. Throughout history we have used surveillance techniques to monitor negative behavior, activities, and information. Quantitative socio-technical methods such as deviant cyber flash mob (DCFM) detection and focal structure analysis (FSA) can provide reconnaissance capabilities that enable cities and governments to look beyond internal data and identify threats based on active events. Groups of powerful hackers can be identified through FSA which is an integrated model that uses a betweenness centrality method at the node-level and spectral modularity at group-level to identify a hidden malicious and powerful focal structure (a subset of the network). Assessment of groups using DCFM methods can help to identify powerful actors and prevent attacks. In this study, we examine multiple data sets integrating the DCFM and FSA models to help cybersecurity experts see a better picture of the threat which will help to plan a better response.